wiz-compliance-remediation

Wiz Compliance Remediation

Overview

Wiz evaluates cloud infrastructure against compliance frameworks (CIS Benchmarks, SOC 2, ISO 27001, PCI-DSS, etc.). This skill maps control failures to Terraform fixes.

CIS AWS Foundations Benchmark

CIS 2.1.1: S3 Bucket Encryption

Control: Ensure S3 bucket has server-side encryption enabled

Terraform Fix:

resource "aws_s3_bucket_server_side_encryption_configuration" "compliant" {
  bucket = aws_s3_bucket.example.id

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm     = "aws:kms"
      kms_master_key_id = aws_kms_key.s3.arn
    }
    bucket_key_enabled = true
  }
}

CIS 2.2.1: EBS Encryption

Control: Ensure EBS encryption is enabled by default

Terraform Fix:

resource "aws_ebs_encryption_by_default" "enabled" {
  enabled = true
}

resource "aws_ebs_default_kms_key" "default" {
  kms_key_id = aws_kms_key.ebs.arn
}

CIS 3.1: CloudTrail Enabled

Control: Ensure CloudTrail is enabled and logging to CloudWatch Logs

Terraform Fix:

resource "aws_cloudtrail" "organization" {
  name                          = "organization-trail"
  s3_bucket_name                = aws_s3_bucket.cloudtrail.id
  include_global_service_events = true
  is_multi_region_trail         = true
  enable_log_file_validation    = true
  depends_on                    = [aws_s3_bucket_policy.cloudtrail]

  event_selector {
    read_write_type           = "All"
    include_management_events = true

    data_resource {
      type   = "AWS::S3::Object"
      values = ["arn:aws:s3:::*/"]
    }

    data_resource {
      type   = "AWS::Lambda::Function"
      values = ["arn:aws:lambda:*:*:function/*"]
    }
  }

  cloud_watch_logs_group_arn = "${aws_cloudwatch_log_group.cloudtrail.arn}:*"
  cloud_watch_logs_role_arn  = aws_iam_role.cloudtrail.arn
}

resource "aws_cloudwatch_log_group" "cloudtrail" {
  name              = "/aws/cloudtrail/organization"
  retention_in_days = 90

  kms_key_id = aws_kms_key.logs.arn
}

CIS 3.2: CloudTrail Log File Validation

Control: Ensure CloudTrail log file validation is enabled

Terraform Fix:

resource "aws_cloudtrail" "example" {
  enable_log_file_validation = true  # Set to true
  # ... other config
}

CIS 4.1: Security Group Restrictions

Control: Ensure no security groups allow ingress from 0.0.0.0/0 to port 22

Terraform Fix:

# Remove or restrict
resource "aws_security_group_rule" "remove_ssh_public" {
  # DO NOT create this rule
  # type              = "ingress"
  # from_port         = 22
  # to_port           = 22
  # protocol          = "tcp"
  # cidr_blocks       = ["0.0.0.0/0"]
  # security_group_id = aws_security_group.example.id
}

# Instead, use restricted access
resource "aws_security_group_rule" "ssh_restricted" {
  type              = "ingress"
  from_port         = 22
  to_port           = 22
  protocol          = "tcp"
  cidr_blocks       = ["203.0.113.0/24"]  # Specific network
  security_group_id = aws_security_group.example.id
}

CIS 5.1: IAM Password Policy

Control: Ensure IAM password policy enforces strong passwords

Terraform Fix:

resource "aws_iam_account_password_policy" "strict" {
  minimum_password_length        = 14
  require_lowercase_characters   = true
  require_numbers                = true
  require_uppercase_characters   = true
  require_symbols                = true
  allow_users_to_change_password = true
  expire_passwords               = true
  max_password_age               = 90
  password_reuse_prevention      = 24
  hard_expiry                    = false
}

SOC 2 Type II Controls

CC6.1: Logical and Administrative Access Controls

Control: Access to systems is restricted to authorized individuals

Terraform Fix:

resource "aws_iam_policy" "least_privilege" {
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Action = [
          "s3:GetObject",
          "s3:ListBucket"
        ]
        Resource = [
          "arn:aws:s3:::my-bucket",
          "arn:aws:s3:::my-bucket/*"
        ]
        Condition = {
          StringEquals = {
            "aws:username" = "authorized-user"
          }
        }
      },
      {
        Effect   = "Deny"
        Action   = "*"
        Resource = "*"
        Condition = {
          Bool = {
            "aws:MultiFactorAuthPresent" = "false"
          }
        }
      }
    ]
  })
}

CC6.6: Encryption in Transit

Control: Data in transit is encrypted using TLS 1.2+

Terraform Fix:

resource "aws_lb_listener" "https" {
  load_balancer_arn = aws_lb.example.arn
  port              = 443
  protocol          = "HTTPS"
  ssl_policy        = "ELBSecurityPolicy-TLS13-1-2-2021-06"  # Strong ciphers only
  certificate_arn   = aws_acm_certificate.example.arn

  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.example.arn
  }
}

resource "aws_db_instance" "encrypted_transit" {
  db_instance_class    = "db.t3.micro"
  publicly_accessible  = false

  # Enforce SSL
  skip_final_snapshot = false
}

resource "aws_elasticache_replication_group" "encrypted" {
  transit_encryption_enabled = true
  auth_token_enabled         = true
}

CC7.2: Monitoring and Alerting

Control: System activity is monitored and alerting is configured

Terraform Fix:

resource "aws_cloudwatch_log_group" "security_events" {
  name              = "/aws/security-events"
  retention_in_days = 90
  kms_key_id        = aws_kms_key.logs.arn
}

resource "aws_cloudwatch_metric_alarm" "unauthorized_api_calls" {
  alarm_name          = "UnauthorizedAPICallsAlarm"
  comparison_operator = "GreaterThanOrEqualToDatapointsToAlarm"
  evaluation_periods  = 1
  metric_name         = "UnauthorizedAPICallsEventCount"
  namespace           = "CloudTrailMetrics"
  period              = 300
  statistic           = "Sum"
  threshold           = 1
  alarm_actions       = [aws_sns_topic.security_alerts.arn]

  dimensions = {
    AlarmName = "UnauthorizedAPICallsAlarm"
  }
}

resource "aws_sns_topic" "security_alerts" {
  name              = "security-alerts"
  kms_master_key_id = aws_kms_key.sns.id
}

ISO 27001 Annex A Controls

A.9.4.1: Access Restriction to Information and Other Associated Assets

Control: Access to information is restricted based on need-to-know

Terraform Fix:

resource "aws_iam_user_policy" "restricted_access" {
  user = aws_iam_user.developer.name

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid    = "AllowOnlyRequiredServices"
        Effect = "Allow"
        Action = [
          "s3:GetObject",
          "s3:ListBucket",
          "logs:CreateLogGroup",
          "logs:CreateLogStream"
        ]
        Resource = [
          "arn:aws:s3:::dev-bucket/*",
          "arn:aws:logs:us-east-1:ACCOUNT:log-group:/app/*"
        ]
      },
      {
        Sid    = "DenyProductionAccess"
        Effect = "Deny"
        Action = "*"
        Resource = [
          "arn:aws:s3:::prod-bucket/*",
          "arn:aws:rds:us-east-1:ACCOUNT:db:prod-*"
        ]
      }
    ]
  })
}

A.10.1.1: Cryptography Policy

Control: Cryptographic controls are implemented for information at rest and in transit

Terraform Fix:

resource "aws_kms_key" "default" {
  description             = "Default KMS key for encryption at rest"
  deletion_window_in_days = 10
  enable_key_rotation     = true

  tags = {
    Name = "default-encryption-key"
  }
}

resource "aws_s3_bucket_server_side_encryption_configuration" "encrypted" {
  bucket = aws_s3_bucket.example.id

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm     = "aws:kms"
      kms_master_key_id = aws_kms_key.default.arn
    }
  }
}

resource "aws_rds_cluster" "encrypted" {
  storage_encrypted = true
  kms_key_id        = aws_kms_key.default.arn
}

A.12.4.1: Event Logging

Control: User activity is logged and retained

Terraform Fix:

resource "aws_flow_log" "vpc" {
  iam_role_arn    = aws_iam_role.vpc_flow_logs.arn
  log_destination = aws_cloudwatch_log_group.vpc_flow_logs.arn
  traffic_type    = "ALL"
  vpc_id          = aws_vpc.example.id

  log_format = "$${srcAddr} $${dstAddr} $${srcPort} $${dstPort} $${protocol} $${packets} $${bytes} $${start} $${end} $${action} $${log-status} $${vpc-id} $${subnet-id} $${instance-id}"
}

resource "aws_cloudwatch_log_group" "vpc_flow_logs" {
  name              = "/aws/vpc/flow-logs"
  retention_in_days = 90
  kms_key_id        = aws_kms_key.logs.arn
}

Control Verification Checklist

After applying fixes:

• Terraform plan shows expected changes
• Changes applied: terraform apply
• Cloud console confirms configuration
• CloudTrail logs the changes
• Monitoring alerts are configured
• Wiz re-scan confirms control now passes
• No service disruption
• Changes documented in PR

Mapping Summary

Framework	Critical Controls	Priority
CIS AWS	3.1, 4.1, 5.1 (Logging, Access, Passwords)	P0
SOC 2	CC6.1, CC6.6, CC7.2 (Access, Encryption, Monitoring)	P0
ISO 27001	A.9.4.1, A.10.1.1, A.12.4.1 (Access, Crypto, Logging)	P0
PCI-DSS	Encryption, Access Control, Logging	P0