Security Improvements Across Terraform Examples and Go Source Files

[Rajesh-Sangepu]

Summary

This pull request includes multiple security improvements across Terraform examples and Go source files. The changes enhance security by enforcing secure TLS configurations, applying the principle of least privilege, strengthening encryption, preventing public exposure of resources, enabling logging, and mitigating Cross-Site Scripting (XSS) risks.

Changes Included

• Enforced TLS 1.2 as the minimum TLS version for Azure Storage Accounts.
• Enabled Storage Analytics logging for Azure Storage Queue Services to improve monitoring and diagnostics.
• Updated AWS IAM policies to follow the principle of least privilege by removing excessive administrative permissions.
• Configured AWS CloudFront Distributions to use secure minimum TLS protocol versions.
• Updated AWS Load Balancer configurations to enforce secure SSL/TLS policies (TLS 1.2 or higher) across example configurations.
• Configured AWS DynamoDB tables to use customer-managed AWS KMS keys for encryption.
• Removed public read access from AWS S3 bucket examples to prevent unauthorized access.
• Replaced the Go text/template package with html/template to ensure automatic HTML escaping and reduce the risk of Cross-Site Scripting (XSS) vulnerabilities.

Files Updated

• _examples/971/modules/azure/storage-account/module.tf
• _examples/1509/main.tf
• _examples/main.tf
• _examples/withVars/main.tf
• _examples/publicBlock/main.tf
• _examples/iam/main.tf
• cmd/tfsec-docs/indexes.go
• cmd/tfsec-docs/webpage.go

Purpose

These changes improve the overall security posture of the repository by implementing security best practices and strengthening the example configurations and source code without changing their intended functionality.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
0 out of 2 committers have signed the CLA.

❌ appuser
❌ Rajesh-Sangepu

---

appuser seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}