{"id":3466,"date":"2021-04-13T13:49:51","date_gmt":"2021-04-13T13:49:51","guid":{"rendered":"https:\/\/contentlab.com\/tutorial-enforcing-security-and-compliance-policies-in-cloudformation-with-bridgecrew\/"},"modified":"2021-11-16T21:39:56","modified_gmt":"2021-11-16T21:39:56","slug":"tutorial-enforcing-security-and-compliance-policies-in-cloudformation-with-bridgecrew","status":"publish","type":"post","link":"https:\/\/contentlab.com\/tutorial-enforcing-security-and-compliance-policies-in-cloudformation-with-bridgecrew\/","title":{"rendered":"Tutorial: Enforcing security and compliance policies in CloudFormation with Bridgecrew"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"3466\" class=\"elementor elementor-3466\" data-elementor-post-type=\"post\">\n\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-6ea03e93 elementor-section-boxed elementor-section-height-default elementor-section-height-default qodef-elementor-content-no\" data-id=\"6ea03e93\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-6356675c\" data-id=\"6356675c\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-eec3376 elementor-widget elementor-widget-text-editor\" data-id=\"eec3376\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.21.0 - 25-04-2024 *\/\n.elementor-widget-text-editor.elementor-drop-cap-view-stacked .elementor-drop-cap{background-color:#69727d;color:#fff}.elementor-widget-text-editor.elementor-drop-cap-view-framed .elementor-drop-cap{color:#69727d;border:3px solid;background-color:transparent}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap{margin-top:8px}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap-letter{width:1em;height:1em}.elementor-widget-text-editor .elementor-drop-cap{float:left;text-align:center;line-height:1;font-size:50px}.elementor-widget-text-editor .elementor-drop-cap-letter{display:inline-block}<\/style>\t\t\t\t<p>AWS CloudFormation makes cloud provisioning simple and scalable by leveraging both automation and configuration as code. Defining your cloud infrastructure and applications as code simplifies repetitive\u00a0<a href=\"https:\/\/contentlab.com\/5-tips-for-automating-devops-workflows\/\">DevOps<\/a>\u00a0tasks and gives you a single source of truth for app and environment configuration.<\/p><p>This makes it more important to make sure your\u00a0<a href=\"https:\/\/bridgecrew.io\/infrastructure-as-code-security\/\">infrastructure as code<\/a>\u00a0(IaC) resources follow security best practices\u2014your CloudFormation configuration is now another part of your codebase, and should be tested and scanned for errors and risks just like any other code review.<\/p><p>With\u00a0<a href=\"https:\/\/bridgecrew.io\/platform\/\">Bridgecrew<\/a>, you can scan your IaC codebase and deployed resources, find misconfigurations, and fix issues fast. In this article, we\u2019ll walk through the process of configuring Bridgecrew to scan a CloudFormation deployment, run the scans, find issues, and fix them.<\/p><h2>Infrastructure as code with CloudFormation<\/h2><p>CloudFormation lets you define your AWS infrastructure with templates, which you can check into version control or store in S3 buckets.<\/p><p>CloudFormation templates are JSON or YAML files. For instance, the following template defines an S3 bucket:<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e6e2734 elementor-widget elementor-widget-code-highlight\" data-id=\"e6e2734\" data-element_type=\"widget\" data-widget_type=\"code-highlight.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"prismjs-default copy-to-clipboard \">\n\t\t\t<pre data-line=\"\" class=\"highlight-height language-json line-numbers\">\n\t\t\t\t<code readonly=\"true\" class=\"language-json\">\n\t\t\t\t\t<xmp>{\r\n\r\n  \"AWSTemplateFormatVersion\" : \"2010-09-09\",\r\n  \"Description\" : \"AWS CloudFormation Sample Template: Sample template showing how to create a publicly accessible S3 bucket.\",\r\n  \"Resources\" : {\r\n    \"S3Bucket\" : {\r\n      \"Type\" : \"AWS::S3::Bucket\",\r\n      \"Properties\" : {\r\n        \"AccessControl\" : \"PublicRead\",\r\n        \"WebsiteConfiguration\" : {\r\n          \"IndexDocument\" : \"index.html\",\r\n          \"ErrorDocument\" : \"error.html\"\r\n         }\r\n      },\r\n      \"DeletionPolicy\" : \"Retain\"\r\n    }\r\n  },\r\n  \"Outputs\" : {\r\n    \"WebsiteURL\" : {\r\n      \"Value\" : { \"Fn::GetAtt\" : [ \"S3Bucket\", \"WebsiteURL\" ] },\r\n      \"Description\" : \"URL for website hosted on S3\"\r\n    },\r\n    \"S3BucketSecureURL\" : {\r\n      \"Value\" : { \"Fn::Join\" : [ \"\", [ \"https:\/\/\", { \"Fn::GetAtt\" : [ \"S3Bucket\", \"DomainName\" ] } ] ] },\r\n      \"Description\" : \"Name of S3 bucket to hold website content\"\r\n    }\r\n  }\r\n}<\/xmp>\n\t\t\t\t<\/code>\n\t\t\t<\/pre>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-925f339 elementor-widget elementor-widget-text-editor\" data-id=\"925f339\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>You can create this bucket in seconds using the\u00a0<a style=\"background-color: #ffffff;\" href=\"https:\/\/aws.amazon.com\/cli\/\">AWS CLI<\/a>:<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-735add0 elementor-widget elementor-widget-code-highlight\" data-id=\"735add0\" data-element_type=\"widget\" data-widget_type=\"code-highlight.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"prismjs-default copy-to-clipboard \">\n\t\t\t<pre data-line=\"\" class=\"highlight-height language-javascript line-numbers\">\n\t\t\t\t<code readonly=\"true\" class=\"language-javascript\">\n\t\t\t\t\t<xmp>aws cloudformation create-stack --stack-name myteststack --template-body file:\/\/\/home\/testuser\/mytemplate.json<\/xmp>\n\t\t\t\t<\/code>\n\t\t\t<\/pre>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-89078d5 elementor-widget elementor-widget-text-editor\" data-id=\"89078d5\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>The benefit of using CloudFormation to define your infrastructure is that it allows you to audit the templates before they are deployed. When you do that, you\u2019re baking best practices for security into your development and deployment lifecycle.<\/p><h2>Getting started with Bridgecrew<\/h2><p>CloudFormation gives us total control to create, change, and delete resources in AWS. With\u00a0<a href=\"https:\/\/bridgecrew.io\/infrastructure-as-code-security\/cloudformation\/\">CloudFormation<\/a>, it\u2019s easy to pick and deploy any of the hundreds of templates readily available from the\u00a0<a href=\"https:\/\/aws.amazon.com\/cloudformation\/resources\/templates\/\">AWS sample templates<\/a>. Because these templates are built solely with functionality in mind, it\u2019s also easy to forget important security configuration and end up having an insecure service running in production.<\/p><p>That\u2019s why scanning your CloudFormation templates before deployment is so important. Bridgecrew integrates into your workflow and stops security issues before they can do any harm.<\/p><p>To get started, check that you have the following prerequisites:<\/p><ul style=\"font-size: 16px; background-color: #ffffff;\"><li style=\"font-size: 16px;\"><a href=\"https:\/\/www.python.org\/downloads\/\" target=\"_blank\" rel=\"noopener noreferrer\">Python 3<\/a>\u00a0and\u00a0<a href=\"https:\/\/pypi.org\/project\/pip\/\" target=\"_blank\" rel=\"noopener noreferrer\">pip<\/a><\/li><li style=\"font-size: 16px;\">An\u00a0<a href=\"https:\/\/aws.amazon.com\/\" target=\"_blank\" rel=\"noopener noreferrer\">AWS<\/a>\u00a0account and an\u00a0<a href=\"https:\/\/docs.aws.amazon.com\/IAM\/latest\/UserGuide\/id_users.html\" target=\"_blank\" rel=\"noopener noreferrer\">IAM<\/a>\u00a0user that can make programmatic calls<\/li><li style=\"font-size: 16px;\">A Bridgecrew account\u2013you can sign up for a free\u00a0<a href=\"https:\/\/www.bridgecrew.cloud\/login\/signUp?__hstc=95155075.d833ab75c7a1fb81010d140587a35dcf.1618320784225.1618320784225.1618320784225.1&amp;__hssc=95155075.1.1618320784226&amp;__hsfp=3964455980\">here<\/a><br \/><br \/><\/li><\/ul><p>The Bridgecrew CLI works on Windows, Mac, and Linux. You can install it with pip:<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-dab9147 elementor-widget elementor-widget-code-highlight\" data-id=\"dab9147\" data-element_type=\"widget\" data-widget_type=\"code-highlight.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"prismjs-default copy-to-clipboard \">\n\t\t\t<pre data-line=\"\" class=\"highlight-height language-javascript line-numbers\">\n\t\t\t\t<code readonly=\"true\" class=\"language-javascript\">\n\t\t\t\t\t<xmp>pip install bridgecrew\r\nor\r\n\r\npip3 install bridgecrew<\/xmp>\n\t\t\t\t<\/code>\n\t\t\t<\/pre>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9075363 elementor-widget elementor-widget-text-editor\" data-id=\"9075363\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>If you run into problems, try the\u00a0<a href=\"https:\/\/docs.bridgecrew.io\/docs\/ingesting-scan-data#installation\" target=\"_blank\" rel=\"noopener noreferrer\">alternate install instructions<\/a>.<\/p><h2>Analyzing CloudFormation configuration with Bridgecrew<\/h2><p>In this tutorial, we\u2019re going to start by testing Bridgecrew CLI with the\u00a0<a href=\"https:\/\/bridgecrew.io\/blog\/introducing-cfngoat-a-vulnerable-by-design-cloudformation-training-tool\/\" target=\"_blank\" rel=\"noopener noreferrer\">CfnGoat template<\/a>, Bridgecrew\u2019s vulnerable-by-design project created to help demonstrate common errors and security best practices in AWS CloudFormation.<\/p><p>First, clone the repository:<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-39f62ac elementor-widget elementor-widget-code-highlight\" data-id=\"39f62ac\" data-element_type=\"widget\" data-widget_type=\"code-highlight.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"prismjs-default copy-to-clipboard \">\n\t\t\t<pre data-line=\"\" class=\"highlight-height language-git line-numbers\">\n\t\t\t\t<code readonly=\"true\" class=\"language-git\">\n\t\t\t\t\t<xmp>git clone https:\/\/github.com\/bridgecrewio\/cfngoat.git<\/xmp>\n\t\t\t\t<\/code>\n\t\t\t<\/pre>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-4f08212 elementor-widget elementor-widget-text-editor\" data-id=\"4f08212\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>To run Bridgecrew CLI, you\u2019ll need the\u00a0<a href=\"https:\/\/docs.bridgecrew.io\/docs\/get-api-token\" target=\"_blank\" rel=\"noopener noreferrer\">Bridgecrew API token<\/a>\u00a0before you can report back to Bridgecrew. To get it, go to\u00a0<span style=\"font-weight: bolder;\">Integrations &gt; API Token<\/span>\u00a0while logged in your Bridgecrew account and copy the token.<\/p><p><img fetchpriority=\"high\" decoding=\"async\" class=\"alignnone size-full wp-image-4092\" src=\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/Bridgecrew-API-Token.png\" sizes=\"(max-width: 386px) 100vw, 386px\" srcset=\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/Bridgecrew-API-Token.png 386w, https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/Bridgecrew-API-Token-300x295.png 300w, https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/Bridgecrew-API-Token.png 24w, https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/Bridgecrew-API-Token.png 48w\" alt=\"Bridgecrew API Token\" width=\"386\" height=\"379\" \/><\/p><p>Use the token in the command to send the results to Bridgecrew:<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-4310dc8 elementor-widget elementor-widget-text-editor\" data-id=\"4310dc8\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Lorem ipsum dolor sit amet, consectetur adipiscing elit. Ut elit tellus, luctus nec ullamcorper mattis, pulvinar dapibus leo.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-eeae253 elementor-widget elementor-widget-code-highlight\" data-id=\"eeae253\" data-element_type=\"widget\" data-widget_type=\"code-highlight.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"prismjs-default copy-to-clipboard \">\n\t\t\t<pre data-line=\"\" class=\"highlight-height language-javascript line-numbers\">\n\t\t\t\t<code readonly=\"true\" class=\"language-javascript\">\n\t\t\t\t\t<xmp>bridgecrew -f cfngoat.yaml --bc-api-key YOUR_API_KEY<\/xmp>\n\t\t\t\t<\/code>\n\t\t\t<\/pre>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9566305 elementor-widget elementor-widget-text-editor\" data-id=\"9566305\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>And run Bridgecrew:<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-b359d3f elementor-widget elementor-widget-code-highlight\" data-id=\"b359d3f\" data-element_type=\"widget\" data-widget_type=\"code-highlight.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"prismjs-default copy-to-clipboard \">\n\t\t\t<pre data-line=\"\" class=\"highlight-height language-javascript line-numbers\">\n\t\t\t\t<code readonly=\"true\" class=\"language-javascript\">\n\t\t\t\t\t<xmp>bridgecrew -f cfngoat.yaml --framework cloudformation --bc-api-key YOUR_API_KEY<\/xmp>\n\t\t\t\t<\/code>\n\t\t\t<\/pre>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1769a20 elementor-widget elementor-widget-text-editor\" data-id=\"1769a20\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>You can also scan entire directories with -d:<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-cc5167a elementor-widget elementor-widget-code-highlight\" data-id=\"cc5167a\" data-element_type=\"widget\" data-widget_type=\"code-highlight.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"prismjs-default copy-to-clipboard \">\n\t\t\t<pre data-line=\"\" class=\"highlight-height language-javascript line-numbers\">\n\t\t\t\t<code readonly=\"true\" class=\"language-javascript\">\n\t\t\t\t\t<xmp>bridgecrew -d cfn --framework cloudformation --bc-api-key YOUR_API_KEY<\/xmp>\n\t\t\t\t<\/code>\n\t\t\t<\/pre>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f3570b1 elementor-widget elementor-widget-text-editor\" data-id=\"f3570b1\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Bridgecrew comes pre-built with\u00a0<a style=\"background-color: #ffffff;\" href=\"https:\/\/docs.bridgecrew.io\/docs\/aws-policy-index\">hundreds of AWS security and compliance policies<\/a>. To get the list of security checks, use -l or \u2013list:<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c3f3a97 elementor-widget elementor-widget-code-highlight\" data-id=\"c3f3a97\" data-element_type=\"widget\" data-widget_type=\"code-highlight.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"prismjs-default copy-to-clipboard \">\n\t\t\t<pre data-line=\"\" class=\"highlight-height language-javascript line-numbers\">\n\t\t\t\t<code readonly=\"true\" class=\"language-javascript\">\n\t\t\t\t\t<xmp>bridgecrew --list<\/xmp>\n\t\t\t\t<\/code>\n\t\t\t<\/pre>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-5edfb67 elementor-widget elementor-widget-text-editor\" data-id=\"5edfb67\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>In many instances, you may only be interested in running a select few checks. In that case, you can add the -c or \u2013check option:<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2f02c74 elementor-widget elementor-widget-code-highlight\" data-id=\"2f02c74\" data-element_type=\"widget\" data-widget_type=\"code-highlight.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"prismjs-default copy-to-clipboard \">\n\t\t\t<pre data-line=\"\" class=\"highlight-height language-javascript line-numbers\">\n\t\t\t\t<code readonly=\"true\" class=\"language-javascript\">\n\t\t\t\t\t<xmp>bridgecrew -f cfngoat.yaml -c CKV_AWS_1,CKV_AWS_2 --bc-api-key YOUR_API_KEY<\/xmp>\n\t\t\t\t<\/code>\n\t\t\t<\/pre>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9ba6bea elementor-widget elementor-widget-text-editor\" data-id=\"9ba6bea\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Or, if you want to run all but some checks, use the \u2013skip-check option:<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6116516 elementor-widget elementor-widget-code-highlight\" data-id=\"6116516\" data-element_type=\"widget\" data-widget_type=\"code-highlight.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"prismjs-default copy-to-clipboard \">\n\t\t\t<pre data-line=\"\" class=\"highlight-height language-javascript line-numbers\">\n\t\t\t\t<code readonly=\"true\" class=\"language-javascript\">\n\t\t\t\t\t<xmp>bridgecrew -f cfngoat.yaml --skip-check CKV_AWS_1,CKV_AWS_2 --bc-api-key YOUR_API_KEY<\/xmp>\n\t\t\t\t<\/code>\n\t\t\t<\/pre>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3bda7d4 elementor-widget elementor-widget-text-editor\" data-id=\"3bda7d4\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>The results show all the failed checks, as well as link to a guide explaining the cause and how to fix them. In some cases, the report includes the snippet of code that is misconfigured:<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-5bd1b77 elementor-widget elementor-widget-code-highlight\" data-id=\"5bd1b77\" data-element_type=\"widget\" data-widget_type=\"code-highlight.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"prismjs-default copy-to-clipboard \">\n\t\t\t<pre data-line=\"\" class=\"highlight-height language-javascript line-numbers\">\n\t\t\t\t<code readonly=\"true\" class=\"language-javascript\">\n\t\t\t\t\t<xmp>Check: CKV_AWS_56: \"Ensure S3 bucket has 'restrict_public_bucket' enabled\"\r\nFAILED for resource: AWS::S3::Bucket.LogsBucket\r\nFile: \/cfngoat.yaml:644-662\r\nGuide: https:\/\/docs.bridgecrew.io\/docs\/bc_aws_s3_22\r\n\r\n644 |     Type: AWS::S3::Bucket\r\n645 |     DeletionPolicy: Delete\r\n646 |     Properties:\r\n647 |       BucketName: !Sub \"${AWS::AccountId}-${CompanyName}-${Environment}-logs\"\r\n648 |       AccessControl: LogDeliveryWrite\r\n649 |       VersioningConfiguration:\r\n650 |         Status: Enabled\r\n651 |       BucketEncryption: \r\n652 |         ServerSideEncryptionConfiguration:\r\n653 |           - ServerSideEncryptionByDefault:\r\n654 |               KMSMasterKeyID: !Ref LogsKey\r\n655 |               SSEAlgorithm: aws:kms\r\n656 |       Tags:\r\n657 |         - Key: Name\r\n658 |           Value: !Sub \"${AWS::AccountId}-${CompanyName}-${Environment}-logs\"<\/xmp>\n\t\t\t\t<\/code>\n\t\t\t<\/pre>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-57a2e3a elementor-widget elementor-widget-text-editor\" data-id=\"57a2e3a\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<h2>Integrating Bridgecrew with AWS dev tools suite<\/h2><p>In the previous section, we used the Bridgecrew CLI to do some quick scanning before committing a change into the code repository. However, forcing every developer to run a scan in their machines ad hoc isn\u2019t conducive. We need a smarter approach, one that continuously audits code.<\/p><p>Bridgecrew supports all popular version control systems and\u00a0<a href=\"https:\/\/contentlab.com\/what-is-continuous-integration-and-continuous-delivery-ci-cd\/\">CI\/CD<\/a>\u00a0platforms. We can, for instance, set up Bridgecrew to run every time a developer commits into a GitHub repository.<\/p><p>This section will show you how to continuously scan CloudFormation templates by integrating Bridgecrew with AWS CodeCommit and AWS CodeBuild.<\/p><p>The integration takes three steps:<\/p><ol style=\"font-size: 16px; background-color: #ffffff;\"><li style=\"font-size: 16px;\">Upload your code to CodeCommit<\/li><li style=\"font-size: 16px;\">Configure CodeBuild to audit your code<\/li><li style=\"font-size: 16px;\">Set up CodePipeline to rerun the audit on every change<\/li><\/ol><h2>Uploading your code to CodeCommit<\/h2><p>AWS CodeCommit is a Git hosting and version control system like GitHub or GitLab, but it only works with private repositories. You can integrate Bridgecrew with CodeCommit to automatically scan your CloudFormation templates for security and compliance errors.<\/p><p>To integrate Bridgecrew with CodeCommit, you\u2019ll first need an IAM user with access to CodeCommit. Open your AWS IAM service and configure access via\u00a0<a href=\"https:\/\/docs.aws.amazon.com\/codecommit\/latest\/userguide\/setting-up-ssh-unixes.html\" target=\"_blank\" rel=\"noopener noreferrer\">SSH keys<\/a>\u00a0or\u00a0<a href=\"https:\/\/docs.aws.amazon.com\/codecommit\/latest\/userguide\/setting-up-gc.html\" target=\"_blank\" rel=\"noopener noreferrer\">a user+password combination<\/a>.<\/p><p>Second, go to the\u00a0<a href=\"https:\/\/aws.amazon.com\/codecommit\/\" target=\"_blank\" rel=\"noopener noreferrer\">AWS CodeCommit<\/a>\u00a0service and create a repository:<\/p><p><img decoding=\"async\" class=\"alignnone size-full wp-image-4095\" src=\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/AWS-CodeCommit-create-a-repository-1.png\" sizes=\"(max-width: 945px) 100vw, 945px\" srcset=\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/AWS-CodeCommit-create-a-repository-1.png 945w, https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/AWS-CodeCommit-create-a-repository-1-300x96.png 300w, https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/AWS-CodeCommit-create-a-repository-1-768x245.png 768w\" alt=\"AWS CodeCommit create a repository\" width=\"945\" height=\"302\" \/><\/p><p>Third, upload your code to the new repository:<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d6d7562 elementor-widget elementor-widget-code-highlight\" data-id=\"d6d7562\" data-element_type=\"widget\" data-widget_type=\"code-highlight.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"prismjs-default copy-to-clipboard \">\n\t\t\t<pre data-line=\"\" class=\"highlight-height language-git line-numbers\">\n\t\t\t\t<code readonly=\"true\" class=\"language-git\">\n\t\t\t\t\t<xmp>git remote remove origin\r\ngit remote add origin https:\/\/git-codecommit.<YOUR_REGION>.amazonaws.com\/v1\/repos\/cfngoat\r\ngit push origin master<\/xmp>\n\t\t\t\t<\/code>\n\t\t\t<\/pre>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9a157e3 elementor-widget elementor-widget-text-editor\" data-id=\"9a157e3\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>For the best results, add the repo-id and branch options so that Bridgecrew shows the correct details in the dashboard:<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3159893 elementor-widget elementor-widget-code-highlight\" data-id=\"3159893\" data-element_type=\"widget\" data-widget_type=\"code-highlight.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"prismjs-default copy-to-clipboard \">\n\t\t\t<pre data-line=\"\" class=\"highlight-height language-javascript line-numbers\">\n\t\t\t\t<code readonly=\"true\" class=\"language-javascript\">\n\t\t\t\t\t<xmp>bridgecrew -f cfngoat.yaml --bc-api-key YOUR_API_KEY --repo-id AWS_ACCOUNT\/REPO_NAME--branch master<\/xmp>\n\t\t\t\t<\/code>\n\t\t\t<\/pre>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f5ab939 elementor-widget elementor-widget-text-editor\" data-id=\"f5ab939\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>The repository ID can take any form as long as it follows the owner\/name format. In AWS, the owner is usually the account ID or an alias.<\/p><p>Once integrated into CodeCommit, we\u2019re ready to set up our continuous workflow using CodeBuild and CodePipeline.<\/p><h2>Configuring CodeBuild to scan your templates<\/h2><p><a href=\"https:\/\/docs.bridgecrew.io\/docs\/integrate-with-codebuild\">AWS CodeBuild<\/a>\u00a0is a CI\/CD platform that can build projects, run jobs, and deploy infrastructure. We\u2019re going to use it to scan the CloudFormation templates before deployment.<\/p><p>First, retrieve your connection command. To do this, open the integrations menu in your Bridgecrew account and select AWS Code Build:<br \/><img decoding=\"async\" class=\"alignnone size-full wp-image-4096\" src=\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/AWS-CodeBuild-Bridgecrew-integration.png\" sizes=\"(max-width: 539px) 100vw, 539px\" srcset=\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/AWS-CodeBuild-Bridgecrew-integration.png 539w, https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/AWS-CodeBuild-Bridgecrew-integration-300x212.png 300w\" alt=\"AWS CodeBuild Bridgecrew integration\" width=\"539\" height=\"381\" \/><\/p><p>Copy the command as shown and run it in your terminal:<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-89fdce1 elementor-widget elementor-widget-code-highlight\" data-id=\"89fdce1\" data-element_type=\"widget\" data-widget_type=\"code-highlight.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"prismjs-default copy-to-clipboard \">\n\t\t\t<pre data-line=\"\" class=\"highlight-height language-javascript line-numbers\">\n\t\t\t\t<code readonly=\"true\" class=\"language-javascript\">\n\t\t\t\t\t<xmp>aws ssm put-parameter --name bridgecrew_api_key --value YOUR_API_KEY --type SecureString<\/xmp>\n\t\t\t\t<\/code>\n\t\t\t<\/pre>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-40a1ce04 elementor-widget elementor-widget-text-editor\" data-id=\"40a1ce04\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"entry-content single-post__content\">\n<pre><span style=\"color: var( --e-global-color-text ); font-family: var( --e-global-typography-text-font-family ), Sans-serif; font-weight: var( --e-global-typography-text-font-weight ); font-size: 1rem;\">Note: if the command fails, your IAM user may not have the correct permissions to create parameters in&nbsp;<\/span><a href=\"https:\/\/aws.amazon.com\/systems-manager\/\" target=\"_blank\" rel=\"noopener noreferrer\" style=\"font-family: var( --e-global-typography-text-font-family ), Sans-serif; font-weight: var( --e-global-typography-text-font-weight ); background-color: rgb(255, 255, 255); font-size: 1rem;\">AWS Systems Manager<\/a><span style=\"color: var( --e-global-color-text ); font-family: var( --e-global-typography-text-font-family ), Sans-serif; font-weight: var( --e-global-typography-text-font-weight ); font-size: 1rem;\">&nbsp;(SSM). In that case, you\u2019ll need to add write permissions to the user.<\/span><br><\/pre>\n<p>Next, copy the YAML code shown on the lower half of the screen and keep it handy:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-4097\" src=\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/yaml.png\" sizes=\"(max-width: 489px) 100vw, 489px\" srcset=\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/yaml.png 489w, https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/yaml-270x300.png 270w\" alt=\"YAML\" width=\"489\" height=\"544\"><br>Now go to your&nbsp;<a href=\"https:\/\/aws.amazon.com\/codebuild\/\">AWS CodeBuild<\/a>&nbsp;service and select&nbsp;<strong>Create a Build Project<\/strong>:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-4099\" src=\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/aws-codebuild-create-build-project.png\" sizes=\"(max-width: 731px) 100vw, 731px\" srcset=\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/aws-codebuild-create-build-project.png 731w, https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/aws-codebuild-create-build-project-300x179.png 300w\" alt=\"aws codebuild create build project\" width=\"731\" height=\"436\"><\/p>\n<p>Select your CodeCommit repository:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-4100\" src=\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/Select-your-CodeCommit-repository.png\" sizes=\"(max-width: 724px) 100vw, 724px\" srcset=\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/Select-your-CodeCommit-repository.png 724w, https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/Select-your-CodeCommit-repository-300x225.png 300w\" alt=\"Select your CodeCommit repository\" width=\"724\" height=\"542\"><\/p>\n<p>Under&nbsp;<strong>Environment Image<\/strong>, select&nbsp;<strong>Managed Image<\/strong>. Then select&nbsp;<strong>Ubuntu &gt; standard:4.0<\/strong>.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-4101\" src=\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/managed-image-ubuntu.png\" sizes=\"(max-width: 724px) 100vw, 724px\" srcset=\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/managed-image-ubuntu.png 724w, https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/managed-image-ubuntu-300x242.png 300w\" alt=\"managed image ubuntu\" width=\"724\" height=\"584\"><\/p>\n<p>Let AWS create a service role for you. Take note of its name.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-4102\" src=\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/AWS-service-role.png\" sizes=\"(max-width: 730px) 100vw, 730px\" srcset=\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/AWS-service-role.png 730w, https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/AWS-service-role-300x101.png 300w\" alt=\"AWS service role\" width=\"730\" height=\"245\"><\/p>\n<p>Next comes the build spec. Select&nbsp;<strong>Insert Commands<\/strong>, then&nbsp;<strong>Switch to Editor<\/strong>&nbsp;and paste the YAML code you copied from Bridgecrew earlier. Overwrite the previous contents completely.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-4103\" src=\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/buildspec.png\" sizes=\"(max-width: 726px) 100vw, 726px\" srcset=\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/buildspec.png 726w, https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/buildspec-300x240.png 300w\" alt=\"buildspec\" width=\"726\" height=\"580\"><\/p>\n<p>Select&nbsp;<strong>Create Build Project<\/strong>&nbsp;to complete the setup.<\/p>\n<p>You\u2019ll need to grant access to the role that CodeBuild just created. To do that, go back to the IAM service and find it:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-large wp-image-4104\" src=\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/grant-access-to-codebuild-role-1024x170.png\" sizes=\"(max-width: 1024px) 100vw, 1024px\" srcset=\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/grant-access-to-codebuild-role-1024x170.png 1024w, https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/grant-access-to-codebuild-role-300x50.png 300w, https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/grant-access-to-codebuild-role-768x127.png 768w, https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/grant-access-to-codebuild-role.png 1332w\" alt=\"grant access to codebuild role\" width=\"1024\" height=\"170\"><\/p>\n<p>Select&nbsp;<strong>Add Inline Policy<\/strong>&nbsp;and type \u201cSystems Manager\u201d in the search box.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-4105\" src=\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/systems-manager.png\" sizes=\"(max-width: 459px) 100vw, 459px\" srcset=\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/systems-manager.png 459w, https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/systems-manager-300x78.png 300w\" alt=\"systems manager\" width=\"459\" height=\"119\"><\/p>\n<p>Check the&nbsp;<code>GetParameters<\/code>&nbsp;read permission.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-4106\" src=\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/GetParameters.png\" sizes=\"(max-width: 638px) 100vw, 638px\" srcset=\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/GetParameters.png 638w, https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/GetParameters-300x128.png 300w\" alt=\"GetParameters\" width=\"638\" height=\"272\"><\/p>\n<p>Scroll down, and under&nbsp;<strong>Resources<\/strong>, choose&nbsp;<strong>Specific<\/strong>. Select on&nbsp;<strong>Add ARN<\/strong>. Fill in the region and account number. Type \u201cbridgecrew_api_key\u201d as the parameter name:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-4107\" src=\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/Add-ARN.png\" sizes=\"(max-width: 772px) 100vw, 772px\" srcset=\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/Add-ARN.png 772w, https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/Add-ARN-300x202.png 300w, https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/Add-ARN-768x517.png 768w\" alt=\"Add ARN\" width=\"772\" height=\"520\"><\/p>\n<p>Select&nbsp;<strong>Add<\/strong>, then&nbsp;<strong>Review Policy<\/strong>&nbsp;&gt;&nbsp;<strong>Create policy<\/strong>.<\/p>\n<h2>Setting up CodePipeline to trigger scans<\/h2>\n<p>If you want CodeBuild to run the scan on each update, you\u2019ll need to configure AWS CodePipeline. You can skip this step, but if you do, you\u2019ll only be able to run manual scans.<\/p>\n<p>To set it up, go to&nbsp;<a href=\"https:\/\/aws.amazon.com\/codepipeline\/\" target=\"_blank\" rel=\"noopener noreferrer\">AWS CodePipeline<\/a>&nbsp;and select&nbsp;<strong>Create Pipeline<\/strong>:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-4108\" src=\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/pipeline-settings.png\" sizes=\"(max-width: 820px) 100vw, 820px\" srcset=\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/pipeline-settings.png 820w, https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/pipeline-settings-300x181.png 300w, https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/pipeline-settings-768x463.png 768w\" alt=\"pipeline settings\" width=\"820\" height=\"494\"><\/p>\n<p>After giving the pipeline a name, select&nbsp;<strong>Next<\/strong>&nbsp;and choose&nbsp;<strong>AWS Code Commit<\/strong>&nbsp;as a source provider and your repository:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-4109\" src=\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/Source-stage.png\" sizes=\"(max-width: 827px) 100vw, 827px\" srcset=\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/Source-stage.png 827w, https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/Source-stage-300x214.png 300w, https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/Source-stage-768x549.png 768w\" alt=\"add source stage\" width=\"827\" height=\"591\"><\/p>\n<p>Next, select the region and the CodeBuild project name:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-4110\" src=\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/add-build-stage.png\" sizes=\"(max-width: 830px) 100vw, 830px\" srcset=\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/add-build-stage.png 830w, https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/add-build-stage-300x248.png 300w, https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/add-build-stage-768x634.png 768w\" alt=\"add build stage\" width=\"830\" height=\"685\"><\/p>\n<p>Unless you plan to deploy right now, you may skip the deployment stage.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-4116\" src=\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/add-deploy-stage.png\" sizes=\"(max-width: 840px) 100vw, 840px\" srcset=\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/add-deploy-stage.png 840w, https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/add-deploy-stage-300x110.png 300w, https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/add-deploy-stage-768x283.png 768w\" alt=\"deploy stage\" width=\"840\" height=\"309\"><\/p>\n<p>Select&nbsp;<strong>Create Pipeline<\/strong>, which should start immediately.<\/p>\n<p>If everything goes well, the pipeline should&nbsp;<em>fail<\/em>&nbsp;at the build stage. This is normal as the CfnGoat code is purposely designed with security flaws. Once the issues are fixed, the pipeline status should turn to green.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-4118\" src=\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/pipeline-status.png\" sizes=\"(max-width: 615px) 100vw, 615px\" srcset=\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/pipeline-status.png 615w, https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/pipeline-status-280x300.png 280w\" alt=\"pipeline status\" width=\"615\" height=\"658\"><\/p>\n<p>You can see the error report on the build job logs.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-4119\" src=\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/build-logs.png\" sizes=\"(max-width: 647px) 100vw, 647px\" srcset=\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/build-logs.png 647w, https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/build-logs-300x229.png 300w\" alt=\"build logs\" width=\"647\" height=\"493\"><\/p>\n<p>The first check that failed in our run, CKV_AWS_3, tests whether the data in AWS Elastic Block Store (EBS) is encrypted or not. In our example, the data isn\u2019t encrypted, and thus the check fails.<\/p>\n<p>You\u2019ll also find these errors in your Bridgecrew account where you can filter by account, type, severity, and more.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-large wp-image-4120\" src=\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/Bridgecrew-filters-1024x336.png\" sizes=\"(max-width: 1024px) 100vw, 1024px\" srcset=\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/Bridgecrew-filters-1024x336.png 1024w, https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/Bridgecrew-filters-300x98.png 300w, https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/Bridgecrew-filters-768x252.png 768w, https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/Bridgecrew-filters.png 1131w\" alt=\"Bridgecrew filters\" width=\"1024\" height=\"336\"><\/p>\n<p>The&nbsp;<a href=\"https:\/\/bridgecrew.io\/platform\/\" target=\"_blank\" rel=\"noopener noreferrer\">Bridgecrew platform<\/a>&nbsp;also provides robust compliance reporting and dashboards to help you track your security posture in both build-time and run-time.<\/p>\n<h2>Addressing security errors in AWS with Bridgecrew<\/h2>\n<p>As we\u2019ve shown so far, Bridgecrew provides the policies and workflow to audit your CloudFormation templates before deployment. But what about the infrastructure that\u2019s already running?<\/p>\n<p>To get continuous&nbsp;<a href=\"https:\/\/bridgecrew.io\/cloud-security\/aws\/\" target=\"_blank\" rel=\"noopener noreferrer\">AWS cloud security<\/a>&nbsp;monitoring, connect Bridgecrew with your AWS account.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-large wp-image-4121\" src=\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/continuous-AWS-cloud-security-monitoring-1024x507.png\" sizes=\"(max-width: 1024px) 100vw, 1024px\" srcset=\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/continuous-AWS-cloud-security-monitoring-1024x507.png 1024w, https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/continuous-AWS-cloud-security-monitoring-300x149.png 300w, https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/continuous-AWS-cloud-security-monitoring-768x381.png 768w, https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/continuous-AWS-cloud-security-monitoring-1536x761.png 1536w, https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/continuous-AWS-cloud-security-monitoring.png 1794w\" alt=\"continuous AWS cloud security monitoring\" width=\"1024\" height=\"507\"><\/p>\n<p>Select&nbsp;<strong>Launch Stack<\/strong>&nbsp;to run the AWS Read-Access CloudFormation Stack. You will then be prompted to create a CloudFormation template pre-populated with Bridgecrew connection details.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-large wp-image-4122\" src=\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/AWS-Read-Access-CloudFormation-Stack-1024x509.jpg\" sizes=\"(max-width: 1024px) 100vw, 1024px\" srcset=\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/AWS-Read-Access-CloudFormation-Stack-1024x509.jpg 1024w, https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/AWS-Read-Access-CloudFormation-Stack-300x149.jpg 300w, https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/AWS-Read-Access-CloudFormation-Stack-768x382.jpg 768w, https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/AWS-Read-Access-CloudFormation-Stack-1536x764.jpg 1536w, https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/AWS-Read-Access-CloudFormation-Stack.jpg 1999w\" alt=\"AWS Read-Access CloudFormation Stack\" width=\"1024\" height=\"509\"><\/p>\n<p>Select the checkbox next to \u201cI acknowledge\u2026\u201d to permit the creation of IAM resources and&nbsp;<strong>Create Stack<\/strong>.<\/p>\n<p>Once integrated, Bridgecrew will enable commit to cloud coverage so that you can address security errors no matter where in the development lifecycle they are. Bridgecrew includes hundreds of checks and runs through the&nbsp;<a href=\"https:\/\/d0.awsstatic.com\/whitepapers\/compliance\/AWS_CIS_Foundations_Benchmark.pdf\" target=\"_blank\" rel=\"noopener noreferrer\">CIS Amazon Web Services Foundations Benchmark<\/a>&nbsp;security assessment and adds more than 40 tests covering regulations such as HIPAA and GDPR.<\/p>\n<h2>Next steps<\/h2>\n<p>We\u2019ve learned how to bake in automated security checks into AWS deployments using Bridgecrew. Now you can keep your infrastructure secure as it grows.<\/p>\n<p>Check out these resources to continue learning about cloud security:<\/p>\n<ul>\n<li><a href=\"https:\/\/docs.bridgecrew.io\/docs\/integrate-with-aws-new-1\">Integrating Bridgecrew with AWS<\/a><\/li>\n<li><a href=\"https:\/\/bridgecrew.io\/blog\/tutorial-find-fix-and-prevent-terraform-misconfigurations-with-bridgecrew\/\">Find, fix, and prevent Terraform misconfigurations with Bridgecrew<\/a><\/li>\n<li><a href=\"https:\/\/bridgecrew.io\/blog\/cloudformation-aws-cdk-scanning-security-compliance\/\">Scanning AWS CDK-generated templates at build-time with Bridgecrew<\/a><\/li>\n<li><a href=\"https:\/\/bridgecrew.io\/blog\/introducing-cfngoat-a-vulnerable-by-design-cloudformation-training-tool\/\">Introducing CfnGoat, a vulnerable-by-design CloudFormation training tool<\/a><br><br>\n<\/li>\n<\/ul>\n<\/div>\n<p><em>This article was originally posted on <a href=\"https:\/\/bridgecrew.io\/blog\">Bridgecrew<\/a>.<br><\/em><\/p>\n<p class=\"p1\"><em><span class=\"s1\">Does your business work with AWS or CloudFormation? If you\u2019re interested in developing expert technical content that performs, <a href=\"https:\/\/contentlab.com\/contact\/\">let\u2019s have a conversation<\/a>&nbsp;today.<\/span><\/em><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>In this article we learn how to bake in automated security checks into AWS deployments using Bridgecrew.<\/p>\n","protected":false},"author":3,"featured_media":4857,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[241,278,18],"tags":[252,301,300,258,298],"hashtags":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v22.5 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Tutorial: Enforcing security and compliance policies in CloudFormation with Bridgecrew &#183; Technical Content Marketing | ContentLab<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/bridgecrew.io\/blog\/tutorial-enforcing-security-and-compliance-policies-in-cloudformation-with-bridgecrew\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Tutorial: Enforcing security and compliance policies in CloudFormation with Bridgecrew &#183; Technical Content Marketing | ContentLab\" \/>\n<meta property=\"og:description\" content=\"In this article we learn how to bake in automated security checks into AWS deployments using Bridgecrew.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/bridgecrew.io\/blog\/tutorial-enforcing-security-and-compliance-policies-in-cloudformation-with-bridgecrew\/\" \/>\n<meta property=\"og:site_name\" content=\"Technical Content Marketing | ContentLab\" \/>\n<meta property=\"article:published_time\" content=\"2021-04-13T13:49:51+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-11-16T21:39:56+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/10\/portfoliofeature4c8.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1746\" \/>\n\t<meta property=\"og:image:height\" content=\"530\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"ContentLab\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@ContentLabIO\" \/>\n<meta name=\"twitter:site\" content=\"@ContentLabIO\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"ContentLab\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"13 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/bridgecrew.io\/blog\/tutorial-enforcing-security-and-compliance-policies-in-cloudformation-with-bridgecrew\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/contentlab.com\/tutorial-enforcing-security-and-compliance-policies-in-cloudformation-with-bridgecrew\/\"},\"author\":{\"name\":\"ContentLab\",\"@id\":\"https:\/\/contentlab.com\/#\/schema\/person\/e1b8cacc1019e83e8d6cd9ab1a049532\"},\"headline\":\"Tutorial: Enforcing security and compliance policies in CloudFormation with Bridgecrew\",\"datePublished\":\"2021-04-13T13:49:51+00:00\",\"dateModified\":\"2021-11-16T21:39:56+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/contentlab.com\/tutorial-enforcing-security-and-compliance-policies-in-cloudformation-with-bridgecrew\/\"},\"wordCount\":1637,\"publisher\":{\"@id\":\"https:\/\/contentlab.com\/#organization\"},\"image\":{\"@id\":\"https:\/\/bridgecrew.io\/blog\/tutorial-enforcing-security-and-compliance-policies-in-cloudformation-with-bridgecrew\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/10\/portfoliofeature4c8.png\",\"keywords\":[\"AWS\",\"CD\",\"CI\",\"Cloud\",\"DevOps\"],\"articleSection\":[\"DevOps\",\"Hands-on Tutorial\",\"Portfolio\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/contentlab.com\/tutorial-enforcing-security-and-compliance-policies-in-cloudformation-with-bridgecrew\/\",\"url\":\"https:\/\/bridgecrew.io\/blog\/tutorial-enforcing-security-and-compliance-policies-in-cloudformation-with-bridgecrew\/\",\"name\":\"Tutorial: Enforcing security and compliance policies in CloudFormation with Bridgecrew &#183; Technical Content Marketing | ContentLab\",\"isPartOf\":{\"@id\":\"https:\/\/contentlab.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/bridgecrew.io\/blog\/tutorial-enforcing-security-and-compliance-policies-in-cloudformation-with-bridgecrew\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/bridgecrew.io\/blog\/tutorial-enforcing-security-and-compliance-policies-in-cloudformation-with-bridgecrew\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/10\/portfoliofeature4c8.png\",\"datePublished\":\"2021-04-13T13:49:51+00:00\",\"dateModified\":\"2021-11-16T21:39:56+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/bridgecrew.io\/blog\/tutorial-enforcing-security-and-compliance-policies-in-cloudformation-with-bridgecrew\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/bridgecrew.io\/blog\/tutorial-enforcing-security-and-compliance-policies-in-cloudformation-with-bridgecrew\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/bridgecrew.io\/blog\/tutorial-enforcing-security-and-compliance-policies-in-cloudformation-with-bridgecrew\/#primaryimage\",\"url\":\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/10\/portfoliofeature4c8.png\",\"contentUrl\":\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/10\/portfoliofeature4c8.png\",\"width\":1746,\"height\":530},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/bridgecrew.io\/blog\/tutorial-enforcing-security-and-compliance-policies-in-cloudformation-with-bridgecrew\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/contentlab.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Tutorial: Enforcing security and compliance policies in CloudFormation with Bridgecrew\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/contentlab.com\/#website\",\"url\":\"https:\/\/contentlab.com\/\",\"name\":\"Technical Content Marketing | ContentLab\",\"description\":\"Technical Content Marketing Done Right.\",\"publisher\":{\"@id\":\"https:\/\/contentlab.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/contentlab.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/contentlab.com\/#organization\",\"name\":\"ContentLab.io\",\"url\":\"https:\/\/contentlab.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/contentlab.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/favicon-1.png\",\"contentUrl\":\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/favicon-1.png\",\"width\":768,\"height\":768,\"caption\":\"ContentLab.io\"},\"image\":{\"@id\":\"https:\/\/contentlab.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/x.com\/ContentLabIO\",\"https:\/\/www.linkedin.com\/company\/17893315\/\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/contentlab.com\/#\/schema\/person\/e1b8cacc1019e83e8d6cd9ab1a049532\",\"name\":\"ContentLab\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/contentlab.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/3929e740ba8fe876f001a63220500e8e?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/3929e740ba8fe876f001a63220500e8e?s=96&d=mm&r=g\",\"caption\":\"ContentLab\"},\"description\":\"ContentLab provides high-quality written articles, tutorials, courses, and other technical marketing materials to industry leaders. We create no-nonsense tech content that\u2019s purpose-built to attract, educate, and engage your technical audience.\",\"sameAs\":[\"https:\/\/contentlab.op\"],\"url\":\"https:\/\/contentlab.com\/author\/contentlab\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Tutorial: Enforcing security and compliance policies in CloudFormation with Bridgecrew &#183; Technical Content Marketing | ContentLab","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/bridgecrew.io\/blog\/tutorial-enforcing-security-and-compliance-policies-in-cloudformation-with-bridgecrew\/","og_locale":"en_US","og_type":"article","og_title":"Tutorial: Enforcing security and compliance policies in CloudFormation with Bridgecrew &#183; Technical Content Marketing | ContentLab","og_description":"In this article we learn how to bake in automated security checks into AWS deployments using Bridgecrew.","og_url":"https:\/\/bridgecrew.io\/blog\/tutorial-enforcing-security-and-compliance-policies-in-cloudformation-with-bridgecrew\/","og_site_name":"Technical Content Marketing | ContentLab","article_published_time":"2021-04-13T13:49:51+00:00","article_modified_time":"2021-11-16T21:39:56+00:00","og_image":[{"width":1746,"height":530,"url":"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/10\/portfoliofeature4c8.png","type":"image\/png"}],"author":"ContentLab","twitter_card":"summary_large_image","twitter_creator":"@ContentLabIO","twitter_site":"@ContentLabIO","twitter_misc":{"Written by":"ContentLab","Est. reading time":"13 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/bridgecrew.io\/blog\/tutorial-enforcing-security-and-compliance-policies-in-cloudformation-with-bridgecrew\/#article","isPartOf":{"@id":"https:\/\/contentlab.com\/tutorial-enforcing-security-and-compliance-policies-in-cloudformation-with-bridgecrew\/"},"author":{"name":"ContentLab","@id":"https:\/\/contentlab.com\/#\/schema\/person\/e1b8cacc1019e83e8d6cd9ab1a049532"},"headline":"Tutorial: Enforcing security and compliance policies in CloudFormation with Bridgecrew","datePublished":"2021-04-13T13:49:51+00:00","dateModified":"2021-11-16T21:39:56+00:00","mainEntityOfPage":{"@id":"https:\/\/contentlab.com\/tutorial-enforcing-security-and-compliance-policies-in-cloudformation-with-bridgecrew\/"},"wordCount":1637,"publisher":{"@id":"https:\/\/contentlab.com\/#organization"},"image":{"@id":"https:\/\/bridgecrew.io\/blog\/tutorial-enforcing-security-and-compliance-policies-in-cloudformation-with-bridgecrew\/#primaryimage"},"thumbnailUrl":"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/10\/portfoliofeature4c8.png","keywords":["AWS","CD","CI","Cloud","DevOps"],"articleSection":["DevOps","Hands-on Tutorial","Portfolio"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/contentlab.com\/tutorial-enforcing-security-and-compliance-policies-in-cloudformation-with-bridgecrew\/","url":"https:\/\/bridgecrew.io\/blog\/tutorial-enforcing-security-and-compliance-policies-in-cloudformation-with-bridgecrew\/","name":"Tutorial: Enforcing security and compliance policies in CloudFormation with Bridgecrew &#183; Technical Content Marketing | ContentLab","isPartOf":{"@id":"https:\/\/contentlab.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/bridgecrew.io\/blog\/tutorial-enforcing-security-and-compliance-policies-in-cloudformation-with-bridgecrew\/#primaryimage"},"image":{"@id":"https:\/\/bridgecrew.io\/blog\/tutorial-enforcing-security-and-compliance-policies-in-cloudformation-with-bridgecrew\/#primaryimage"},"thumbnailUrl":"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/10\/portfoliofeature4c8.png","datePublished":"2021-04-13T13:49:51+00:00","dateModified":"2021-11-16T21:39:56+00:00","breadcrumb":{"@id":"https:\/\/bridgecrew.io\/blog\/tutorial-enforcing-security-and-compliance-policies-in-cloudformation-with-bridgecrew\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/bridgecrew.io\/blog\/tutorial-enforcing-security-and-compliance-policies-in-cloudformation-with-bridgecrew\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/bridgecrew.io\/blog\/tutorial-enforcing-security-and-compliance-policies-in-cloudformation-with-bridgecrew\/#primaryimage","url":"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/10\/portfoliofeature4c8.png","contentUrl":"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/10\/portfoliofeature4c8.png","width":1746,"height":530},{"@type":"BreadcrumbList","@id":"https:\/\/bridgecrew.io\/blog\/tutorial-enforcing-security-and-compliance-policies-in-cloudformation-with-bridgecrew\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/contentlab.com\/"},{"@type":"ListItem","position":2,"name":"Tutorial: Enforcing security and compliance policies in CloudFormation with Bridgecrew"}]},{"@type":"WebSite","@id":"https:\/\/contentlab.com\/#website","url":"https:\/\/contentlab.com\/","name":"Technical Content Marketing | ContentLab","description":"Technical Content Marketing Done Right.","publisher":{"@id":"https:\/\/contentlab.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/contentlab.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/contentlab.com\/#organization","name":"ContentLab.io","url":"https:\/\/contentlab.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/contentlab.com\/#\/schema\/logo\/image\/","url":"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/favicon-1.png","contentUrl":"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/favicon-1.png","width":768,"height":768,"caption":"ContentLab.io"},"image":{"@id":"https:\/\/contentlab.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/ContentLabIO","https:\/\/www.linkedin.com\/company\/17893315\/"]},{"@type":"Person","@id":"https:\/\/contentlab.com\/#\/schema\/person\/e1b8cacc1019e83e8d6cd9ab1a049532","name":"ContentLab","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/contentlab.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/3929e740ba8fe876f001a63220500e8e?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/3929e740ba8fe876f001a63220500e8e?s=96&d=mm&r=g","caption":"ContentLab"},"description":"ContentLab provides high-quality written articles, tutorials, courses, and other technical marketing materials to industry leaders. We create no-nonsense tech content that\u2019s purpose-built to attract, educate, and engage your technical audience.","sameAs":["https:\/\/contentlab.op"],"url":"https:\/\/contentlab.com\/author\/contentlab\/"}]}},"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/10\/portfoliofeature4c8.png","_links":{"self":[{"href":"https:\/\/contentlab.com\/wp-json\/wp\/v2\/posts\/3466"}],"collection":[{"href":"https:\/\/contentlab.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/contentlab.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/contentlab.com\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/contentlab.com\/wp-json\/wp\/v2\/comments?post=3466"}],"version-history":[{"count":6,"href":"https:\/\/contentlab.com\/wp-json\/wp\/v2\/posts\/3466\/revisions"}],"predecessor-version":[{"id":5397,"href":"https:\/\/contentlab.com\/wp-json\/wp\/v2\/posts\/3466\/revisions\/5397"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/contentlab.com\/wp-json\/wp\/v2\/media\/4857"}],"wp:attachment":[{"href":"https:\/\/contentlab.com\/wp-json\/wp\/v2\/media?parent=3466"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/contentlab.com\/wp-json\/wp\/v2\/categories?post=3466"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/contentlab.com\/wp-json\/wp\/v2\/tags?post=3466"},{"taxonomy":"hashtags","embeddable":true,"href":"https:\/\/contentlab.com\/wp-json\/wp\/v2\/hashtags?post=3466"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}