Initial security checks + docs + Terraform module skeleton + CI workflow

[HPxt]

Motivation

• Introduce a minimal, opinionated baseline for cloud security checks (AWS + GCP) so contributors can add automated CIS-based controls that are easy to understand and reproduce.
• Provide documentation and a contribution guide to standardize how new checks, evidence and Terraform remediations are proposed.
• Add Terraform module skeletons to encourage IaC remediations for AWS baselines.
• Add a GitHub Actions workflow to validate repository structure and exercise a sample check for continuous verification.

Description

• Add a new CI workflow .github/workflows/security-checks.yml that defines a validate-structure job which checks script executability, runs a sample check (./checks/aws/logging/check_cloudtrail_enabled.sh || true) and uploads example evidence from output/examples/.
• Add multiple shell checks under checks/ for AWS and GCP: check_cloudtrail_enabled.sh, check_account_password_policy.sh, check_security_groups_open_ports.sh, check_audit_logging_enabled.sh, check_overprivileged_roles.sh, and check_firewall_allow_all.sh, each returning concise JSON and validating presence of aws/gcloud CLIs.
• Add documentation and templates under docs/ including metodologia.md, matriz-cis.md, domain guides for AWS/GCP, and a CONTRIBUTING.md to standardize contributions.
• Add example evidence JSON files under output/examples/ and create Terraform AWS module skeletons and an example terraform/aws/examples/baseline/main.tf to map checks to future remediations.

Testing

• No automated CI runs have been executed for this PR yet.
• The newly added workflow defines automated checks that will run on pull requests, including test -x validations of scripts, a simulated run of ./checks/aws/logging/check_cloudtrail_enabled.sh (guarded with || true), and artifact upload via actions/upload-artifact@v4.
• Each script includes basic runtime guards that return JSON ERROR status when required CLIs are missing, enabling deterministic CI behavior when the workflow runs.
• Future PRs should trigger the workflow to validate that executables and sample check runs succeed in the GitHub Actions environment.

---

Codex Task

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 053f5d36a2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Validate audit configs, not log sinks

This check marks CIS-GCP-2.1 as PASS whenever gcloud logging sinks list succeeds, but that command only lists sink resources (the SDK docs describe it as “list the defined sinks”), not whether Cloud Audit Logs are enabled. Google’s audit logging docs place this control in IAM policy auditConfigs (via gcloud projects get-iam-policy). In a project with default/disabled Data Access audit logging but normal Logging permissions, this branch returns a false PASS.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Verify CloudTrail logging status before passing

The script passes when describe-trails returns at least one trail, but AWS CLI documents describe-trails as retrieving trail “settings,” not active logging state. Logging activity is exposed by get-trail-status (IsLogging: whether the trail is currently logging). If a trail exists but logging was stopped, this code still reports PASS for CIS-AWS-3.1, which is a false negative.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Include IPv6 public CIDRs in SG exposure query

The security group filter only checks IpRanges for 0.0.0.0/0, but describe-security-groups returns IPv6 sources separately under Ipv6Ranges/CidrIpv6. Any inbound rule open to ::/0 bypasses this query, so internet-exposed groups can be reported as PASS/WARN incorrectly depending on IPv4 presence.

Useful? React with 👍 / 👎.