@hoanghainh/komagu 2.3.0 → 2.5.0

package/remediate/authz/patcher.py

@@ -12,6 +12,76 @@ from dataclasses import dataclass
 from pathlib import Path
 from typing import Any, Dict, List, Optional, Tuple
 
+JAVA_LEGACY_SHIM = "remediate/legacy_shims/java/OwnershipEnforcer.java"
+
+_SPRING_BUILD_FILES = ("pom.xml", "build.gradle", "build.gradle.kts", "gradle.properties")
+_SPRING_BOOT_VERSION_PATTERNS = (
+    re.compile(r"spring-boot-(?:starter-parent|dependencies)</artifactId>\s*<version>\s*(\d+)\."),
+    re.compile(r"<spring-boot\.version>\s*(\d+)\."),
+    re.compile(r"org\.springframework\.boot['\"]\)?\s+version\s+['\"](\d+)\."),
+    re.compile(r"org\.springframework\.boot:spring-boot[\w-]*:(\d+)\."),
+    re.compile(r"springBootVersion\s*=\s*['\"]?(\d+)\."),
+)
+_XML_COMMENT = re.compile(r"<!--.*?-->", re.DOTALL)
+_SPRING_CONTROLLER = re.compile(r"^\s*@(?:Rest)?Controller\b", re.MULTILINE)
+_SPRING_MAPPING_LINE = re.compile(r"^\s*@(?:Get|Post|Put|Patch|Delete|Request)Mapping\b")
+_JAVA_METHOD_LINE = re.compile(r"^\s*(?:public|protected)\b[^;=]*\(")
+_JAVA_DECLARATION_LINE = re.compile(r"^\s*(?:public|protected|private|abstract|final|class)\b")
+_JAVA_TYPE_NAME = re.compile(r"[A-Z][A-Za-z0-9_]*")
+_JAVA_LITERALS_AND_COMMENTS = re.compile(
+    r""""(?:\\.|[^"\\\n])*"|'(?:\\.|[^'\\\n])'|//[^\n]*|/\*.*?\*/""", re.DOTALL
+)
+_JAVA_PACKAGE_STATEMENT = re.compile(r"^[ \t]*package\s+[\w.]+\s*;[ \t]*(?:\r\n|\r|\n)", re.MULTILINE)
+
+
+def _newline_of(content: str) -> str:
+    """Return the line ending a generated line must use to match the surrounding file."""
+    if "\r\n" in content:
+        return "\r\n"
+    return "\r" if "\r" in content else "\n"
+
+
+def _declared_spring_boot_major(build_file: Path) -> Optional[int]:
+    """Return the Spring Boot major version a build file declares, if it declares one."""
+    try:
+        text = _XML_COMMENT.sub("", build_file.read_text(encoding="utf-8", errors="replace"))
+    except OSError:
+        return None
+    for pattern in _SPRING_BOOT_VERSION_PATTERNS:
+        match = pattern.search(text)
+        if match:
+            return int(match.group(1))
+    return None
+
+
+def _spring_boot_major(source_file: Path) -> Optional[int]:
+    """Find the Spring Boot major version from the nearest build file that declares one."""
+    for directory in Path(source_file).resolve().parents:
+        for name in _SPRING_BUILD_FILES:
+            major = _declared_spring_boot_major(directory / name)
+            if major is not None:
+                return major
+        if (directory / ".git").exists():
+            break
+    return None
+
+
+def _is_java_handler_line(lines: List[str], idx: int) -> bool:
+    """True when an annotation inserted above lines[idx] would land on a controller method."""
+    if not (_SPRING_MAPPING_LINE.match(lines[idx]) or _JAVA_METHOD_LINE.match(lines[idx])):
+        return False
+    declaration = next((line for line in lines[idx:] if _JAVA_DECLARATION_LINE.match(line)), "")
+    return "(" in declaration and not re.search(r"\bclass\b", declaration)
+
+
+def _java_uses_type(content: str, type_name: str) -> bool:
+    """True when code outside strings and comments references type_name, other than declaring it."""
+    if not _JAVA_TYPE_NAME.fullmatch(type_name):
+        return False
+    code = _JAVA_LITERALS_AND_COMMENTS.sub(" ", content)
+    code = re.sub(rf"\b(?:class|interface|enum)\s+{type_name}\b", " ", code)
+    return re.search(rf"\b{type_name}\b", code) is not None
+
 
 @dataclass
 class BOLARewriteResult:
@@ -84,43 +154,73 @@ class BOLAOwnershipPatcher:
 
     def ensure_imports(self, content: str, lang: str) -> Tuple[str, bool]:
         """Ensure necessary Komagu authorization import is present at the top of the file."""
+        newline = _newline_of(content)
         if lang in ("typescript", "javascript"):
             if "from '@hoanghainh/komagu'" in content or 'from "@hoanghainh/komagu"' in content:
                 return content, False
-            import_stmt = "import { RequireOwnership, OwnershipGuard, ResourceOperation } from '@hoanghainh/komagu';\n"
+            import_stmt = "import { RequireOwnership, OwnershipGuard, ResourceOperation } from '@hoanghainh/komagu';" + newline
             return import_stmt + content, True
 
         elif lang == "csharp":
             if "using Komagu.Security.Authorization;" in content:
                 return content, False
-            import_stmt = "using Komagu.Security.Authorization;\n"
+            import_stmt = "using Komagu.Security.Authorization;" + newline
             return import_stmt + content, True
 
         elif lang == "java":
-            if "import io.komagu.security.authorization.RequireOwnership;" in content:
+            if "import io.komagu.security.spring.RequireOwnership;" in content:
                 return content, False
-            import_stmt = "import io.komagu.security.authorization.RequireOwnership;\nimport io.komagu.security.authorization.ResourceOperation;\n"
-            if "package " in content:
-                parts = content.split(";\n", 1)
-                return parts[0] + ";\n\n" + import_stmt + parts[1], True
+            import_stmt = (
+                "import io.komagu.security.spring.RequireOwnership;" + newline
+                + "import io.komagu.security.authorization.ResourceOperation;" + newline
+            )
+            package = _JAVA_PACKAGE_STATEMENT.search(content)
+            if package:
+                return content[: package.end()] + newline + import_stmt + content[package.end():], True
             return import_stmt + content, True
 
         elif lang == "python":
             if "from remediate.authz.python.komagu_authz" in content:
                 return content, False
-            import_stmt = "from remediate.authz.python.komagu_authz import RequireOwnership, ResourceOperation\n"
+            import_stmt = "from remediate.authz.python.komagu_authz import RequireOwnership, ResourceOperation" + newline
             return import_stmt + content, True
 
         return content, False
 
+    def _java_manual_reason(
+        self, target_file: Path, content: str, lines: List[str], idx: int, resource: str
+    ) -> Optional[str]:
+        """Say why @RequireOwnership cannot be inserted here, or None when it can."""
+        if not _SPRING_CONTROLLER.search(content):
+            problem = "this file is not a Spring controller"
+        elif _spring_boot_major(target_file) != 3:
+            problem = "no Spring Boot 3 version was found in the build files"
+        elif not _is_java_handler_line(lines, idx):
+            problem = "the finding does not point at a controller method"
+        elif not _java_uses_type(content, resource):
+            problem = f"the entity class could not be confirmed from the route (inferred {resource!r})"
+        else:
+            return None
+        return (
+            f"@RequireOwnership needs a Spring Boot 3 controller method, but {problem}; requires manual "
+            f"remediation: call OwnershipEnforcer.requireOwnership(...) before the object is read or "
+            f"written (see {JAVA_LEGACY_SHIM})."
+        )
+
     def patch_file(
         self,
         target_file: Path,
         line_number: int,
         finding: Dict[str, Any],
+        content: Optional[str] = None,
     ) -> Tuple[str, BOLARewriteResult]:
-        """Inject appropriate ownership guard above the method or route at line_number."""
-        content = target_file.read_text(encoding="utf-8", errors="replace")
+        """Inject appropriate ownership guard above the method or route at line_number.
+
+        Pass the already-decoded `content` to keep the caller's encoding and pending edits.
+        Without it the file must be valid UTF-8: replacing bytes would corrupt the source.
+        """
+        if content is None:
+            content = Path(target_file).read_bytes().decode("utf-8")
         lines = content.splitlines(keepends=True)
         idx = line_number - 1
 
@@ -150,6 +250,7 @@ class BOLAOwnershipPatcher:
                 explanation="Ownership guard already present at target line.",
             )
 
+        newline = _newline_of(content)
         guard_lines: List[str] = []
 
         if lang in ("typescript", "javascript"):
@@ -173,6 +274,14 @@ class BOLAOwnershipPatcher:
             guard_lines.append(f"{indent}[RequireOwnership(typeof({resource}), idRouteParameter: \"id\", operation: ResourceOperation.{cs_op})]\n")
 
         elif lang == "java":
+            manual_reason = self._java_manual_reason(target_file, content, lines, idx, resource)
+            if manual_reason:
+                return content, BOLARewriteResult(
+                    original_line=target_line,
+                    patched_line=target_line,
+                    changed=False,
+                    explanation=manual_reason,
+                )
             guard_lines.append(f"{indent}@RequireOwnership(entityClass = {resource}.class, operation = ResourceOperation.{operation})\n")
 
         elif lang == "python":
@@ -186,7 +295,7 @@ class BOLAOwnershipPatcher:
                 explanation=f"Automated BOLA ownership guard not supported for language '{lang}'; requires manual remediation.",
             )
 
-        guard_snippet = "".join(guard_lines)
+        guard_snippet = "".join(guard_lines).replace("\n", newline)
         lines.insert(idx, guard_snippet)
         patched_body = "".join(lines)
 

package/remediate/authz/tests/test_bola_patcher.py

@@ -106,6 +106,9 @@ class TestBOLAOwnershipPatcher(unittest.TestCase):
 
     def test_patch_spring_boot_controller(self) -> None:
         """Spring Boot controller method must receive @RequireOwnership annotation and import."""
+        (self.test_dir / "build.gradle").write_text(
+            "plugins { id 'org.springframework.boot' version '3.2.1' }\n", encoding="utf-8"
+        )
         controller_file = self.test_dir / "OrderController.java"
         controller_file.write_text(
             "package com.example.demo;\n\n"
@@ -127,7 +130,7 @@ class TestBOLAOwnershipPatcher(unittest.TestCase):
 
         patched_content, res = self.patcher.patch_file(controller_file, 5, finding)
         self.assertTrue(res.changed)
-        self.assertIn("import io.komagu.security.authorization.RequireOwnership;", patched_content)
+        self.assertIn("import io.komagu.security.spring.RequireOwnership;", patched_content)
         self.assertIn("@RequireOwnership(entityClass = Order.class, operation = ResourceOperation.READ)", patched_content)
 
     def test_patch_python_fastapi(self) -> None:

package/remediate/edge/coraza/Caddyfile

@@ -19,7 +19,7 @@
         `
     }
 
-    reverse_proxy http://mock-backend:5000 {
+    reverse_proxy {$KOMAGU_UPSTREAM:http://mock-backend:5000} {
         header_up Host {upstream_hostport}
         header_up X-Real-IP {remote_host}
     }

package/remediate/edge/coraza/Dockerfile

@@ -7,3 +7,12 @@ RUN xcaddy build \
 FROM caddy:alpine
 
 COPY --from=builder /usr/bin/caddy /usr/bin/caddy
+
+# Caddy stores runtime state under /data and /config; it listens on :8080, so no
+# bind capability is needed
+RUN addgroup -S caddy \
+    && adduser -S -G caddy caddy \
+    && mkdir -p /data/caddy /config/caddy \
+    && chown -R caddy:caddy /data /config
+
+USER caddy

package/remediate/edge/coraza/rules/coraza-crs-custom.conf

@@ -20,6 +20,18 @@ SecAction \
    t:none,\
    setvar:'tx.allowed_request_content_type=|application/x-www-form-urlencoded| |multipart/form-data| |text/xml| |application/xml| |application/soap+xml| |application/x-amf| |application/json| |application/cloudevents+json| |application/problem+json|'"
 
+# Struts 1 token forms post a field named org.apache.struts.taglib.html.TOKEN, which CRS 944130 reads as a Java class.
+# Only that field name is excluded, and the raw body of such a request; ARGS still carries every parsed field,
+# so Java classes in any value or other field name still score.
+SecRule ARGS_NAMES "@streq org.apache.struts.taglib.html.TOKEN" \
+  "id:200002,\
+   phase:2,\
+   pass,\
+   nolog,\
+   t:none,\
+   ctl:ruleRemoveTargetById=944130;ARGS_NAMES:org.apache.struts.taglib.html.TOKEN,\
+   ctl:ruleRemoveTargetById=944130;REQUEST_BODY"
+
 # Custom rule: Ensure SQL injection indicators in query string, URI, JSON body, or headers trigger HTTP 403
 # Tuned to prevent false positives on dashes, hash symbols, or benign words (e.g. ?q=a--b, ?name=C#)
 SecRule ARGS|REQUEST_URI|REQUEST_HEADERS "@rx (?i)(?:(?:\bunion\b[\s\S]*?\bselect\b)|(?:\b(?:or|and)\b\s+(?:(?:\d+\s*=\s*\d+)|(?:['\"][^'\"]+['\"]\s*=\s*['\"]?[^'\"\s]+)|true\b|false\b))|(?:;\s*(?:drop|alter|truncate|delete)\s+table\b)|(?:\-\-(?:[\s+\r\n\t]|$))|(?:\/\*[\s\S]*?\*\/)|(?:['\"`]\s*#|#\s+))" \

package/remediate/edge/coraza/virtual_patcher.py

@@ -13,11 +13,15 @@ from pathlib import Path
 from typing import Any, Dict, List, Optional, Tuple, Union
 
 
+SESSION_ROUTE_SUFFIXES = (".do", ".action", ".jsp", ".jspx")
+
+
 class VirtualPatcher:
     """Generates OWASP Coraza / ModSecurity SecRule virtual patches from LSA findings."""
 
     def __init__(self, start_rule_id: int = 1100001) -> None:
         self.current_rule_id = start_rule_id
+        self.skipped: List[str] = []
 
     def _sanitize_regex_path(self, path: str) -> str:
         """Convert a parameterized endpoint path like /api/orders/{id} into a regex."""
@@ -121,6 +125,20 @@ SecRule REQUEST_URI "@rx {path_regex}" \\
 """
         return rule
 
+    @staticmethod
+    def _finding_path(finding: Dict[str, Any]) -> Optional[str]:
+        return (finding.get("attack_vector") or {}).get("path") or (finding.get("endpoint") or {}).get("path")
+
+    @staticmethod
+    def _is_session_route(path: Optional[str]) -> bool:
+        """Legacy form actions sign users in with a session cookie, so no Authorization header is expected."""
+        return bool(path) and path.split("?", 1)[0].lower().endswith(SESSION_ROUTE_SUFFIXES)
+
+    def _skip(self, rules: List[str], fid: str, reason: str) -> None:
+        note = f"{fid}: no virtual patch, {reason}"
+        self.skipped.append(note)
+        rules.append(f"# {note}\n")
+
     def generate_patches_from_findings(
         self,
         findings_data: Union[Dict[str, Any], List[Dict[str, Any]]],
@@ -146,6 +164,9 @@ SecRule REQUEST_URI "@rx {path_regex}" \\
                 continue
 
             if cat == "bola" or fid.startswith("BOLA"):
+                if self._is_session_route(self._finding_path(item)):
+                    self._skip(rules, fid, "a WAF cannot check object ownership on a session-cookie route; fix it in code")
+                    continue
                 rule_text = self.generate_bola_rule(item)
                 rules.append(rule_text)
                 manifest.append({
@@ -155,6 +176,9 @@ SecRule REQUEST_URI "@rx {path_regex}" \\
                     "endpoint": item.get("endpoint", {}).get("path", ""),
                 })
             elif cat in ("sql_injection", "nosql_injection") or fid.startswith("INJ"):
+                if not self._finding_path(item):
+                    self._skip(rules, fid, "the finding names no route; the general CRS and Komagu SQLi rules still apply")
+                    continue
                 rule_text = self.generate_sqli_rule(item)
                 rules.append(rule_text)
                 manifest.append({

package/remediate/edge/docker-compose.yml

@@ -13,9 +13,9 @@ services:
       KONG_ADMIN_LISTEN: 0.0.0.0:8001
       KOMAGU_JWT_SECRET: ${KOMAGU_JWT_SECRET:-komagu-default-test-jwt-secret-key-32chars}
     volumes:
-      - ./kong/kong.yaml:/kong/declarative/kong.yaml:ro
+      - ${KOMAGU_KONG_CONFIG:-./kong/kong.yaml}:/kong/declarative/kong.yaml:ro
     ports:
-      - "8000:8000"  # Public API Gateway proxy port
+      - "${KOMAGU_EDGE_BIND:-0.0.0.0}:8000:8000"  # Public API Gateway proxy port
       - "127.0.0.1:8001:8001"  # Kong Admin API bound strictly to loopback interface on host
     depends_on:
       - coraza-waf
@@ -34,10 +34,15 @@ services:
       context: ./coraza
     image: komagu-coraza-caddy:local
     container_name: komagu-coraza-waf
+    environment:
+      KOMAGU_UPSTREAM: ${KOMAGU_UPSTREAM:-http://mock-backend:5000}
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
     volumes:
       - ./coraza/Caddyfile:/etc/caddy/Caddyfile:ro
       - ./coraza/coraza.conf:/etc/coraza/coraza.conf:ro
       - ./coraza/rules:/etc/coraza/rules:ro
+      - ${KOMAGU_VIRTUAL_PATCH_FILE:-./coraza/rules/virtual-patches.conf}:/etc/coraza/rules/virtual-patches.conf:ro
     expose:
       - "8080"
     depends_on:

package/remediate/edge/kong/kong-legacy-session.yaml

@@ -0,0 +1,51 @@
+# Kong profile for a legacy application that signs users in with a session cookie (JSESSIONID) and form actions.
+# Every path goes to Coraza, and rate limiting is per client IP because these requests carry no JWT.
+# Use it with: komagu protect --target <url> --config remediate/edge/kong/kong-legacy-session.yaml --up
+_format_version: "3.0"
+
+services:
+  - name: komagu-legacy-app
+    url: http://coraza-waf:8080
+    connect_timeout: 5000
+    read_timeout: 30000
+    write_timeout: 30000
+    routes:
+      - name: legacy-all-paths
+        paths:
+          - /
+        strip_path: false
+        preserve_host: false
+        protocols:
+          - http
+          - https
+        plugins:
+          - name: rate-limiting
+            config:
+              minute: 120
+              second: 10
+              limit_by: ip
+              policy: redis
+              fault_tolerant: false
+              redis:
+                host: redis
+                port: 6379
+                timeout: 2000
+                database: 0
+              hide_client_headers: false
+              error_code: 429
+              error_message: "Rate limit exceeded. Please back off and retry."
+
+plugins:
+  - name: correlation-id
+    config:
+      header_name: X-Correlation-ID
+      generator: uuid#counter
+      echo_downstream: true
+
+  - name: response-transformer
+    config:
+      remove:
+        headers:
+          - X-Kong-Upstream-Latency
+          - X-Kong-Proxy-Latency
+          - Server

package/remediate/edge/mock-backend/Dockerfile

@@ -5,4 +5,6 @@ COPY app.py .
 
 EXPOSE 5000
 
+USER nobody
+
 CMD ["python", "-u", "app.py"]

package/remediate/edge/tests/test_edge_security.py

@@ -380,9 +380,12 @@ class TestCorazaWafContainer(unittest.TestCase):
             _docker("rm", "-f", cls.container)
 
     @classmethod
-    def _status(cls, path, body=None):
+    def _status(cls, path, body=None, form=None):
         headers = {"Content-Type": "application/json"} if body is not None else {}
         data = json.dumps(body).encode("utf-8") if body is not None else None
+        if form is not None:
+            headers = {"Content-Type": "application/x-www-form-urlencoded"}
+            data = form.encode("ascii")
         req = urllib.request.Request(f"http://127.0.0.1:{cls.port}{path}", data=data, headers=headers)
         try:
             with urllib.request.urlopen(req, timeout=5) as resp:
@@ -423,6 +426,23 @@ class TestCorazaWafContainer(unittest.TestCase):
         self.assertNotEqual(self._status("/api/v1/orders?q=salt+and+pepper=yes"), 403)
         self.assertNotEqual(self._status("/api/v1/orders?name=C%23"), 403)
 
+    def test_struts_token_field_name_not_blocked(self):
+        """CRS 944130 reads the Struts 1 token field name as a Java class, which blocked every token form (#374)."""
+        self._require_running()
+        self.assertNotEqual(self._status("/order/update.do?org.apache.struts.taglib.html.TOKEN=abc123"), 403)
+
+    def _post_form(self, body):
+        return self._status("/order/update.do", form=body)
+
+    def test_struts_token_form_post_not_blocked(self):
+        self._require_running()
+        self.assertNotEqual(self._post_form("org.apache.struts.taglib.html.TOKEN=abc123&id=1&note=hello"), 403)
+
+    def test_java_class_in_a_value_still_blocked(self):
+        self._require_running()
+        self.assertEqual(self._status("/order/update.do?note=java.lang.Runtime"), 403)
+        self.assertEqual(self._post_form("org.apache.struts.taglib.html.TOKEN=abc123&note=java.lang.Runtime"), 403)
+
 
 class TestCorazaWafSkipLogic(unittest.TestCase):
     """

package/remediate/resilience/terraform/backup_worm.tf

@@ -148,6 +148,8 @@ resource "aws_s3_bucket_versioning" "logs_versioning" {
   }
 }
 
+# S3 server access logging requires SSE-S3 on the destination bucket: AWS does
+# not support SSE-KMS here, so a customer managed key cannot be used.
 resource "aws_s3_bucket_server_side_encryption_configuration" "logs_encryption" {
   provider = aws.secondary
   bucket   = aws_s3_bucket.worm_access_logs.id
@@ -344,6 +346,19 @@ resource "aws_s3_bucket_policy" "deny_destructive_actions" {
 }
 
 # 10. Cross-Region Replication Infrastructure (Primary Tokyo -> Secondary Osaka)
+resource "aws_kms_key" "primary_state_key" {
+  count                   = var.enable_cross_region_replication ? 1 : 0
+  provider                = aws.primary
+  description             = "KMS Key for Komagu primary state backups in Tokyo"
+  deletion_window_in_days = 30
+  enable_key_rotation     = true
+
+  tags = {
+    Name        = "${var.project_name}-primary-state-key"
+    Environment = var.environment
+  }
+}
+
 resource "aws_s3_bucket" "primary_backup" {
   count    = var.enable_cross_region_replication ? 1 : 0
   provider = aws.primary
@@ -382,8 +397,11 @@ resource "aws_s3_bucket_server_side_encryption_configuration" "primary_encryptio
   bucket   = aws_s3_bucket.primary_backup[0].id
 
   rule {
+    bucket_key_enabled = true
+
     apply_server_side_encryption_by_default {
-      sse_algorithm = "AES256"
+      kms_master_key_id = aws_kms_key.primary_state_key[0].arn
+      sse_algorithm     = "aws:kms"
     }
   }
 }
@@ -465,6 +483,16 @@ resource "aws_iam_policy" "replication_policy" {
         ]
         Effect   = "Allow"
         Resource = "${aws_s3_bucket.immutable_worm_backup.arn}/*"
+      },
+      {
+        Action   = ["kms:Decrypt"]
+        Effect   = "Allow"
+        Resource = aws_kms_key.primary_state_key[0].arn
+      },
+      {
+        Action   = ["kms:Encrypt", "kms:GenerateDataKey*"]
+        Effect   = "Allow"
+        Resource = aws_kms_key.worm_backup_key.arn
       }
     ]
   })
@@ -486,9 +514,19 @@ resource "aws_s3_bucket_replication_configuration" "crr" {
     id     = "ReplicateToOsakaWORM"
     status = "Enabled"
 
+    source_selection_criteria {
+      sse_kms_encrypted_objects {
+        status = "Enabled"
+      }
+    }
+
     destination {
       bucket        = aws_s3_bucket.immutable_worm_backup.arn
       storage_class = "STANDARD"
+
+      encryption_configuration {
+        replica_kms_key_id = aws_kms_key.worm_backup_key.arn
+      }
     }
   }
 

package/remediate/resilience/terraform/main.tf

@@ -64,7 +64,7 @@ resource "aws_subnet" "primary_public_1a" {
   vpc_id                  = aws_vpc.primary.id
   cidr_block              = "10.100.1.0/24"
   availability_zone       = "${var.primary_region}a"
-  map_public_ip_on_launch = true
+  map_public_ip_on_launch = false # Internet-facing resources must request a public IP explicitly
 
   tags = {
     Name = "${var.project_name}-primary-public-1a"
@@ -76,7 +76,7 @@ resource "aws_subnet" "primary_public_1c" {
   vpc_id                  = aws_vpc.primary.id
   cidr_block              = "10.100.2.0/24"
   availability_zone       = "${var.primary_region}c"
-  map_public_ip_on_launch = true
+  map_public_ip_on_launch = false # Internet-facing resources must request a public IP explicitly
 
   tags = {
     Name = "${var.project_name}-primary-public-1c"
@@ -102,10 +102,22 @@ resource "aws_security_group" "primary_default_sg" {
   description = "Default egress-only security group for primary workloads"
 
   egress {
+    description = "Workload traffic inside the primary VPC"
     from_port   = 0
     to_port     = 0
     protocol    = "-1"
-    cidr_blocks = ["0.0.0.0/0"]
+    cidr_blocks = [aws_vpc.primary.cidr_block]
+  }
+
+  dynamic "egress" {
+    for_each = length(var.workload_egress_cidrs) > 0 ? [1] : []
+    content {
+      description = "HTTPS to operator-approved external destinations"
+      from_port   = 443
+      to_port     = 443
+      protocol    = "tcp"
+      cidr_blocks = var.workload_egress_cidrs
+    }
   }
 
   tags = {

package/remediate/resilience/terraform/variables.tf

@@ -35,3 +35,14 @@ variable "enable_cross_region_replication" {
   type        = bool
   default     = true
 }
+
+variable "workload_egress_cidrs" {
+  description = "External CIDR ranges primary workloads may reach over HTTPS. Empty keeps egress inside the VPC."
+  type        = list(string)
+  default     = []
+
+  validation {
+    condition     = !contains(var.workload_egress_cidrs, "0.0.0.0/0") && !contains(var.workload_egress_cidrs, "::/0")
+    error_message = "workload_egress_cidrs must list specific ranges, not 0.0.0.0/0 or ::/0."
+  }
+}

package/remediate/resilience/tests/test_resilience.py

@@ -66,6 +66,22 @@ class TestMultiRegionResilience(unittest.TestCase):
         self.assertIn("aws_route_table_association", content)
         self.assertIn("aws_security_group", content)
 
+    def test_03b_terraform_network_and_encryption_hardening(self) -> None:
+        """Verifies no automatic public IPs, no open egress and CMK-encrypted primary backups."""
+        tf_dir = os.path.join(MODULE_ROOT, "terraform")
+        with open(os.path.join(tf_dir, "main.tf"), "r", encoding="utf-8") as f:
+            main_tf = f.read()
+        with open(os.path.join(tf_dir, "backup_worm.tf"), "r", encoding="utf-8") as f:
+            worm_tf = f.read()
+
+        self.assertNotIn("map_public_ip_on_launch = true", main_tf)
+        sg_start = main_tf.index('resource "aws_security_group" "primary_default_sg"')
+        sg_block = main_tf[sg_start:main_tf.index("# 2. Secondary Standby DR VPC")]
+        self.assertNotIn("0.0.0.0/0", sg_block)
+
+        self.assertIn("aws_kms_key.primary_state_key[0].arn", worm_tf)
+        self.assertIn("replica_kms_key_id = aws_kms_key.worm_backup_key.arn", worm_tf)
+
     def test_04_dr_snapshot_creation_and_integrity(self) -> None:
         """Verifies immutable snapshot creation and cryptographic integrity check."""
         mgr = DRManager(secondary_region="ap-northeast-3")