Infrastructure hardcodes its cryptography instead of selecting a managed policy

crypto_agility

Severity

low

Remediation Complexity

medium

Remediation Risk

low

Remediation Effort

medium

Vendor

All

Resource

Encryption

Description

Crypto-agility is the ability to change algorithm without changing the system. It is what decides whether the post-quantum migration is a configuration change or a project.

A listener that selects a provider-managed security policy inherits every future hardening of that policy. One that enumerates its own cipher suites, or pins a bespoke profile, has to be found, edited, reviewed and redeployed — for every resource that repeats the list — the day a suite falls.

The detector reports two shapes: an enumerated cipher-suite list where a managed policy could be named, and a policy value the provider does not define.

A policy counts as provider-managed only when it is one the provider actually publishes. A name shaped like a predefined policy but unknown — a bespoke ELBSecurityPolicy-Custom-Internal, or a typo such as ELBSecurityPolicy-TLS-12-2017-01 for …-TLS-1-2-… — is reported: nothing outside the template maintains it, which is the failure mode this rule exists to catch.

Examples

Terraform

resource "google_compute_ssl_policy" "front" {
  name    = "front"
  profile = "CUSTOM" (1)
  custom_features = ["TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"]
}

1	A bespoke profile: the suites are pinned by this template rather than maintained by the provider.

Kubernetes

apiVersion: v1
kind: Pod
metadata:
  name: kube-apiserver
spec:
  containers:
  - command:
    - kube-apiserver
    - --tls-cipher-suites=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384 (1)
    name: kube-apiserver

1	Every algorithm change has to be made here, on every manifest that repeats it.

Mitigation / Fix

Buildtime

Name a managed policy where the provider offers one.

resource "google_compute_ssl_policy" "front" {
  name    = "front"
  profile = "RESTRICTED" # FIXED: maintained by the provider
}

Where a list is unavoidable — a control-plane flag, an SSH daemon — keep it in one place (a module, a template, a configuration management role) so a future algorithm change is one edit rather than a search.