DevSecOps and security cheat sheet

trivy fs --severity HIGH,CRITICAL --exit-code 1 .
trivy image --ignore-unfixed --severity HIGH,CRITICAL registry.example.com/app:1.4
trivy config ./terraform
checkov -d ./terraform
semgrep scan --config auto .
syft registry.example.com/app:1.4 -o spdx-json > sbom.json
grype sbom:./sbom.json --fail-on high

trufflehog filesystem . --only-verified
detect-secrets scan > .secrets.baseline
aws sts get-caller-identity
aws iam list-access-keys --user-name deploy
aws iam update-access-key --user-name deploy --access-key-id AKIA... --status Inactive

cosign generate-key-pair
cosign sign --key cosign.key registry.example.com/app@sha256:abc123
cosign verify --key cosign.pub registry.example.com/app@sha256:abc123
cosign attest --predicate sbom.json --type spdxjson --key cosign.key registry.example.com/app@sha256:abc123

docker run --rm --read-only --tmpfs /tmp --cap-drop ALL \
  --security-opt no-new-privileges --pids-limit 200 --memory 256m app:1.4
docker run --rm --user 65532:65532 app:1.4
docker scout cves app:1.4

kubectl auth can-i --list -n shop --as system:serviceaccount:shop:web
kubectl get clusterrolebindings -o wide | grep cluster-admin
kubectl get pods -A -o jsonpath='{range .items[*]}{.metadata.namespace}{" "}{.metadata.name}{" "}{.spec.containers[*].securityContext.privileged}{"\n"}{end}'
kubectl label ns shop pod-security.kubernetes.io/enforce=restricted
kubectl get networkpolicy -A
kubectl get secret db -n shop -o jsonpath='{.data.password}' | base64 -d

aws iam get-account-authorization-details > iam.json
aws iam generate-credential-report && aws iam get-credential-report
aws accessanalyzer list-findings --analyzer-arn ARN
aws s3api get-public-access-block --bucket NAME
aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=ConsoleLogin
aws ec2 describe-security-groups --filters Name=ip-permission.cidr,Values=0.0.0.0/0

openssl s_client -connect example.com:443 -servername example.com </dev/null | openssl x509 -noout -dates -issuer -subject
openssl x509 -in cert.pem -noout -text | head -30
nmap -sV --script ssl-enum-ciphers -p 443 example.com

ss -tunap | head -40
last -a | head
sudo journalctl -u sshd --since "1 hour ago" | grep -i "failed\|accepted"
sudo iptables -I INPUT -s 203.0.113.50 -j DROP
sudo tcpdump -i eth0 -w /secure/capture.pcap host 203.0.113.50

echo "$TOKEN" | cut -d. -f2 | base64 -d 2>/dev/null | jq '{iss,aud,exp,scope}'
aws iam list-users --query 'Users[].UserName' --output text
aws iam get-user --user-name svc-old --query 'User.PasswordLastUsed'

curl -sI https://example.com | grep -iE 'strict-transport|content-security|x-content-type'
curl -s -o /dev/null -w "%{http_code}\n" https://api.example.com/invoices/10043 -H "Authorization: Bearer $TOKEN"

opa eval -d policy/ -i plan.json "data.terraform.security.deny"
kubectl apply -f policy.yaml && kubectl get policyreport -A

aws ec2 describe-security-groups --filters Name=ip-permission.cidr,Values=0.0.0.0/0 --query 'SecurityGroups[].GroupId'
dig +short CNAME promo.example.com
dig +short TXT example.com | grep -i spf

aws s3api put-object-lock-configuration --bucket backups --object-lock-configuration '{"ObjectLockEnabled":"Enabled","Rule":{"DefaultRetention":{"Mode":"COMPLIANCE","Days":30}}}'
aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=DeleteSnapshot --max-results 5