Hallazgos — CRITICAL & HIGH (11)
| Severidad | Check ID | Descripcion / Recurso afectado | Framework |
|---|---|---|---|
| ● Critical | CKV_AWS_24 |
SSH abierto al mundo (0.0.0.0/0 en puerto 22)
aws_security_group_rule.bastion_ssh › terraform/main.tf:87
|
Terraform |
| ● Critical | CKV_AWS_145 |
RDS sin cifrado en reposo (storage_encrypted = false)
aws_db_instance.cloudagro_prod › terraform/main.tf:134
|
Terraform |
| ● Critical | CKV_K8S_20 |
Contenedor ejecutandose en modo privilegiado
Deployment/worker-processor › k8s/worker-deployment.yaml:42
|
Kubernetes |
| ● Critical | CKV_DOCKER_1 |
Imagen Docker ejecuta proceso como root (USER no definido)
Dockerfile:1-42 › imagen base: node:18
|
Dockerfile |
| ● High | CKV_AWS_18 |
S3 bucket de backups sin access logging habilitado
aws_s3_bucket.agro_backups › terraform/main.tf:58
|
Terraform |
| ● High | CKV_AWS_79 |
EC2 sin IMDSv2 — vulnerable a SSRF y robo de credenciales
aws_instance.api_server › terraform/main.tf:205
|
Terraform |
| ● High | CKV_AWS_21 |
S3 sin versionado — perdida de datos irrecuperable en sobrescritura
aws_s3_bucket.agro_uploads › terraform/main.tf:71
|
Terraform |
| ● High | CKV_K8S_1 |
Contenedor API ejecutandose como root (runAsNonRoot: false)
Deployment/cloudagro-api › k8s/api-deployment.yaml:35
|
Kubernetes |
| ● High | CKV_K8S_37 |
Sin drop de capabilities Linux (NET_RAW, SYS_ADMIN activas)
Deployment/cloudagro-api › k8s/api-deployment.yaml:38
|
Kubernetes |
| ● High | CKV_AWS_57 |
S3 bucket con ACL "public-read" — exposicion de datos agricolas
aws_s3_bucket.agro_reports › terraform/main.tf:89
|
Terraform |
| ● High | CKV_K8S_14 |
Imagen Docker con tag "latest" — builds no reproducibles
Deployment/cloudagro-api › k8s/api-deployment.yaml:28
|
Kubernetes |
Hallazgos — MEDIUM (9)
| Severidad | Check ID | Descripcion / Recurso afectado | Framework |
|---|---|---|---|
| ● Medium | CKV_K8S_8 |
Sin liveness probe — pods zombie sin reinicio automatico
Deployment/cloudagro-api › k8s/api-deployment.yaml
|
Kubernetes |
| ● Medium | CKV_K8S_9 |
Sin readiness probe — trafico a pods no preparados
Deployment/cloudagro-api › k8s/api-deployment.yaml
|
Kubernetes |
| ● Medium | CKV_K8S_12 |
Sin limite de memoria — riesgo de OOM y eviccion del nodo
Deployment/worker-processor › k8s/worker-deployment.yaml
|
Kubernetes |
| ● Medium | CKV_K8S_28 |
Sin limite de CPU — consumo descontrolado en el cluster
Deployment/worker-processor › k8s/worker-deployment.yaml
|
Kubernetes |
| ● Medium | CKV_AWS_86 |
CloudFront sin acceso logging — sin visibilidad de trafico CDN
aws_cloudfront_distribution.main › terraform/main.tf:178
|
Terraform |
| ● Medium | CKV_AWS_129 |
VPC Flow Logs deshabilitados — sin auditoria de trafico de red
aws_vpc.cloudagro_main › terraform/main.tf:12
|
Terraform |
| ● Medium | CKV_CUSTOM_2 |
Recursos sin tag "environment" ni "team" (politica corporativa)
aws_instance.api_server, aws_db_instance.cloudagro_prod (+3 mas)
|
Terraform |
| ● Medium | CKV_DOCKER_3 |
HEALTHCHECK no definido en Dockerfile
Dockerfile:1-42 › cloudagro-api
|
Dockerfile |
| ● Medium | CKV_AWS_111 |
IAM policy con accion "*" — permisos excesivos (least privilege)
aws_iam_policy.lambda_exec › terraform/main.tf:244
|
Terraform |
Checks Superados (muestra — 31 total)
✓ CKV_AWS_2
✓ CKV_AWS_7
✓ CKV_AWS_8
✓ CKV_AWS_25
✓ CKV_AWS_34
✓ CKV_AWS_56
✓ CKV_AWS_68
✓ CKV_AWS_91
✓ CKV_AWS_92
✓ CKV_AWS_99
✓ CKV_AWS_117
✓ CKV_AWS_119
✓ CKV_K8S_2
✓ CKV_K8S_4
✓ CKV_K8S_5
✓ CKV_K8S_6
✓ CKV_K8S_10
✓ CKV_K8S_11
✓ CKV_K8S_15
✓ CKV_K8S_16
✓ CKV_K8S_21
✓ CKV_K8S_25
✓ CKV_K8S_26
✓ CKV_K8S_30
✓ CKV_K8S_31
✓ CKV_K8S_43
✓ CKV_DOCKER_2
✓ CKV_DOCKER_5
✓ CKV_DOCKER_6
✓ CKV_DOCKER_7
✓ CKV_CUSTOM_1
$ checkov -d . --framework terraform,kubernetes,dockerfile \
-o json --output-file-path ./reports/checkov-report.json \
--external-checks-dir ./custom_checks/ \
--baseline .checkov.baseline
Passed checks: 31, Failed checks: 25, Skipped checks: 0
Run time: 4.37s | Resources scanned: 43 | Policies applied: 56