wiz-cloud-remediation

Wiz Cloud Misconfiguration Remediation

Overview

Wiz scans cloud infrastructure for misconfigurations across AWS, Azure, and GCP. This skill provides service-specific remediation patterns with Terraform code examples.

AWS Remediation

S3 Public Bucket

Wiz Finding: S3 bucket is publicly accessible

Terraform Fix:

resource "aws_s3_bucket" "example" {
  bucket = "my-bucket"
}

# Block all public access
resource "aws_s3_bucket_public_access_block" "example" {
  bucket = aws_s3_bucket.example.id

  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

S3 Without Encryption

Wiz Finding: S3 bucket is not encrypted

Terraform Fix:

resource "aws_s3_bucket_server_side_encryption_configuration" "example" {
  bucket = aws_s3_bucket.example.id

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm     = "aws:kms"
      kms_master_key_id = aws_kms_key.example.arn
    }
    bucket_key_enabled = true
  }
}

Security Group Open to Internet

Wiz Finding: Security group allows unrestricted ingress from 0.0.0.0/0

Terraform Fix:

# Bad: Open to everyone
resource "aws_security_group_rule" "bad" {
  type              = "ingress"
  from_port         = 22
  to_port           = 22
  protocol          = "tcp"
  cidr_blocks       = ["0.0.0.0/0"]
  security_group_id = aws_security_group.example.id
}

# Good: Restricted to specific network
resource "aws_security_group_rule" "good" {
  type              = "ingress"
  from_port         = 22
  to_port           = 22
  protocol          = "tcp"
  cidr_blocks       = ["203.0.113.0/24"]  # Corporate VPN
  security_group_id = aws_security_group.example.id
}

IAM Overly Permissive Policy

Wiz Finding: IAM policy has wildcard actions or resources

Terraform Fix:

# Bad: Wildcard permissions
resource "aws_iam_policy" "bad" {
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect   = "Allow"
      Action   = "s3:*"
      Resource = "*"
    }]
  })
}

# Good: Least privilege
resource "aws_iam_policy" "good" {
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect = "Allow"
      Action = [
        "s3:GetObject",
        "s3:ListBucket"
      ]
      Resource = [
        "arn:aws:s3:::my-bucket",
        "arn:aws:s3:::my-bucket/*"
      ]
    }]
  })
}

RDS Unencrypted

Wiz Finding: RDS instance is not encrypted

Terraform Fix:

resource "aws_db_instance" "example" {
  # Enable encryption
  storage_encrypted = true
  kms_key_id        = aws_kms_key.example.arn

  # Additional hardening
  deletion_protection      = true
  backup_retention_period  = 30
  multi_az                 = true
  publicly_accessible      = false

  skip_final_snapshot       = false
  final_snapshot_identifier = "my-db-final"
}

EC2 Without EBS Encryption

Wiz Finding: EC2 instance has unencrypted EBS volumes

Terraform Fix:

resource "aws_ebs_volume" "example" {
  availability_zone = "us-east-1a"
  size              = 40
  encrypted         = true
  kms_key_id        = aws_kms_key.example.arn
}

# Or for instances, enable by default
resource "aws_ebs_encryption_by_default" "example" {
  enabled = true
}

resource "aws_ebs_default_kms_key" "example" {
  kms_key_id = aws_kms_key.example.arn
}

ELB Without HTTPS

Wiz Finding: Load balancer allows unencrypted HTTP

Terraform Fix:

resource "aws_lb_listener" "https" {
  load_balancer_arn = aws_lb.example.arn
  port              = "443"
  protocol          = "HTTPS"
  ssl_policy        = "ELBSecurityPolicy-TLS13-1-2-2021-06"
  certificate_arn   = aws_acm_certificate.example.arn

  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.example.arn
  }
}

# Redirect HTTP to HTTPS
resource "aws_lb_listener" "http" {
  load_balancer_arn = aws_lb.example.arn
  port              = "80"
  protocol          = "HTTP"

  default_action {
    type = "redirect"

    redirect {
      port        = "443"
      protocol    = "HTTPS"
      status_code = "HTTP_301"
    }
  }
}

Azure Remediation

Storage Account Public Access

Wiz Finding: Storage account allows public blob access

Terraform Fix:

resource "azurerm_storage_account" "example" {
  account_replication_type = "RAGRS"
  https_traffic_only_enabled = true

  shared_access_key_enabled = false  # Disable shared keys
}

resource "azurerm_storage_account_network_rules" "example" {
  storage_account_id = azurerm_storage_account.example.id

  default_action             = "Deny"
  bypass                     = ["AzureServices"]
  virtual_network_subnet_ids = [azurerm_subnet.example.id]
}

Storage Without Encryption

Wiz Finding: Storage account is not encrypted with CMK

Terraform Fix:

resource "azurerm_storage_account" "example" {
  account_replication_type = "RAGRS"

  customer_managed_key {
    key_vault_key_id          = azurerm_key_vault_key.example.id
    user_assigned_identity_id = azurerm_user_assigned_identity.example.id
  }
}

Key Vault Without Purge Protection

Wiz Finding: Key Vault can be purged even if soft-delete enabled

Terraform Fix:

resource "azurerm_key_vault" "example" {
  soft_delete_retention_days = 90
  purge_protection_enabled   = true
  enable_rbac_authorization  = true

  # Restrict network access
  network_acls {
    default_action = "Deny"
    bypass         = ["AzureServices"]
  }
}

App Service Not HTTPS-Only

Wiz Finding: App Service allows unencrypted HTTP

Terraform Fix:

resource "azurerm_app_service" "example" {
  https_only = true

  site_config {
    min_tls_version = "1.2"
  }
}

GCP Remediation

Cloud Storage Public Access

Wiz Finding: Cloud Storage bucket allows public access

Terraform Fix:

resource "google_storage_bucket" "example" {
  location = "US"

  # Uniform bucket-level access (disable object ACLs)
  uniform_bucket_level_access = true

  # Prevent public access
  lifecycle {
    prevent_destroy = true
  }
}

resource "google_storage_bucket_iam_member" "restrict" {
  bucket = google_storage_bucket.example.name
  role   = "roles/storage.admin"
  member = "serviceAccount:${google_service_account.example.email}"
}

Cloud Storage Without Encryption

Wiz Finding: Cloud Storage bucket is not encrypted with CMK

Terraform Fix:

resource "google_storage_bucket" "example" {
  location = "US"

  encryption {
    default_kms_key_name = google_kms_crypto_key.example.id
  }
}

Cloud SQL Public IP

Wiz Finding: Cloud SQL instance has public IP enabled

Terraform Fix:

resource "google_sql_database_instance" "example" {
  database_version = "POSTGRES_15"

  settings {
    ip_configuration {
      require_ssl        = true
      ipv4_enabled       = false  # Disable public IP
      private_network    = google_compute_network.private.id
      enable_private_path_access = true
    }
  }
}

GKE Without Network Policy

Wiz Finding: GKE cluster does not have network policies enabled

Terraform Fix:

resource "google_container_cluster" "example" {
  network_policy {
    enabled = true
    provider = "PROVIDER_UNSPECIFIED"
  }

  workload_identity_config {
    workload_pool = "${var.project_id}.svc.id.goog"
  }
}

Verification

After applying fixes:

# Validate Terraform
terraform validate

# Plan to see changes
terraform plan -out=tfplan

# Apply changes
terraform apply tfplan

# Verify in cloud console
# AWS: Check S3 bucket policies, security group rules, RDS settings
# Azure: Check storage account network rules, Key Vault properties
# GCP: Check bucket permissions, SQL instance settings

# Re-scan with Wiz
wiz scan --project-id <project_id>

Cross-Provider Pattern Summary

Issue	AWS	Azure	GCP
Public Access	Security Group / S3 ACL	Storage ACL / Firewall	IAM / Bucket Policy
Encryption	KMS	Key Vault	Cloud KMS
Logging	CloudTrail / S3 logs	Activity Log	Cloud Audit Logs
Network Isolation	VPC / Security Group	VNet / NSG	VPC / Firewall
Authentication	IAM	RBAC	IAM