Implement Terraform state locking for member accounts

[dms1981]

As part of ministryofjustice/modernisation-platform#5534, this PR does the following:

• Sets the minor Terraform version in use to 1.6
• Updates the reusable job to assume a backend role in the Modernisation Platform account when terraform init is run
• Removes the ability for customers to set custom Terraform init input values
• Configures a state locking table to be used when Terraform is running for all customers

[github-actions]

TFSEC Scan Success

Show Output

*****************************

TFSEC will check the following folders:

Checkov Scan Success

Show Output

*****************************

Checkov will check the following folders:

CTFLint Scan Success

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing `terraform` plugin...
Installed `terraform` (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.2.1)
tflint will check the following folders:

[github-actions]

TFSEC Scan Success

Show Output

*****************************

TFSEC will check the following folders:

Checkov Scan Success

Show Output

*****************************

Checkov will check the following folders:

CTFLint Scan Success

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing `terraform` plugin...
Installed `terraform` (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.2.1)
tflint will check the following folders:

[github-actions]

TFSEC Scan Success

Show Output

*****************************

TFSEC will check the following folders:
terraform/environments/nomis-data-hub

*****************************

Running TFSEC in terraform/environments/nomis-data-hub
Excluding the following checks: AWS095

======================================================
tfsec is joining the Trivy family

tfsec will continue to remain available 
for the time being, although our engineering 
attention will be directed at Trivy going forward.

You can read more here: 
https://github.com/aquasecurity/tfsec/discussions/1994
======================================================
  timings
  ──────────────────────────────────────────
  disk i/o             3.63292ms
  parsing              227.921955ms
  adaptation           153.605µs
  checks               4.062001ms
  total                235.770481ms

  counts
  ──────────────────────────────────────────
  modules downloaded   0
  modules processed    5
  blocks processed     265
  files read           68

  results
  ──────────────────────────────────────────
  passed               7
  ignored              0
  critical             0
  high                 0
  medium               0
  low                  0


No problems detected!

tfsec_exitcode=0

Checkov Scan Failed

Show Output

*****************************

Checkov will check the following folders:
terraform/environments/nomis-data-hub

*****************************

Running Checkov in terraform/environments/nomis-data-hub
terraform scan results:

Passed checks: 102, Failed checks: 12, Skipped checks: 19

Check: CKV_AWS_337: "Ensure SSM parameters are using KMS CMK"
	FAILED for resource: aws_ssm_parameter.ndh_secrets["ndh_host_os"]
	File: /main.tf:98-108

		98  | resource "aws_ssm_parameter" "ndh_secrets" {
		99  |   for_each = toset(local.ndh_secrets)
		100 |   name     = each.value
		101 |   type     = "SecureString"
		102 |   value    = random_password.random_value.result
		103 |   lifecycle {
		104 |     ignore_changes = [
		105 |       value,
		106 |     ]
		107 |   }
		108 | }

Check: CKV_AWS_337: "Ensure SSM parameters are using KMS CMK"
	FAILED for resource: aws_ssm_parameter.ndh_secrets["ndh_app_host_b"]
	File: /main.tf:98-108

		98  | resource "aws_ssm_parameter" "ndh_secrets" {
		99  |   for_each = toset(local.ndh_secrets)
		100 |   name     = each.value
		101 |   type     = "SecureString"
		102 |   value    = random_password.random_value.result
		103 |   lifecycle {
		104 |     ignore_changes = [
		105 |       value,
		106 |     ]
		107 |   }
		108 | }

Check: CKV_AWS_337: "Ensure SSM parameters are using KMS CMK"
	FAILED for resource: aws_ssm_parameter.ndh_secrets["ndh_ems_port_1"]
	File: /main.tf:98-108

		98  | resource "aws_ssm_parameter" "ndh_secrets" {
		99  |   for_each = toset(local.ndh_secrets)
		100 |   name     = each.value
		101 |   type     = "SecureString"
		102 |   value    = random_password.random_value.result
		103 |   lifecycle {
		104 |     ignore_changes = [
		105 |       value,
		106 |     ]
		107 |   }
		108 | }

Check: CKV_AWS_337: "Ensure SSM parameters are using KMS CMK"
	FAILED for resource: aws_ssm_parameter.ndh_secrets["ndh_host_os_version"]
	File: /main.tf:98-108

		98  | resource "aws_ssm_parameter" "ndh_secrets" {
		99  |   for_each = toset(local.ndh_secrets)
		100 |   name     = each.value
		101 |   type     = "SecureString"
		102 |   value    = random_password.random_value.result
		103 |   lifecycle {
		104 |     ignore_changes = [
		105 |       value,
		106 |     ]
		107 |   }
		108 | }

Check: CKV_AWS_337: "Ensure SSM parameters are using KMS CMK"
	FAILED for resource: aws_ssm_parameter.ndh_secrets["ndh_admin_user"]
	File: /main.tf:98-108

		98  | resource "aws_ssm_parameter" "ndh_secrets" {
		99  |   for_each = toset(local.ndh_secrets)
		100 |   name     = each.value
		101 |   type     = "SecureString"
		102 |   value    = random_password.random_value.result
		103 |   lifecycle {
		104 |     ignore_changes = [
		105 |       value,
		106 |     ]
		107 |   }
		108 | }

Check: CKV_AWS_337: "Ensure SSM parameters are using KMS CMK"
	FAILED for resource: aws_ssm_parameter.ndh_secrets["ndh_domain_name"]
	File: /main.tf:98-108

		98  | resource "aws_ssm_parameter" "ndh_secrets" {
		99  |   for_each = toset(local.ndh_secrets)
		100 |   name     = each.value
		101 |   type     = "SecureString"
		102 |   value    = random_password.random_value.result
		103 |   lifecycle {
		104 |     ignore_changes = [
		105 |       value,
		106 |     ]
		107 |   }
		108 | }

Check: CKV_AWS_337: "Ensure SSM parameters are using KMS CMK"
	FAILED for resource: aws_ssm_parameter.ndh_secrets["ndh_ems_host_a"]
	File: /main.tf:98-108

		98  | resource "aws_ssm_parameter" "ndh_secrets" {
		99  |   for_each = toset(local.ndh_secrets)
		100 |   name     = each.value
		101 |   type     = "SecureString"
		102 |   value    = random_password.random_value.result
		103 |   lifecycle {
		104 |     ignore_changes = [
		105 |       value,
		106 |     ]
		107 |   }
		108 | }

Check: CKV_AWS_337: "Ensure SSM parameters are using KMS CMK"
	FAILED for resource: aws_ssm_parameter.ndh_secrets["ndh_admin_pass"]
	File: /main.tf:98-108

		98  | resource "aws_ssm_parameter" "ndh_secrets" {
		99  |   for_each = toset(local.ndh_secrets)
		100 |   name     = each.value
		101 |   type     = "SecureString"
		102 |   value    = random_password.random_value.result
		103 |   lifecycle {
		104 |     ignore_changes = [
		105 |       value,
		106 |     ]
		107 |   }
		108 | }

Check: CKV_AWS_337: "Ensure SSM parameters are using KMS CMK"
	FAILED for resource: aws_ssm_parameter.ndh_secrets["ndh_ems_host_b"]
	File: /main.tf:98-108

		98  | resource "aws_ssm_parameter" "ndh_secrets" {
		99  |   for_each = toset(local.ndh_secrets)
		100 |   name     = each.value
		101 |   type     = "SecureString"
		102 |   value    = random_password.random_value.result
		103 |   lifecycle {
		104 |     ignore_changes = [
		105 |       value,
		106 |     ]
		107 |   }
		108 | }

Check: CKV_AWS_337: "Ensure SSM parameters are using KMS CMK"
	FAILED for resource: aws_ssm_parameter.ndh_secrets["ndh_ems_port_2"]
	File: /main.tf:98-108

		98  | resource "aws_ssm_parameter" "ndh_secrets" {
		99  |   for_each = toset(local.ndh_secrets)
		100 |   name     = each.value
		101 |   type     = "SecureString"
		102 |   value    = random_password.random_value.result
		103 |   lifecycle {
		104 |     ignore_changes = [
		105 |       value,
		106 |     ]
		107 |   }
		108 | }

Check: CKV_AWS_337: "Ensure SSM parameters are using KMS CMK"
	FAILED for resource: aws_ssm_parameter.ndh_secrets["ndh_app_host_a"]
	File: /main.tf:98-108

		98  | resource "aws_ssm_parameter" "ndh_secrets" {
		99  |   for_each = toset(local.ndh_secrets)
		100 |   name     = each.value
		101 |   type     = "SecureString"
		102 |   value    = random_password.random_value.result
		103 |   lifecycle {
		104 |     ignore_changes = [
		105 |       value,
		106 |     ]
		107 |   }
		108 | }

Check: CKV_AWS_337: "Ensure SSM parameters are using KMS CMK"
	FAILED for resource: aws_ssm_parameter.ndh_secrets["ndh_harkemsadmin_ssl_pass"]
	File: /main.tf:98-108

		98  | resource "aws_ssm_parameter" "ndh_secrets" {
		99  |   for_each = toset(local.ndh_secrets)
		100 |   name     = each.value
		101 |   type     = "SecureString"
		102 |   value    = random_password.random_value.result
		103 |   lifecycle {
		104 |     ignore_changes = [
		105 |       value,
		106 |     ]
		107 |   }
		108 | }


checkov_exitcode=1

CTFLint Scan Failed

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing `terraform` plugin...
Installed `terraform` (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.2.1)
tflint will check the following folders:
terraform/environments/nomis-data-hub

*****************************

Running tflint in terraform/environments/nomis-data-hub
Excluding the following checks: terraform_unused_declarations
1 issue(s) found:

Warning: Missing version constraint for provider "random" in "required_providers" (terraform_required_providers)

  on terraform/environments/nomis-data-hub/main.tf line 93:
  93: resource "random_password" "random_value" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.2.1/docs/rules/terraform_required_providers.md

tflint_exitcode=2