Security Considerations
Our code is continuously scanned using Checkov. The following security considerations are documented for transparency:
| Check | Details | Reason |
|---|---|---|
| CKV_TF_1 | Ensure Terraform module sources use a commit hash | For easy experimentation, we set version of module instead of a commit hash. Consider implementing a commit hash in production. Read more |
| CKV2_K8S_6 | Minimize pods without NetworkPolicy | All Pod-to-Pod communication is allowed for experimentation. Amazon VPC CNI supports Kubernetes Network Policies for production. |
| CKV_K8S_8 | Liveness Probe Should be Configured | No health checks for experimentation. Implement health checks in production. |
| CKV_K8S_9 | Readiness Probe Should be Configured | Same as above. |
| CKV_K8S_22 | Use read-only filesystem where possible | Exception for workloads requiring R/W. Configure read-only root. |
| CKV_K8S_23 | Minimize root containers | Default root containers for demo compatibility. For production, use runAsNonRoot: true. |
| CKV_K8S_37 | Minimize containers with capabilities | Exception for workloads requiring added capability. See capabilities guidance. |
| CKV_K8S_40 | Run as high UID | Public container images used as-is. See how to define UID. |