Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: Pre-Commit dependencies update #26

Merged
merged 1 commit into from
Apr 4, 2024

Conversation

github-actions[bot]
Copy link
Contributor

@github-actions github-actions bot commented Apr 1, 2024

Pre-Commit Dependencies updates required

There are pre-commit dependencies waiting to be updated. Please see the Files changed tab for details.

Please check results of pre-commit test run with these updates in comments below.

Generated automatically with GitHub Actions

@github-actions github-actions bot requested a review from a team as a code owner April 1, 2024 01:27
Copy link
Contributor Author

github-actions bot commented Apr 1, 2024

👍 🚀 😄 The Pre Commit test run succeded. See results here.

@sebastianczech
Copy link
Contributor

sebastianczech commented Apr 2, 2024

/sca

Testing job ID: 8518424432
Job result: SUCCESS

@sebastianczech
Copy link
Contributor

All Checkov issues connected with autoscaling:

Check: CKV_AWS_290: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.vm_series_asg.aws_iam_role_policy.lambda_iam_policy_default
	File: /modules/asg/main.tf:198-[24](https://github.com/PaloAltoNetworks/terraform-aws-swfw-modules/actions/runs/8518424432/job/23330573710#step:11:25)9
	Calling File: /examples/isolated_design_autoscale/main.tf:214-[25](https://github.com/PaloAltoNetworks/terraform-aws-swfw-modules/actions/runs/8518424432/job/23330573710#step:11:26)2
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-290
Check: CKV_AWS_355: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.vm_series_asg.aws_iam_role_policy.lambda_iam_policy_default
	File: /modules/asg/main.tf:198-249
	Calling File: /examples/isolated_design_autoscale/main.tf:214-252
Check: CKV_AWS_[28](https://github.com/PaloAltoNetworks/terraform-aws-swfw-modules/actions/runs/8518424432/job/23330573710#step:11:29)9: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: module.vm_series_asg.aws_iam_role_policy.lambda_iam_policy_default
	File: /modules/asg/main.tf:198-249
	Calling File: /examples/isolated_design_autoscale/main.tf:214-252
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-289
Check: CKV_AWS_364: "Ensure that AWS Lambda function permissions delegated to AWS services are limited by SourceArn or SourceAccount"
	FAILED for resource: module.vm_series_asg.aws_lambda_permission.this
	File: /modules/asg/main.tf:328-333
	Calling File: /examples/isolated_design_autoscale/main.tf:214-252
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-364

probably can be fixed in #24 ?

Regarding issues in panorama module:

Check: CKV_AWS_8: "Ensure all data stored in the Launch configuration or instance Elastic Blocks Store is securely encrypted"
	FAILED for resource: module.panorama.aws_instance.this
	File: /modules/panorama/main.tf:[31](https://github.com/PaloAltoNetworks/terraform-aws-swfw-modules/actions/runs/8518424432/job/23330573710#step:11:32)-60
	Calling File: /examples/panorama_standalone/main.tf:150-173
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-13
Check: CKV_AWS_3: "Ensure all data stored in the EBS is securely encrypted"
	FAILED for resource: module.panorama.aws_ebs_volume.this
	File: /modules/panorama/main.tf:72-81
	Calling File: /examples/panorama_standalone/main.tf:150-173
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-3-encrypt-ebs-volume
Check: CKV2_AWS_2: "Ensure that only encrypted EBS volumes are attached to EC2 instances"
	FAILED for resource: module.panorama.aws_ebs_volume.this
	File: /modules/panorama/main.tf:72-81
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-only-encrypted-ebs-volumes-are-attached-to-ec2-instances

currently we have variable ebs_encrypted, which is used while creating resource aws_ebs_volume, but technically it's possible to set false for ebs_encrypted - do we want to always set it to true and remove that variable ?

Regarding issues for bootstrap module:

Check: CKV_AWS_1[45](https://github.com/PaloAltoNetworks/terraform-aws-swfw-modules/actions/runs/8518424432/job/23330573710#step:11:46): "Ensure that S3 buckets are encrypted with KMS by default"
	FAILED for resource: module.bootstrap.aws_s3_bucket.this[0]
	File: /modules/bootstrap/main.tf:19-25
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-s3-buckets-are-encrypted-with-kms-by-default
Check: CKV2_AWS_6: "Ensure that S3 bucket has a Public Access block"
	FAILED for resource: module.bootstrap.aws_s3_bucket.this[0]
	File: /modules/bootstrap/main.tf:19-25
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/s3-bucket-should-have-public-access-blocks-defaults-to-false-if-the-public-access-block-is-not-attached
Check: CKV_AWS_21: "Ensure all data stored in the S3 bucket have versioning enabled"
	FAILED for resource: module.bootstrap.aws_s3_bucket.this[0]
	File: /modules/bootstrap/main.tf:19-25
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-16-enable-versioning

we have encryption, versioning and blocked public access always enable, if we create the bucket. I propose to set all 3 Checkov warnings to list of skipped. Do you agree ?

@sebastianczech sebastianczech merged commit 488552a into main Apr 4, 2024
@sebastianczech sebastianczech deleted the pre-commit-dependencies-update branch April 4, 2024 14:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants