terraform Infra rebuilt

[IjazMoJ]

No description provided.

[github-actions]

TFSEC Scan Success

Show Output

*****************************

TFSEC will check the following folders:
terraform/environments/hmpps-domain-services

*****************************

Running TFSEC in terraform/environments/hmpps-domain-services
Excluding the following checks: AWS095

======================================================
tfsec is joining the Trivy family

tfsec will continue to remain available 
for the time being, although our engineering 
attention will be directed at Trivy going forward.

You can read more here: 
https://github.com/aquasecurity/tfsec/discussions/1994
======================================================
  timings
  ──────────────────────────────────────────
  disk i/o             2.202616ms
  parsing              224.89397ms
  adaptation           142.307µs
  checks               9.733118ms
  total                236.972011ms

  counts
  ──────────────────────────────────────────
  modules downloaded   0
  modules processed    5
  blocks processed     270
  files read           72

  results
  ──────────────────────────────────────────
  passed               1
  ignored              0
  critical             0
  high                 0
  medium               0
  low                  0


No problems detected!

tfsec_exitcode=0

Checkov Scan Failed

Show Output

*****************************

Checkov will check the following folders:
terraform/environments/hmpps-domain-services

*****************************

Running Checkov in terraform/environments/hmpps-domain-services
terraform scan results:

Passed checks: 94, Failed checks: 3, Skipped checks: 19

Check: CKV_AWS_337: "Ensure SSM parameters are using KMS CMK"
	FAILED for resource: aws_ssm_parameter.linux-join-ad-account-username
	File: /ssm.tf:2-12

		2  | resource "aws_ssm_parameter" "linux-join-ad-account-username" {
		3  |   name        = "Linux Join Domain Service Account Username"
		4  |   type        = "SecureString"
		5  |   value       = "INITIAL_VALUE_OVERRIDDEN"
		6  |   description = "Username to join linux machines to azure.noms.root domain"
		7  |   tags        = local.tags
		8  | 
		9  |   lifecycle {
		10 |     ignore_changes = [value]
		11 |   }
		12 | }

Check: CKV_AWS_337: "Ensure SSM parameters are using KMS CMK"
	FAILED for resource: aws_ssm_parameter.linux-join-ad-account-password
	File: /ssm.tf:14-24

		14 | resource "aws_ssm_parameter" "linux-join-ad-account-password" {
		15 |   name        = "Linux Join Domain Service Account Password"
		16 |   type        = "SecureString"
		17 |   value       = "INITIAL_VALUE_OVERRIDDEN"
		18 |   description = "Password to join linux machines to azure.noms.root domain"
		19 |   tags        = local.tags
		20 | 
		21 |   lifecycle {
		22 |     ignore_changes = [value]
		23 |   }
		24 | }
Check: CKV_AWS_103: "Ensure that load balancer is using at least TLS 1.2"
	FAILED for resource: module.baseline.module.lb_listener.aws_lb_listener.this
	File: /../../modules/lb_listener/main.tf:1-61
	Guide: https://docs.paloaltonetworks.com/content/techdocs/en_US/prisma/prisma-cloud/prisma-cloud-code-security-policy-reference/aws-policies/aws-general-policies/bc-aws-general-43.html

		Code lines for this resource are too many. Please use IDE of your choice to review the file.

checkov_exitcode=1

CTFLint Scan Success

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing `terraform` plugin...
Installed `terraform` (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.2.1)
tflint will check the following folders:
terraform/environments/hmpps-domain-services

*****************************

Running tflint in terraform/environments/hmpps-domain-services
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=0

[github-actions]

TFSEC Scan Success

Show Output

*****************************

TFSEC will check the following folders:
terraform/environments/hmpps-domain-services

*****************************

Running TFSEC in terraform/environments/hmpps-domain-services
Excluding the following checks: AWS095

======================================================
tfsec is joining the Trivy family

tfsec will continue to remain available 
for the time being, although our engineering 
attention will be directed at Trivy going forward.

You can read more here: 
https://github.com/aquasecurity/tfsec/discussions/1994
======================================================
  timings
  ──────────────────────────────────────────
  disk i/o             1.484298ms
  parsing              173.949804ms
  adaptation           124.199µs
  checks               16.452906ms
  total                192.011207ms

  counts
  ──────────────────────────────────────────
  modules downloaded   0
  modules processed    5
  blocks processed     270
  files read           72

  results
  ──────────────────────────────────────────
  passed               1
  ignored              0
  critical             0
  high                 0
  medium               0
  low                  0


No problems detected!

tfsec_exitcode=0

Checkov Scan Failed

Show Output

*****************************

Checkov will check the following folders:
terraform/environments/hmpps-domain-services

*****************************

Running Checkov in terraform/environments/hmpps-domain-services
terraform scan results:

Passed checks: 94, Failed checks: 3, Skipped checks: 19

Check: CKV_AWS_337: "Ensure SSM parameters are using KMS CMK"
	FAILED for resource: aws_ssm_parameter.linux-join-ad-account-username
	File: /ssm.tf:2-12

		2  | resource "aws_ssm_parameter" "linux-join-ad-account-username" {
		3  |   name        = "Linux Join Domain Service Account Username"
		4  |   type        = "SecureString"
		5  |   value       = "INITIAL_VALUE_OVERRIDDEN"
		6  |   description = "Username to join linux machines to azure.noms.root domain"
		7  |   tags        = local.tags
		8  | 
		9  |   lifecycle {
		10 |     ignore_changes = [value]
		11 |   }
		12 | }

Check: CKV_AWS_337: "Ensure SSM parameters are using KMS CMK"
	FAILED for resource: aws_ssm_parameter.linux-join-ad-account-password
	File: /ssm.tf:14-24

		14 | resource "aws_ssm_parameter" "linux-join-ad-account-password" {
		15 |   name        = "Linux Join Domain Service Account Password"
		16 |   type        = "SecureString"
		17 |   value       = "INITIAL_VALUE_OVERRIDDEN"
		18 |   description = "Password to join linux machines to azure.noms.root domain"
		19 |   tags        = local.tags
		20 | 
		21 |   lifecycle {
		22 |     ignore_changes = [value]
		23 |   }
		24 | }
Check: CKV_AWS_103: "Ensure that load balancer is using at least TLS 1.2"
	FAILED for resource: module.baseline.module.lb_listener.aws_lb_listener.this
	File: /../../modules/lb_listener/main.tf:1-61
	Guide: https://docs.paloaltonetworks.com/content/techdocs/en_US/prisma/prisma-cloud/prisma-cloud-code-security-policy-reference/aws-policies/aws-general-policies/bc-aws-general-43.html

		Code lines for this resource are too many. Please use IDE of your choice to review the file.

checkov_exitcode=1

CTFLint Scan Success

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing `terraform` plugin...
Installed `terraform` (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.2.1)
tflint will check the following folders:
terraform/environments/hmpps-domain-services

*****************************

Running tflint in terraform/environments/hmpps-domain-services
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=0