Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bump ecs::modernisation-platform-terraform-ecs-cluster from 2.0.1 to 4.2.1 in /terraform/environments/delius-jitbit #5993

Closed
wants to merge 1 commit into from
Closed

Bump ecs::modernisation-platform-terraform-ecs-cluster from 2.0.1 to 4.2.1 in /terraform/environments/delius-jitbit #5993

wants to merge 1 commit into from

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github May 8, 2024

Bumps ecs::modernisation-platform-terraform-ecs-cluster from 2.0.1 to 4.2.1.

Release notes

Sourced from ecs::modernisation-platform-terraform-ecs-cluster's releases.

v4.2.1

What's Changed

New Contributors

Full Changelog: ministryofjustice/modernisation-platform-terraform-ecs-cluster@v4.2.0...v4.2.1

v4.2.0

What's New

Mount points are now supported in a container definition

What's Changed

Full Changelog: ministryofjustice/modernisation-platform-terraform-ecs-cluster@v4.1.1...v4.2.0

v4.1.1

Change to replace [*] with [0] to select one item not a list.

What's Changed

Full Changelog: ministryofjustice/modernisation-platform-terraform-ecs-cluster@v4.1.0...v4.1.1

4.1.0

Introduced new attributes that can be passed into the module. See below for details of all changes.

What's Changed

New Contributors

Full Changelog: ministryofjustice/modernisation-platform-terraform-ecs-cluster@v4.0.3...v4.1.0

... (truncated)

Commits
  • e4f82fe 📝 Add Documentation for the container definition module (#143)
  • 49dba4d Merge pull request #142 from ministryofjustice/dependabot/github_actions/brid...
  • 91660d0 Build(deps): Bump bridgecrewio/checkov-action
  • 1a927b6 Merge pull request #141 from ministryofjustice/dependabot/github_actions/acti...
  • bd7af0d Build(deps): Bump actions/setup-go from 5.0.0 to 5.0.1
  • 754e008 Merge pull request #140 from ministryofjustice/feature/6675-github-action-sta...
  • 44f79f1 feature/6675-GitHub Action Status Badges
  • f8bdd52 Merge pull request #138 from ministryofjustice/mount-points-bug
  • 804641b add mount points to json
  • c0e0768 Merge pull request #137 from ministryofjustice/no-splatting
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
Bump ecs::modernisation-platform-terraform-ecs-cluster
8bd6e8d 
Bumps [ecs::modernisation-platform-terraform-ecs-cluster](https://github.com/ministryofjustice/modernisation-platform-terraform-ecs-cluster) from 2.0.1 to 4.2.1.
- [Release notes](https://github.com/ministryofjustice/modernisation-platform-terraform-ecs-cluster/releases)
- [Commits](ministryofjustice/modernisation-platform-terraform-ecs-cluster@v2.0.1...v4.2.1)

---
updated-dependencies:
- dependency-name: ecs::github::ministryofjustice/modernisation-platform-terraform-ecs-cluster::v2.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot requested a review from a team as a code owner May 8, 2024 01:04
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label May 8, 2024
@dependabot dependabot bot requested a review from a team as a code owner May 8, 2024 01:04
@dependabot dependabot bot added the terraform Pull requests that update Terraform code label May 8, 2024
@dependabot dependabot bot requested a review from a team as a code owner May 8, 2024 01:04
@dependabot dependabot bot mentioned this pull request May 8, 2024
Closed
@github-actions github-actions bot added the environments-repository Used to exclude PRs from this repo in our Slack PR update label May 8, 2024
@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented May 8, 2024

Trivy Scan Failed

Show Output ```hcl

Trivy will check the following folders:
terraform/environments/delius-jitbit

Running Trivy in terraform/environments/delius-jitbit
2024-05-08T01:06:15Z INFO Need to update DB
2024-05-08T01:06:15Z INFO Downloading DB... repository="ghcr.io/aquasecurity/trivy-db:2"
2024-05-08T01:06:17Z INFO Vulnerability scanning is enabled
2024-05-08T01:06:17Z INFO Misconfiguration scanning is enabled
2024-05-08T01:06:17Z INFO Need to update the built-in policies
2024-05-08T01:06:17Z INFO Downloading the built-in policies...
50.41 KiB / 50.41 KiB [-----------------------------------------------------------] 100.00% ? p/s 0s2024-05-08T01:06:17Z INFO Secret scanning is enabled
2024-05-08T01:06:17Z INFO If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-05-08T01:06:17Z INFO Please see also https://aquasecurity.github.io/trivy/v0.51/docs/scanner/secret/#recommendation for faster secret detection
2024-05-08T01:06:22Z INFO Number of language-specific files num=0
2024-05-08T01:06:22Z INFO Detected config files num=15

ecs.tf (terraform)

Tests: 2 (SUCCESSES: 1, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 0, CRITICAL: 1)

CRITICAL: Security group rule allows egress to multiple public internet addresses.
════════════════════════════════════════
Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.

See https://avd.aquasec.com/misconfig/avd-aws-0104
────────────────────────────────────────
ecs.tf:70
via ecs.tf:64-72 (aws_security_group_rule.allow_all_egress)
────────────────────────────────────────
64 resource "aws_security_group_rule" "allow_all_egress" {
65 description = "Allow all outbound traffic to any IPv4 address"
66 type = "egress"
67 from_port = 0
68 to_port = 0
69 protocol = "-1"
70 [ cidr_blocks = ["0.0.0.0/0"]
71 security_group_id = aws_security_group.jitbit.id
72 }
────────────────────────────────────────

github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.2.1/main.tf (terraform)

Tests: 7 (SUCCESSES: 5, FAILURES: 0, EXCEPTIONS: 2)
Failures: 0 (HIGH: 0, CRITICAL: 0)

github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0/main.tf (terraform)

Tests: 14 (SUCCESSES: 12, FAILURES: 2, EXCEPTIONS: 0)
Failures: 2 (HIGH: 2, CRITICAL: 0)

HIGH: Bucket does not encrypt data with a customer managed key.
════════════════════════════════════════
Encryption using AWS keys provides protection for your S3 buckets. To increase control of the encryption and manage factors like rotation use customer managed keys.

See https://avd.aquasec.com/misconfig/avd-aws-0132
────────────────────────────────────────
github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0/main.tf:157-165
via s3.tf:1-84 (module.jitbit_bucket)
────────────────────────────────────────
157 ┌ resource "aws_s3_bucket_server_side_encryption_configuration" "default" {
158 │ bucket = aws_s3_bucket.default.id
159 │ rule {
160 │ apply_server_side_encryption_by_default {
161 │ sse_algorithm = var.sse_algorithm
162 │ kms_master_key_id = (var.custom_kms_key != "") ? var.custom_kms_key : ""
163 │ }
164 │ }
165 └ }
────────────────────────────────────────

HIGH: Bucket does not encrypt data with a customer managed key.
════════════════════════════════════════
Encryption using AWS keys provides protection for your S3 buckets. To increase control of the encryption and manage factors like rotation use customer managed keys.

See https://avd.aquasec.com/misconfig/avd-aws-0132
────────────────────────────────────────
github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0/main.tf:157-165
via ecs.tf:11-51 (module.s3_bucket_app_deployment)
────────────────────────────────────────
157 ┌ resource "aws_s3_bucket_server_side_encryption_configuration" "default" {
158 │ bucket = aws_s3_bucket.default.id
159 │ rule {
160 │ apply_server_side_encryption_by_default {
161 │ sse_algorithm = var.sse_algorithm
162 │ kms_master_key_id = (var.custom_kms_key != "") ? var.custom_kms_key : ""
163 │ }
164 │ }
165 └ }
────────────────────────────────────────

iam.tf (terraform)

Tests: 6 (SUCCESSES: 0, FAILURES: 0, EXCEPTIONS: 6)
Failures: 0 (HIGH: 0, CRITICAL: 0)

lb.tf (terraform)

Tests: 7 (SUCCESSES: 4, FAILURES: 2, EXCEPTIONS: 1)
Failures: 2 (HIGH: 0, CRITICAL: 2)

CRITICAL: Security group rule allows ingress from public internet.
════════════════════════════════════════
Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.

See https://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
lb.tf:62-70
via lb.tf:35-71 (ingress)
via lb.tf:30-87 (aws_security_group.load_balancer_security_group)
────────────────────────────────────────
30 resource "aws_security_group" "load_balancer_security_group" {
..
62 ┌ ipv6_cidr_blocks = [
63 │ # Route53 Healthcheck Access Cidrs IPv6
64 │ "2406:da18:7ff:f800::/53", # ap-southeast-1 Region
65 │ "2406:da18:fff:f800::/53", # ap-southeast-1 Region
66 │ "2a05:d018:fff:f800::/53", # eu-west-1 Region
67 │ "2a05:d018:7ff:f800::/53", # eu-west-1 Region
68 └ "2600:1f18:7fff:f800::/53", # us-east-1 Region
..
────────────────────────────────────────

CRITICAL: Security group rule allows ingress from public internet.
════════════════════════════════════════
Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.

See https://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
lb.tf:40-60
via lb.tf:35-71 (ingress)
via lb.tf:30-87 (aws_security_group.load_balancer_security_group)
────────────────────────────────────────
30 resource "aws_security_group" "load_balancer_security_group" {
..
40 ┌ cidr_blocks = distinct(flatten([
41 │ "20.49.214.199/32", # Azure Landing Zone Egress
42 │ "20.49.214.228/32", # Azure Landing Zone Egress
43 │ "20.26.11.71/32", # Azure Landing Zone Egress
44 │ "20.26.11.108/32", # Azure Landing Zone Egress
45 │ # Route53 Healthcheck Access Cidrs
46 └ # London Region not support yet, so metrics are not yet publised, can be enabled at later stage for Route53 endpoint monitor
..
────────────────────────────────────────

monitoring.tf (terraform)

Tests: 2 (SUCCESSES: 1, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Topic does not have encryption enabled.
════════════════════════════════════════
Topics should be encrypted to protect their contents.

See https://avd.aquasec.com/misconfig/avd-aws-0095
────────────────────────────────────────
monitoring.tf:6-8
────────────────────────────────────────
6 ┌ resource "aws_sns_topic" "jitbit_alerting" {
7 │ name = "jitbit_alerting"
8 └ }
────────────────────────────────────────

ses-logging.tf (terraform)

Tests: 5 (SUCCESSES: 2, FAILURES: 1, EXCEPTIONS: 2)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Topic does not have encryption enabled.
════════════════════════════════════════
Topics should be encrypted to protect their contents.

See https://avd.aquasec.com/misconfig/avd-aws-0095
────────────────────────────────────────
ses-logging.tf:17-21
────────────────────────────────────────
17 ┌ resource "aws_sns_topic" "jitbit_ses_destination_topic" {
18 │ name = format("%s-ses-destination-topic", local.application_name)
19 │
20 │ tags = local.tags
21 └ }
────────────────────────────────────────

ses.tf (terraform)

Tests: 2 (SUCCESSES: 0, FAILURES: 0, EXCEPTIONS: 2)
Failures: 0 (HIGH: 0, CRITICAL: 0)

trivy_exitcode=1

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/delius-jitbit

*****************************

Running Checkov in terraform/environments/delius-jitbit
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2024-05-08 01:06:25,380 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0:None (for external modules, the --download-external-modules flag is required)
2024-05-08 01:06:25,381 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.1.0:None (for external modules, the --download-external-modules flag is required)
2024-05-08 01:06:25,381 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-ecs-cluster//cluster?ref=v2.0.1:None (for external modules, the --download-external-modules flag is required)
2024-05-08 01:06:25,381 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-pagerduty-integration?ref=v2.0.0:None (for external modules, the --download-external-modules flag is required)
2024-05-08 01:06:25,381 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.2.1:None (for external modules, the --download-external-modules flag is required)
2024-05-08 01:06:25,381 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-ecs-cluster//cluster?ref=v4.2.1:None (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 259, Failed checks: 51, Skipped checks: 20

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: bastion_linux
	File: /bastion_linux.tf:6-43
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		6  | module "bastion_linux" {
		7  |   source = "github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.2.1"
		8  | 
		9  |   providers = {
		10 |     aws.share-host   = aws.core-vpc # core-vpc-(environment) holds the networking for all accounts
		11 |     aws.share-tenant = aws          # The default provider (unaliased, `aws`) is the tenant
		12 |   }
		13 | 
		14 |   # s3 - used for logs and user ssh public keys
		15 |   bucket_name          = "bastion"
		16 |   bucket_versioning    = true
		17 |   bucket_force_destroy = true
		18 |   # public keys
		19 |   public_key_data = local.public_key_data.keys[local.environment]
		20 |   # logs
		21 |   log_auto_clean       = "Enabled"
		22 |   log_standard_ia_days = 30  # days before moving to IA storage
		23 |   log_glacier_days     = 60  # days before moving to Glacier
		24 |   log_expiry_days      = 180 # days before log expiration
		25 |   # bastion
		26 |   allow_ssh_commands = false
		27 | 
		28 |   app_name      = var.networking[0].application
		29 |   business_unit = local.vpc_name
		30 |   subnet_set    = local.subnet_set
		31 |   environment   = local.environment
		32 |   region        = "eu-west-2"
		33 | 
		34 |   # custom scaling schedule
		35 |   autoscaling_cron = {
		36 |     "down" : "0 21 * * *",
		37 |     "up" : "0 05 * * *"
		38 |   }
		39 | 
		40 |   # Tags
		41 |   tags_common = local.tags
		42 |   tags_prefix = terraform.workspace
		43 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.jitbit
	File: /ecs.tf:84-87
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		84 | resource "aws_cloudwatch_log_group" "jitbit" {
		85 |   name              = format("%s-ecs", local.application_name)
		86 |   retention_in_days = 30
		87 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.jitbit
	File: /ecs.tf:84-87
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		84 | resource "aws_cloudwatch_log_group" "jitbit" {
		85 |   name              = format("%s-ecs", local.application_name)
		86 |   retention_in_days = 30
		87 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: ecs
	File: /ecs.tf:1-8
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		1 | module "ecs" {
		2 |   source = "github.com/ministryofjustice/modernisation-platform-terraform-ecs-cluster//cluster?ref=v4.2.1"
		3 | 
		4 |   environment = local.environment
		5 |   name        = local.application_name
		6 | 
		7 |   tags = local.tags
		8 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: s3_bucket_app_deployment
	File: /ecs.tf:11-51
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		11 | module "s3_bucket_app_deployment" {
		12 | 
		13 |   source = "github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0"
		14 | 
		15 |   providers = {
		16 |     aws.bucket-replication = aws
		17 |   }
		18 |   bucket_name        = "${local.application_name}-${local.environment}-deployment"
		19 |   versioning_enabled = true
		20 | 
		21 |   ownership_controls = "BucketOwnerEnforced"
		22 | 
		23 |   lifecycle_rule = [
		24 |     {
		25 |       id      = "main"
		26 |       enabled = "Enabled"
		27 |       prefix  = ""
		28 | 
		29 |       tags = {
		30 |         rule      = "log"
		31 |         autoclean = "true"
		32 |       }
		33 | 
		34 |       noncurrent_version_transition = [
		35 |         {
		36 |           days          = 90
		37 |           storage_class = "STANDARD_IA"
		38 |           }, {
		39 |           days          = 365
		40 |           storage_class = "GLACIER"
		41 |         }
		42 |       ]
		43 | 
		44 |       noncurrent_version_expiration = {
		45 |         days = 730
		46 |       }
		47 |     }
		48 |   ]
		49 | 
		50 |   tags = local.tags
		51 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.ecs_service_policy
	File: /iam.tf:37-52
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		37 | data "aws_iam_policy_document" "ecs_service_policy" {
		38 |   statement {
		39 |     effect    = "Allow"
		40 |     resources = ["*"]
		41 | 
		42 |     actions = [
		43 |       "elasticloadbalancing:Describe*",
		44 |       "elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
		45 |       "elasticloadbalancing:RegisterInstancesWithLoadBalancer",
		46 |       "ec2:Describe*",
		47 |       "ec2:AuthorizeSecurityGroupIngress",
		48 |       "elasticloadbalancing:RegisterTargets",
		49 |       "elasticloadbalancing:DeregisterTargets"
		50 |     ]
		51 |   }
		52 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.ecs_service_policy
	File: /iam.tf:37-52
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		37 | data "aws_iam_policy_document" "ecs_service_policy" {
		38 |   statement {
		39 |     effect    = "Allow"
		40 |     resources = ["*"]
		41 | 
		42 |     actions = [
		43 |       "elasticloadbalancing:Describe*",
		44 |       "elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
		45 |       "elasticloadbalancing:RegisterInstancesWithLoadBalancer",
		46 |       "ec2:Describe*",
		47 |       "ec2:AuthorizeSecurityGroupIngress",
		48 |       "elasticloadbalancing:RegisterTargets",
		49 |       "elasticloadbalancing:DeregisterTargets"
		50 |     ]
		51 |   }
		52 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.ecs_exec
	File: /iam.tf:98-114
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		98  | data "aws_iam_policy_document" "ecs_exec" {
		99  |   statement {
		100 |     effect    = "Allow"
		101 |     resources = ["*"]
		102 | 
		103 |     actions = [
		104 |       "ssm:GetParameters",
		105 |       "ecr:GetAuthorizationToken",
		106 |       "ecr:BatchCheckLayerAvailability",
		107 |       "ecr:GetDownloadUrlForLayer",
		108 |       "ecr:BatchGetImage",
		109 |       "logs:CreateLogGroup",
		110 |       "logs:CreateLogStream",
		111 |       "logs:PutLogEvents"
		112 |     ]
		113 |   }
		114 | }

Check: CKV_AWS_108: "Ensure IAM policies does not allow data exfiltration"
	FAILED for resource: aws_iam_policy_document.ecs_exec
	File: /iam.tf:98-114
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-data-exfiltration

		98  | data "aws_iam_policy_document" "ecs_exec" {
		99  |   statement {
		100 |     effect    = "Allow"
		101 |     resources = ["*"]
		102 | 
		103 |     actions = [
		104 |       "ssm:GetParameters",
		105 |       "ecr:GetAuthorizationToken",
		106 |       "ecr:BatchCheckLayerAvailability",
		107 |       "ecr:GetDownloadUrlForLayer",
		108 |       "ecr:BatchGetImage",
		109 |       "logs:CreateLogGroup",
		110 |       "logs:CreateLogStream",
		111 |       "logs:PutLogEvents"
		112 |     ]
		113 |   }
		114 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.ecs_exec
	File: /iam.tf:98-114
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		98  | data "aws_iam_policy_document" "ecs_exec" {
		99  |   statement {
		100 |     effect    = "Allow"
		101 |     resources = ["*"]
		102 | 
		103 |     actions = [
		104 |       "ssm:GetParameters",
		105 |       "ecr:GetAuthorizationToken",
		106 |       "ecr:BatchCheckLayerAvailability",
		107 |       "ecr:GetDownloadUrlForLayer",
		108 |       "ecr:BatchGetImage",
		109 |       "logs:CreateLogGroup",
		110 |       "logs:CreateLogStream",
		111 |       "logs:PutLogEvents"
		112 |     ]
		113 |   }
		114 | }

Check: CKV_AWS_26: "Ensure all data stored in the SNS topic is encrypted"
	FAILED for resource: aws_sns_topic.jitbit_alerting
	File: /monitoring.tf:6-8
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-15

		6 | resource "aws_sns_topic" "jitbit_alerting" {
		7 |   name = "jitbit_alerting"
		8 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: pagerduty_core_alerts
	File: /monitoring.tf:37-44
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		37 | module "pagerduty_core_alerts" {
		38 |   depends_on = [
		39 |     aws_sns_topic.jitbit_alerting
		40 |   ]
		41 |   source                    = "github.com/ministryofjustice/modernisation-platform-terraform-pagerduty-integration?ref=v2.0.0"
		42 |   sns_topics                = [aws_sns_topic.jitbit_alerting.name]
		43 |   pagerduty_integration_key = local.pagerduty_integration_key
		44 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.app_logs
	File: /monitoring_app.tf:1-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		1 | resource "aws_cloudwatch_log_group" "app_logs" {
		2 |   name              = "delius-jitbit-ecs"
		3 |   retention_in_days = 30
		4 | 
		5 |   tags = local.tags
		6 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.app_logs
	File: /monitoring_app.tf:1-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		1 | resource "aws_cloudwatch_log_group" "app_logs" {
		2 |   name              = "delius-jitbit-ecs"
		3 |   retention_in_days = 30
		4 | 
		5 |   tags = local.tags
		6 | }

Check: CKV_AWS_354: "Ensure RDS Performance Insights are encrypted using KMS CMKs"
	FAILED for resource: aws_db_instance.jitbit
	File: /rds.tf:40-83
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-354

		40 | resource "aws_db_instance" "jitbit" {
		41 |   engine         = "sqlserver-se"
		42 |   license_model  = "license-included"
		43 |   engine_version = local.application_data.accounts[local.environment].db_engine_version
		44 |   instance_class = local.application_data.accounts[local.environment].db_instance_class
		45 |   identifier     = "${local.application_name}-${local.environment}-database"
		46 |   username       = local.application_data.accounts[local.environment].db_user
		47 | 
		48 |   manage_master_user_password = true
		49 | 
		50 |   snapshot_identifier = try(local.application_data.accounts[local.environment].db_snapshot_identifier, null)
		51 | 
		52 |   # tflint-ignore: aws_db_instance_default_parameter_group
		53 |   parameter_group_name        = "default.sqlserver-se-15.0"
		54 |   deletion_protection         = local.application_data.accounts[local.environment].db_deletion_protection
		55 |   delete_automated_backups    = local.application_data.accounts[local.environment].db_delete_automated_backups
		56 |   skip_final_snapshot         = local.skip_final_snapshot
		57 |   final_snapshot_identifier   = !local.skip_final_snapshot ? "${local.application_name}-${local.environment}-database-final-snapshot" : null
		58 |   allocated_storage           = local.application_data.accounts[local.environment].db_allocated_storage
		59 |   max_allocated_storage       = local.application_data.accounts[local.environment].db_max_allocated_storage
		60 |   storage_type                = local.application_data.accounts[local.environment].db_storage_type
		61 |   maintenance_window          = local.application_data.accounts[local.environment].db_maintenance_window
		62 |   auto_minor_version_upgrade  = local.application_data.accounts[local.environment].db_auto_minor_version_upgrade
		63 |   allow_major_version_upgrade = local.application_data.accounts[local.environment].db_allow_major_version_upgrade
		64 |   backup_window               = local.application_data.accounts[local.environment].db_backup_window
		65 |   backup_retention_period     = local.application_data.accounts[local.environment].db_retention_period
		66 |   #checkov:skip=CKV_AWS_133: "backup_retention enabled, can be edited it application_variables.json"
		67 |   iam_database_authentication_enabled = local.application_data.accounts[local.environment].db_iam_database_authentication_enabled
		68 |   #checkov:skip=CKV_AWS_161: "iam auth enabled, but optional"
		69 |   db_subnet_group_name   = aws_db_subnet_group.jitbit.id
		70 |   vpc_security_group_ids = [aws_security_group.database_security_group.id]
		71 |   multi_az               = local.application_data.accounts[local.environment].db_multi_az
		72 |   #checkov:skip=CKV_AWS_157: "multi-az enabled, but optional"
		73 |   monitoring_interval = local.application_data.accounts[local.environment].db_monitoring_interval
		74 |   monitoring_role_arn = local.application_data.accounts[local.environment].db_monitoring_interval == 0 ? "" : aws_iam_role.rds_enhanced_monitoring[0].arn
		75 |   #checkov:skip=CKV_AWS_118: "enhanced monitoring is enabled, but optional"
		76 |   storage_encrypted               = true
		77 |   performance_insights_enabled    = local.application_data.accounts[local.environment].db_performance_insights_enabled
		78 |   performance_insights_kms_key_id = "" #tfsec:ignore:aws-rds-enable-performance-insights-encryption Left empty so that it will run, however should be populated with real key in scenario.
		79 |   enabled_cloudwatch_logs_exports = local.application_data.accounts[local.environment].db_enabled_cloudwatch_logs_exports
		80 |   tags = merge(local.tags,
		81 |     { Name = lower(format("%s-%s-database", local.application_name, local.environment)) }
		82 |   )
		83 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: jitbit_bucket
	File: /s3.tf:1-84
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.jitbit_sandbox
	File: /sandbox_ecs.tf:92-97
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		92 | resource "aws_cloudwatch_log_group" "jitbit_sandbox" {
		93 |   count = local.is-development ? 1 : 0
		94 | 
		95 |   name              = format("%s-%s-ecs", local.application_name, "sandbox")
		96 |   retention_in_days = 30
		97 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.jitbit_sandbox
	File: /sandbox_ecs.tf:92-97
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		92 | resource "aws_cloudwatch_log_group" "jitbit_sandbox" {
		93 |   count = local.is-development ? 1 : 0
		94 | 
		95 |   name              = format("%s-%s-ecs", local.application_name, "sandbox")
		96 |   retention_in_days = 30
		97 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: ecs_sandbox
	File: /sandbox_ecs.tf:1-10
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		1  | module "ecs_sandbox" {
		2  |   count = local.is-development ? 1 : 0
		3  | 
		4  |   source = "github.com/ministryofjustice/modernisation-platform-terraform-ecs-cluster//cluster?ref=v2.0.1"
		5  | 
		6  |   environment = local.environment
		7  |   name        = "${local.application_name}-sandbox"
		8  | 
		9  |   tags = local.tags
		10 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: s3_bucket_app_deployment_sandbox
	File: /sandbox_ecs.tf:12-53
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		12 | module "s3_bucket_app_deployment_sandbox" {
		13 |   count = local.is-development ? 1 : 0
		14 | 
		15 |   source = "github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0"
		16 | 
		17 |   providers = {
		18 |     aws.bucket-replication = aws
		19 |   }
		20 |   bucket_name        = "${local.application_name}-sandbox-deployment"
		21 |   versioning_enabled = true
		22 | 
		23 |   ownership_controls = "BucketOwnerEnforced"
		24 | 
		25 |   lifecycle_rule = [
		26 |     {
		27 |       id      = "main"
		28 |       enabled = "Enabled"
		29 |       prefix  = ""
		30 | 
		31 |       tags = {
		32 |         rule      = "log"
		33 |         autoclean = "true"
		34 |       }
		35 | 
		36 |       noncurrent_version_transition = [
		37 |         {
		38 |           days          = 90
		39 |           storage_class = "STANDARD_IA"
		40 |           }, {
		41 |           days          = 365
		42 |           storage_class = "GLACIER"
		43 |         }
		44 |       ]
		45 | 
		46 |       noncurrent_version_expiration = {
		47 |         days = 730
		48 |       }
		49 |     }
		50 |   ]
		51 | 
		52 |   tags = local.tags
		53 | }

Check: CKV_AWS_150: "Ensure that Load Balancer has deletion protection enabled"
	FAILED for resource: aws_lb.external_sandbox
	File: /sandbox_lb.tf:2-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-150

		2  | resource "aws_lb" "external_sandbox" {
		3  |   # checkov:skip=CKV_AWS_91
		4  |   # checkov:skip=CKV2_AWS_28
		5  | 
		6  |   count = local.is-development ? 1 : 0
		7  | 
		8  |   name               = "${local.application_name}-lb-sandbox"
		9  |   internal           = false
		10 |   load_balancer_type = "application"
		11 |   security_groups    = [aws_security_group.load_balancer_security_group_sandbox[0].id]
		12 |   subnets            = data.aws_subnets.shared-public.ids
		13 | 
		14 |   drop_invalid_header_fields = true
		15 | 
		16 |   tags = merge(
		17 |     local.tags,
		18 |     {
		19 |       Name = "${local.application_name}-sandbox"
		20 |     }
		21 |   )
		22 | }

Check: CKV_AWS_118: "Ensure that enhanced monitoring is enabled for Amazon RDS instances"
	FAILED for resource: aws_db_instance.jitbit_sandbox
	File: /sandbox_rds.tf:27-70
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/ensure-that-enhanced-monitoring-is-enabled-for-amazon-rds-instances

		27 | resource "aws_db_instance" "jitbit_sandbox" {
		28 |   count = local.is-development ? 1 : 0
		29 | 
		30 |   engine         = "sqlserver-se"
		31 |   license_model  = "license-included"
		32 |   engine_version = local.application_data.accounts["sandbox"].db_engine_version
		33 |   instance_class = local.application_data.accounts["sandbox"].db_instance_class
		34 |   identifier     = "${local.application_name}-sandbox-database"
		35 |   username       = local.application_data.accounts["sandbox"].db_user
		36 | 
		37 |   manage_master_user_password = true
		38 | 
		39 |   snapshot_identifier = try(local.application_data.accounts["sandbox"].db_snapshot_identifier, null)
		40 | 
		41 |   # tflint-ignore: aws_db_instance_default_parameter_group
		42 |   parameter_group_name        = "default.sqlserver-se-15.0"
		43 |   deletion_protection         = local.application_data.accounts["sandbox"].db_deletion_protection
		44 |   delete_automated_backups    = local.application_data.accounts["sandbox"].db_delete_automated_backups
		45 |   skip_final_snapshot         = local.application_data.accounts["sandbox"].db_skip_final_snapshot
		46 |   final_snapshot_identifier   = !local.skip_final_snapshot ? "${local.application_name}-sandbox-database-final-snapshot" : null
		47 |   allocated_storage           = local.application_data.accounts["sandbox"].db_allocated_storage
		48 |   max_allocated_storage       = local.application_data.accounts["sandbox"].db_max_allocated_storage
		49 |   storage_type                = local.application_data.accounts["sandbox"].db_storage_type
		50 |   maintenance_window          = local.application_data.accounts["sandbox"].db_maintenance_window
		51 |   auto_minor_version_upgrade  = local.application_data.accounts["sandbox"].db_auto_minor_version_upgrade
		52 |   allow_major_version_upgrade = local.application_data.accounts["sandbox"].db_allow_major_version_upgrade
		53 |   backup_window               = local.application_data.accounts["sandbox"].db_backup_window
		54 |   backup_retention_period     = local.application_data.accounts["sandbox"].db_retention_period
		55 |   #checkov:skip=CKV_AWS_133: "backup_retention enabled, can be edited it application_variables.json"
		56 |   iam_database_authentication_enabled = local.application_data.accounts["sandbox"].db_iam_database_authentication_enabled
		57 |   #checkov:skip=CKV_AWS_161: "iam auth enabled, but optional"
		58 |   db_subnet_group_name   = aws_db_subnet_group.jitbit.id
		59 |   vpc_security_group_ids = [aws_security_group.database_security_group_sandbox[0].id]
		60 |   multi_az               = local.application_data.accounts["sandbox"].db_multi_az
		61 |   #checkov:skip=CKV_AWS_157: "multi-az enabled, but optional"
		62 |   storage_encrypted = true
		63 | 
		64 |   tags = merge(
		65 |     local.tags,
		66 |     {
		67 |       Name = lower(format("%s-%s-database", local.application_name, "sandbox"))
		68 |     }
		69 |   )
		70 | }

Check: CKV_AWS_129: "Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled"
	FAILED for resource: aws_db_instance.jitbit_sandbox
	File: /sandbox_rds.tf:27-70
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-that-respective-logs-of-amazon-relational-database-service-amazon-rds-are-enabled

		27 | resource "aws_db_instance" "jitbit_sandbox" {
		28 |   count = local.is-development ? 1 : 0
		29 | 
		30 |   engine         = "sqlserver-se"
		31 |   license_model  = "license-included"
		32 |   engine_version = local.application_data.accounts["sandbox"].db_engine_version
		33 |   instance_class = local.application_data.accounts["sandbox"].db_instance_class
		34 |   identifier     = "${local.application_name}-sandbox-database"
		35 |   username       = local.application_data.accounts["sandbox"].db_user
		36 | 
		37 |   manage_master_user_password = true
		38 | 
		39 |   snapshot_identifier = try(local.application_data.accounts["sandbox"].db_snapshot_identifier, null)
		40 | 
		41 |   # tflint-ignore: aws_db_instance_default_parameter_group
		42 |   parameter_group_name        = "default.sqlserver-se-15.0"
		43 |   deletion_protection         = local.application_data.accounts["sandbox"].db_deletion_protection
		44 |   delete_automated_backups    = local.application_data.accounts["sandbox"].db_delete_automated_backups
		45 |   skip_final_snapshot         = local.application_data.accounts["sandbox"].db_skip_final_snapshot
		46 |   final_snapshot_identifier   = !local.skip_final_snapshot ? "${local.application_name}-sandbox-database-final-snapshot" : null
		47 |   allocated_storage           = local.application_data.accounts["sandbox"].db_allocated_storage
		48 |   max_allocated_storage       = local.application_data.accounts["sandbox"].db_max_allocated_storage
		49 |   storage_type                = local.application_data.accounts["sandbox"].db_storage_type
		50 |   maintenance_window          = local.application_data.accounts["sandbox"].db_maintenance_window
		51 |   auto_minor_version_upgrade  = local.application_data.accounts["sandbox"].db_auto_minor_version_upgrade
		52 |   allow_major_version_upgrade = local.application_data.accounts["sandbox"].db_allow_major_version_upgrade
		53 |   backup_window               = local.application_data.accounts["sandbox"].db_backup_window
		54 |   backup_retention_period     = local.application_data.accounts["sandbox"].db_retention_period
		55 |   #checkov:skip=CKV_AWS_133: "backup_retention enabled, can be edited it application_variables.json"
		56 |   iam_database_authentication_enabled = local.application_data.accounts["sandbox"].db_iam_database_authentication_enabled
		57 |   #checkov:skip=CKV_AWS_161: "iam auth enabled, but optional"
		58 |   db_subnet_group_name   = aws_db_subnet_group.jitbit.id
		59 |   vpc_security_group_ids = [aws_security_group.database_security_group_sandbox[0].id]
		60 |   multi_az               = local.application_data.accounts["sandbox"].db_multi_az
		61 |   #checkov:skip=CKV_AWS_157: "multi-az enabled, but optional"
		62 |   storage_encrypted = true
		63 | 
		64 |   tags = merge(
		65 |     local.tags,
		66 |     {
		67 |       Name = lower(format("%s-%s-database", local.application_name, "sandbox"))
		68 |     }
		69 |   )
		70 | }

Check: CKV_AWS_354: "Ensure RDS Performance Insights are encrypted using KMS CMKs"
	FAILED for resource: aws_db_instance.jitbit_sandbox
	File: /sandbox_rds.tf:27-70
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-354

		27 | resource "aws_db_instance" "jitbit_sandbox" {
		28 |   count = local.is-development ? 1 : 0
		29 | 
		30 |   engine         = "sqlserver-se"
		31 |   license_model  = "license-included"
		32 |   engine_version = local.application_data.accounts["sandbox"].db_engine_version
		33 |   instance_class = local.application_data.accounts["sandbox"].db_instance_class
		34 |   identifier     = "${local.application_name}-sandbox-database"
		35 |   username       = local.application_data.accounts["sandbox"].db_user
		36 | 
		37 |   manage_master_user_password = true
		38 | 
		39 |   snapshot_identifier = try(local.application_data.accounts["sandbox"].db_snapshot_identifier, null)
		40 | 
		41 |   # tflint-ignore: aws_db_instance_default_parameter_group
		42 |   parameter_group_name        = "default.sqlserver-se-15.0"
		43 |   deletion_protection         = local.application_data.accounts["sandbox"].db_deletion_protection
		44 |   delete_automated_backups    = local.application_data.accounts["sandbox"].db_delete_automated_backups
		45 |   skip_final_snapshot         = local.application_data.accounts["sandbox"].db_skip_final_snapshot
		46 |   final_snapshot_identifier   = !local.skip_final_snapshot ? "${local.application_name}-sandbox-database-final-snapshot" : null
		47 |   allocated_storage           = local.application_data.accounts["sandbox"].db_allocated_storage
		48 |   max_allocated_storage       = local.application_data.accounts["sandbox"].db_max_allocated_storage
		49 |   storage_type                = local.application_data.accounts["sandbox"].db_storage_type
		50 |   maintenance_window          = local.application_data.accounts["sandbox"].db_maintenance_window
		51 |   auto_minor_version_upgrade  = local.application_data.accounts["sandbox"].db_auto_minor_version_upgrade
		52 |   allow_major_version_upgrade = local.application_data.accounts["sandbox"].db_allow_major_version_upgrade
		53 |   backup_window               = local.application_data.accounts["sandbox"].db_backup_window
		54 |   backup_retention_period     = local.application_data.accounts["sandbox"].db_retention_period
		55 |   #checkov:skip=CKV_AWS_133: "backup_retention enabled, can be edited it application_variables.json"
		56 |   iam_database_authentication_enabled = local.application_data.accounts["sandbox"].db_iam_database_authentication_enabled
		57 |   #checkov:skip=CKV_AWS_161: "iam auth enabled, but optional"
		58 |   db_subnet_group_name   = aws_db_subnet_group.jitbit.id
		59 |   vpc_security_group_ids = [aws_security_group.database_security_group_sandbox[0].id]
		60 |   multi_az               = local.application_data.accounts["sandbox"].db_multi_az
		61 |   #checkov:skip=CKV_AWS_157: "multi-az enabled, but optional"
		62 |   storage_encrypted = true
		63 | 
		64 |   tags = merge(
		65 |     local.tags,
		66 |     {
		67 |       Name = lower(format("%s-%s-database", local.application_name, "sandbox"))
		68 |     }
		69 |   )
		70 | }

Check: CKV_AWS_353: "Ensure that RDS instances have performance insights enabled"
	FAILED for resource: aws_db_instance.jitbit_sandbox
	File: /sandbox_rds.tf:27-70
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-353

		27 | resource "aws_db_instance" "jitbit_sandbox" {
		28 |   count = local.is-development ? 1 : 0
		29 | 
		30 |   engine         = "sqlserver-se"
		31 |   license_model  = "license-included"
		32 |   engine_version = local.application_data.accounts["sandbox"].db_engine_version
		33 |   instance_class = local.application_data.accounts["sandbox"].db_instance_class
		34 |   identifier     = "${local.application_name}-sandbox-database"
		35 |   username       = local.application_data.accounts["sandbox"].db_user
		36 | 
		37 |   manage_master_user_password = true
		38 | 
		39 |   snapshot_identifier = try(local.application_data.accounts["sandbox"].db_snapshot_identifier, null)
		40 | 
		41 |   # tflint-ignore: aws_db_instance_default_parameter_group
		42 |   parameter_group_name        = "default.sqlserver-se-15.0"
		43 |   deletion_protection         = local.application_data.accounts["sandbox"].db_deletion_protection
		44 |   delete_automated_backups    = local.application_data.accounts["sandbox"].db_delete_automated_backups
		45 |   skip_final_snapshot         = local.application_data.accounts["sandbox"].db_skip_final_snapshot
		46 |   final_snapshot_identifier   = !local.skip_final_snapshot ? "${local.application_name}-sandbox-database-final-snapshot" : null
		47 |   allocated_storage           = local.application_data.accounts["sandbox"].db_allocated_storage
		48 |   max_allocated_storage       = local.application_data.accounts["sandbox"].db_max_allocated_storage
		49 |   storage_type                = local.application_data.accounts["sandbox"].db_storage_type
		50 |   maintenance_window          = local.application_data.accounts["sandbox"].db_maintenance_window
		51 |   auto_minor_version_upgrade  = local.application_data.accounts["sandbox"].db_auto_minor_version_upgrade
		52 |   allow_major_version_upgrade = local.application_data.accounts["sandbox"].db_allow_major_version_upgrade
		53 |   backup_window               = local.application_data.accounts["sandbox"].db_backup_window
		54 |   backup_retention_period     = local.application_data.accounts["sandbox"].db_retention_period
		55 |   #checkov:skip=CKV_AWS_133: "backup_retention enabled, can be edited it application_variables.json"
		56 |   iam_database_authentication_enabled = local.application_data.accounts["sandbox"].db_iam_database_authentication_enabled
		57 |   #checkov:skip=CKV_AWS_161: "iam auth enabled, but optional"
		58 |   db_subnet_group_name   = aws_db_subnet_group.jitbit.id
		59 |   vpc_security_group_ids = [aws_security_group.database_security_group_sandbox[0].id]
		60 |   multi_az               = local.application_data.accounts["sandbox"].db_multi_az
		61 |   #checkov:skip=CKV_AWS_157: "multi-az enabled, but optional"
		62 |   storage_encrypted = true
		63 | 
		64 |   tags = merge(
		65 |     local.tags,
		66 |     {
		67 |       Name = lower(format("%s-%s-database", local.application_name, "sandbox"))
		68 |     }
		69 |   )
		70 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: jitbit_bucket_sandbox
	File: /sandbox_s3.tf:1-86
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_26: "Ensure all data stored in the SNS topic is encrypted"
	FAILED for resource: aws_sns_topic.jitbit_ses_destination_topic
	File: /ses-logging.tf:17-21
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-15

		17 | resource "aws_sns_topic" "jitbit_ses_destination_topic" {
		18 |   name = format("%s-ses-destination-topic", local.application_name)
		19 | 
		20 |   tags = local.tags
		21 | }

Check: CKV_AWS_115: "Ensure that AWS Lambda function is configured for function-level concurrent execution limit"
	FAILED for resource: aws_lambda_function.sns_to_cloudwatch
	File: /ses-logging.tf:49-65
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-function-level-concurrent-execution-limit

		49 | resource "aws_lambda_function" "sns_to_cloudwatch" {
		50 |   filename         = "${path.module}/lambda/sns_to_cloudwatch.zip"
		51 |   function_name    = "sns_to_cloudwatch"
		52 |   architectures    = ["arm64"]
		53 |   role             = aws_iam_role.lambda.arn
		54 |   runtime          = "python3.12"
		55 |   handler          = "sns_to_cloudwatch.handler"
		56 |   source_code_hash = data.archive_file.lambda_function_payload.output_base64sha256
		57 | 
		58 |   environment {
		59 |     variables = {
		60 |       LOG_GROUP_NAME = aws_cloudwatch_log_group.sns_logs.name
		61 |     }
		62 |   }
		63 | 
		64 |   tags = local.tags
		65 | }

Check: CKV_AWS_272: "Ensure AWS Lambda function is configured to validate code-signing"
	FAILED for resource: aws_lambda_function.sns_to_cloudwatch
	File: /ses-logging.tf:49-65
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-272

		49 | resource "aws_lambda_function" "sns_to_cloudwatch" {
		50 |   filename         = "${path.module}/lambda/sns_to_cloudwatch.zip"
		51 |   function_name    = "sns_to_cloudwatch"
		52 |   architectures    = ["arm64"]
		53 |   role             = aws_iam_role.lambda.arn
		54 |   runtime          = "python3.12"
		55 |   handler          = "sns_to_cloudwatch.handler"
		56 |   source_code_hash = data.archive_file.lambda_function_payload.output_base64sha256
		57 | 
		58 |   environment {
		59 |     variables = {
		60 |       LOG_GROUP_NAME = aws_cloudwatch_log_group.sns_logs.name
		61 |     }
		62 |   }
		63 | 
		64 |   tags = local.tags
		65 | }

Check: CKV_AWS_173: "Check encryption settings for Lambda environmental variable"
	FAILED for resource: aws_lambda_function.sns_to_cloudwatch
	File: /ses-logging.tf:49-65
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-5

		49 | resource "aws_lambda_function" "sns_to_cloudwatch" {
		50 |   filename         = "${path.module}/lambda/sns_to_cloudwatch.zip"
		51 |   function_name    = "sns_to_cloudwatch"
		52 |   architectures    = ["arm64"]
		53 |   role             = aws_iam_role.lambda.arn
		54 |   runtime          = "python3.12"
		55 |   handler          = "sns_to_cloudwatch.handler"
		56 |   source_code_hash = data.archive_file.lambda_function_payload.output_base64sha256
		57 | 
		58 |   environment {
		59 |     variables = {
		60 |       LOG_GROUP_NAME = aws_cloudwatch_log_group.sns_logs.name
		61 |     }
		62 |   }
		63 | 
		64 |   tags = local.tags
		65 | }

Check: CKV_AWS_117: "Ensure that AWS Lambda function is configured inside a VPC"
	FAILED for resource: aws_lambda_function.sns_to_cloudwatch
	File: /ses-logging.tf:49-65
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-inside-a-vpc-1

		49 | resource "aws_lambda_function" "sns_to_cloudwatch" {
		50 |   filename         = "${path.module}/lambda/sns_to_cloudwatch.zip"
		51 |   function_name    = "sns_to_cloudwatch"
		52 |   architectures    = ["arm64"]
		53 |   role             = aws_iam_role.lambda.arn
		54 |   runtime          = "python3.12"
		55 |   handler          = "sns_to_cloudwatch.handler"
		56 |   source_code_hash = data.archive_file.lambda_function_payload.output_base64sha256
		57 | 
		58 |   environment {
		59 |     variables = {
		60 |       LOG_GROUP_NAME = aws_cloudwatch_log_group.sns_logs.name
		61 |     }
		62 |   }
		63 | 
		64 |   tags = local.tags
		65 | }

Check: CKV_AWS_116: "Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)"
	FAILED for resource: aws_lambda_function.sns_to_cloudwatch
	File: /ses-logging.tf:49-65
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-a-dead-letter-queue-dlq

		49 | resource "aws_lambda_function" "sns_to_cloudwatch" {
		50 |   filename         = "${path.module}/lambda/sns_to_cloudwatch.zip"
		51 |   function_name    = "sns_to_cloudwatch"
		52 |   architectures    = ["arm64"]
		53 |   role             = aws_iam_role.lambda.arn
		54 |   runtime          = "python3.12"
		55 |   handler          = "sns_to_cloudwatch.handler"
		56 |   source_code_hash = data.archive_file.lambda_function_payload.output_base64sha256
		57 | 
		58 |   environment {
		59 |     variables = {
		60 |       LOG_GROUP_NAME = aws_cloudwatch_log_group.sns_logs.name
		61 |     }
		62 |   }
		63 | 
		64 |   tags = local.tags
		65 | }

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: aws_lambda_function.sns_to_cloudwatch
	File: /ses-logging.tf:49-65
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		49 | resource "aws_lambda_function" "sns_to_cloudwatch" {
		50 |   filename         = "${path.module}/lambda/sns_to_cloudwatch.zip"
		51 |   function_name    = "sns_to_cloudwatch"
		52 |   architectures    = ["arm64"]
		53 |   role             = aws_iam_role.lambda.arn
		54 |   runtime          = "python3.12"
		55 |   handler          = "sns_to_cloudwatch.handler"
		56 |   source_code_hash = data.archive_file.lambda_function_payload.output_base64sha256
		57 | 
		58 |   environment {
		59 |     variables = {
		60 |       LOG_GROUP_NAME = aws_cloudwatch_log_group.sns_logs.name
		61 |     }
		62 |   }
		63 | 
		64 |   tags = local.tags
		65 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.sns_logs
	File: /ses-logging.tf:67-72
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		67 | resource "aws_cloudwatch_log_group" "sns_logs" {
		68 |   name              = format("%s-ses-logs", local.application_name)
		69 |   retention_in_days = local.application_data.accounts[local.environment].ses_log_retention_days
		70 | 
		71 |   tags = local.tags
		72 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.execution_logs
	File: /ses-logging.tf:74-79
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		74 | resource "aws_cloudwatch_log_group" "execution_logs" {
		75 |   name              = format("/aws/lambda/%s", aws_lambda_function.sns_to_cloudwatch.function_name)
		76 |   retention_in_days = 3
		77 | 
		78 |   tags = local.tags
		79 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.execution_logs
	File: /ses-logging.tf:74-79
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		74 | resource "aws_cloudwatch_log_group" "execution_logs" {
		75 |   name              = format("/aws/lambda/%s", aws_lambda_function.sns_to_cloudwatch.function_name)
		76 |   retention_in_days = 3
		77 | 
		78 |   tags = local.tags
		79 | }

Check: CKV_AWS_273: "Ensure access is controlled through SSO and not AWS IAM defined users"
	FAILED for resource: aws_iam_user.jitbit_ses_smtp_user
	File: /ses.tf:54-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-273

		54 | resource "aws_iam_user" "jitbit_ses_smtp_user" {
		55 |   name = "${local.environment}-jitbit-smtp-user"
		56 | }

Check: CKV_AWS_290: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_user_policy.jitbit_ses_smtp_user
	File: /ses.tf:62-79
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-290

		62 | resource "aws_iam_user_policy" "jitbit_ses_smtp_user" {
		63 |   name = "${local.environment}-jitbit-ses-smtp-user-policy"
		64 |   user = aws_iam_user.jitbit_ses_smtp_user.name
		65 | 
		66 |   policy = jsonencode({
		67 |     Version = "2012-10-17",
		68 |     Statement = [
		69 |       {
		70 |         Effect = "Allow",
		71 |         Action = [
		72 |           "ses:SendRawEmail",
		73 |           "ses:SendEmail"
		74 |         ],
		75 |         Resource = "*"
		76 |       }
		77 |     ]
		78 |   })
		79 | }

Check: CKV_AWS_355: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_user_policy.jitbit_ses_smtp_user
	File: /ses.tf:62-79
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-355

		62 | resource "aws_iam_user_policy" "jitbit_ses_smtp_user" {
		63 |   name = "${local.environment}-jitbit-ses-smtp-user-policy"
		64 |   user = aws_iam_user.jitbit_ses_smtp_user.name
		65 | 
		66 |   policy = jsonencode({
		67 |     Version = "2012-10-17",
		68 |     Statement = [
		69 |       {
		70 |         Effect = "Allow",
		71 |         Action = [
		72 |           "ses:SendRawEmail",
		73 |           "ses:SendEmail"
		74 |         ],
		75 |         Resource = "*"
		76 |       }
		77 |     ]
		78 |   })
		79 | }

Check: CKV_AWS_337: "Ensure SSM parameters are using KMS CMK"
	FAILED for resource: aws_ssm_parameter.jitbit_ses_smtp_user
	File: /ses.tf:81-91
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-337

		81 | resource "aws_ssm_parameter" "jitbit_ses_smtp_user" {
		82 |   name = "/${local.environment}/jitbit/ses_smtp"
		83 |   type = "SecureString"
		84 |   value = jsonencode({
		85 |     user              = aws_iam_user.jitbit_ses_smtp_user.name,
		86 |     key               = aws_iam_access_key.jitbit_ses_smtp_user.id,
		87 |     secret            = aws_iam_access_key.jitbit_ses_smtp_user.secret
		88 |     ses_smtp_user     = aws_iam_access_key.jitbit_ses_smtp_user.id
		89 |     ses_smtp_password = aws_iam_access_key.jitbit_ses_smtp_user.ses_smtp_password_v4
		90 |   })
		91 | }

Check: CKV_AWS_337: "Ensure SSM parameters are using KMS CMK"
	FAILED for resource: aws_ssm_parameter.app_url
	File: /ssm.tf:2-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-337

		2 | resource "aws_ssm_parameter" "app_url" {
		3 |   name  = "/${var.networking[0].application}/environment/app-url"
		4 |   type  = "String"
		5 |   value = "https://${local.app_url}/"
		6 | }

Check: CKV_AWS_192: "Ensure WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell"
	FAILED for resource: aws_wafv2_web_acl.this
	File: /waf.tf:1-53
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-waf-prevents-message-lookup-in-log4j2

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.waf
	File: /waf.tf:59-63
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		59 | resource "aws_cloudwatch_log_group" "waf" {
		60 |   name              = "aws-waf-logs-${local.application_name}"
		61 |   retention_in_days = 60
		62 |   tags              = local.tags
		63 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.waf
	File: /waf.tf:59-63
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		59 | resource "aws_cloudwatch_log_group" "waf" {
		60 |   name              = "aws-waf-logs-${local.application_name}"
		61 |   retention_in_days = 60
		62 |   tags              = local.tags
		63 | }

Check: CKV2_AWS_60: "Ensure RDS instance with copy tags to snapshots is enabled"
	FAILED for resource: aws_db_instance.jitbit
	File: /rds.tf:40-83
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-60

		40 | resource "aws_db_instance" "jitbit" {
		41 |   engine         = "sqlserver-se"
		42 |   license_model  = "license-included"
		43 |   engine_version = local.application_data.accounts[local.environment].db_engine_version
		44 |   instance_class = local.application_data.accounts[local.environment].db_instance_class
		45 |   identifier     = "${local.application_name}-${local.environment}-database"
		46 |   username       = local.application_data.accounts[local.environment].db_user
		47 | 
		48 |   manage_master_user_password = true
		49 | 
		50 |   snapshot_identifier = try(local.application_data.accounts[local.environment].db_snapshot_identifier, null)
		51 | 
		52 |   # tflint-ignore: aws_db_instance_default_parameter_group
		53 |   parameter_group_name        = "default.sqlserver-se-15.0"
		54 |   deletion_protection         = local.application_data.accounts[local.environment].db_deletion_protection
		55 |   delete_automated_backups    = local.application_data.accounts[local.environment].db_delete_automated_backups
		56 |   skip_final_snapshot         = local.skip_final_snapshot
		57 |   final_snapshot_identifier   = !local.skip_final_snapshot ? "${local.application_name}-${local.environment}-database-final-snapshot" : null
		58 |   allocated_storage           = local.application_data.accounts[local.environment].db_allocated_storage
		59 |   max_allocated_storage       = local.application_data.accounts[local.environment].db_max_allocated_storage
		60 |   storage_type                = local.application_data.accounts[local.environment].db_storage_type
		61 |   maintenance_window          = local.application_data.accounts[local.environment].db_maintenance_window
		62 |   auto_minor_version_upgrade  = local.application_data.accounts[local.environment].db_auto_minor_version_upgrade
		63 |   allow_major_version_upgrade = local.application_data.accounts[local.environment].db_allow_major_version_upgrade
		64 |   backup_window               = local.application_data.accounts[local.environment].db_backup_window
		65 |   backup_retention_period     = local.application_data.accounts[local.environment].db_retention_period
		66 |   #checkov:skip=CKV_AWS_133: "backup_retention enabled, can be edited it application_variables.json"
		67 |   iam_database_authentication_enabled = local.application_data.accounts[local.environment].db_iam_database_authentication_enabled
		68 |   #checkov:skip=CKV_AWS_161: "iam auth enabled, but optional"
		69 |   db_subnet_group_name   = aws_db_subnet_group.jitbit.id
		70 |   vpc_security_group_ids = [aws_security_group.database_security_group.id]
		71 |   multi_az               = local.application_data.accounts[local.environment].db_multi_az
		72 |   #checkov:skip=CKV_AWS_157: "multi-az enabled, but optional"
		73 |   monitoring_interval = local.application_data.accounts[local.environment].db_monitoring_interval
		74 |   monitoring_role_arn = local.application_data.accounts[local.environment].db_monitoring_interval == 0 ? "" : aws_iam_role.rds_enhanced_monitoring[0].arn
		75 |   #checkov:skip=CKV_AWS_118: "enhanced monitoring is enabled, but optional"
		76 |   storage_encrypted               = true
		77 |   performance_insights_enabled    = local.application_data.accounts[local.environment].db_performance_insights_enabled
		78 |   performance_insights_kms_key_id = "" #tfsec:ignore:aws-rds-enable-performance-insights-encryption Left empty so that it will run, however should be populated with real key in scenario.
		79 |   enabled_cloudwatch_logs_exports = local.application_data.accounts[local.environment].db_enabled_cloudwatch_logs_exports
		80 |   tags = merge(local.tags,
		81 |     { Name = lower(format("%s-%s-database", local.application_name, local.environment)) }
		82 |   )
		83 | }

Check: CKV2_AWS_60: "Ensure RDS instance with copy tags to snapshots is enabled"
	FAILED for resource: aws_db_instance.jitbit_sandbox
	File: /sandbox_rds.tf:27-70
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-60

		27 | resource "aws_db_instance" "jitbit_sandbox" {
		28 |   count = local.is-development ? 1 : 0
		29 | 
		30 |   engine         = "sqlserver-se"
		31 |   license_model  = "license-included"
		32 |   engine_version = local.application_data.accounts["sandbox"].db_engine_version
		33 |   instance_class = local.application_data.accounts["sandbox"].db_instance_class
		34 |   identifier     = "${local.application_name}-sandbox-database"
		35 |   username       = local.application_data.accounts["sandbox"].db_user
		36 | 
		37 |   manage_master_user_password = true
		38 | 
		39 |   snapshot_identifier = try(local.application_data.accounts["sandbox"].db_snapshot_identifier, null)
		40 | 
		41 |   # tflint-ignore: aws_db_instance_default_parameter_group
		42 |   parameter_group_name        = "default.sqlserver-se-15.0"
		43 |   deletion_protection         = local.application_data.accounts["sandbox"].db_deletion_protection
		44 |   delete_automated_backups    = local.application_data.accounts["sandbox"].db_delete_automated_backups
		45 |   skip_final_snapshot         = local.application_data.accounts["sandbox"].db_skip_final_snapshot
		46 |   final_snapshot_identifier   = !local.skip_final_snapshot ? "${local.application_name}-sandbox-database-final-snapshot" : null
		47 |   allocated_storage           = local.application_data.accounts["sandbox"].db_allocated_storage
		48 |   max_allocated_storage       = local.application_data.accounts["sandbox"].db_max_allocated_storage
		49 |   storage_type                = local.application_data.accounts["sandbox"].db_storage_type
		50 |   maintenance_window          = local.application_data.accounts["sandbox"].db_maintenance_window
		51 |   auto_minor_version_upgrade  = local.application_data.accounts["sandbox"].db_auto_minor_version_upgrade
		52 |   allow_major_version_upgrade = local.application_data.accounts["sandbox"].db_allow_major_version_upgrade
		53 |   backup_window               = local.application_data.accounts["sandbox"].db_backup_window
		54 |   backup_retention_period     = local.application_data.accounts["sandbox"].db_retention_period
		55 |   #checkov:skip=CKV_AWS_133: "backup_retention enabled, can be edited it application_variables.json"
		56 |   iam_database_authentication_enabled = local.application_data.accounts["sandbox"].db_iam_database_authentication_enabled
		57 |   #checkov:skip=CKV_AWS_161: "iam auth enabled, but optional"
		58 |   db_subnet_group_name   = aws_db_subnet_group.jitbit.id
		59 |   vpc_security_group_ids = [aws_security_group.database_security_group_sandbox[0].id]
		60 |   multi_az               = local.application_data.accounts["sandbox"].db_multi_az
		61 |   #checkov:skip=CKV_AWS_157: "multi-az enabled, but optional"
		62 |   storage_encrypted = true
		63 | 
		64 |   tags = merge(
		65 |     local.tags,
		66 |     {
		67 |       Name = lower(format("%s-%s-database", local.application_name, "sandbox"))
		68 |     }
		69 |   )
		70 | }

Check: CKV2_AWS_34: "AWS SSM Parameter should be Encrypted"
	FAILED for resource: aws_ssm_parameter.app_url
	File: /ssm.tf:2-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-ssm-parameter-is-encrypted

		2 | resource "aws_ssm_parameter" "app_url" {
		3 |   name  = "/${var.networking[0].application}/environment/app-url"
		4 |   type  = "String"
		5 |   value = "https://${local.app_url}/"
		6 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: aws_security_group.jitbit
	File: /ecs.tf:53-62
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		53 | resource "aws_security_group" "jitbit" {
		54 |   vpc_id      = data.aws_vpc.shared.id
		55 |   name        = format("hmpps-%s-%s-service", local.environment, local.application_name)
		56 |   description = "Security group for the ${local.application_name} service"
		57 |   tags        = local.tags
		58 | 
		59 |   lifecycle {
		60 |     create_before_destroy = true
		61 |   }
		62 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: aws_security_group.jitbit_sandbox
	File: /sandbox_ecs.tf:55-66
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		55 | resource "aws_security_group" "jitbit_sandbox" {
		56 |   count = local.is-development ? 1 : 0
		57 | 
		58 |   vpc_id      = data.aws_vpc.shared.id
		59 |   name        = format("hmpps-%s-%s-service", "sandbox", local.application_name)
		60 |   description = "Security group for the ${local.application_name} service"
		61 |   tags        = local.tags
		62 | 
		63 |   lifecycle {
		64 |     create_before_destroy = true
		65 |   }
		66 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.db_app_connection_string_sandbox
	File: /sandbox_secrets.tf:2-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		2  | resource "aws_secretsmanager_secret" "db_app_connection_string_sandbox" {
		3  |   count = local.is-development ? 1 : 0
		4  |   #checkov:skip=CKV_AWS_149
		5  |   name                    = "${var.networking[0].application}-app-connection-string-sandbox"
		6  |   recovery_window_in_days = 0
		7  |   tags = merge(
		8  |     local.tags,
		9  |     {
		10 |       Name = "${var.networking[0].application}-app-connection-string-sandbox"
		11 |     },
		12 |   )
		13 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.db_app_connection_string
	File: /secrets.tf:5-15
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		5  | resource "aws_secretsmanager_secret" "db_app_connection_string" {
		6  |   #checkov:skip=CKV_AWS_149
		7  |   name                    = "${var.networking[0].application}-app-connection-string"
		8  |   recovery_window_in_days = 0
		9  |   tags = merge(
		10 |     local.tags,
		11 |     {
		12 |       Name = "${var.networking[0].application}-app-connection-string"
		13 |     },
		14 |   )
		15 | }


checkov_exitcode=1

CTFLint Scan Failed

Show Output 
*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.5.0)
tflint will check the following folders:
terraform/environments/delius-jitbit

*****************************

Running tflint in terraform/environments/delius-jitbit
Excluding the following checks: terraform_unused_declarations
1 issue(s) found:

Warning: Missing version constraint for provider "archive" in `required_providers` (terraform_required_providers)

  on terraform/environments/delius-jitbit/ses-logging.tf line 42:
  42: data "archive_file" "lambda_function_payload" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_required_providers.md

tflint_exitcode=2

Trivy Scan Failed

Show Output 
*****************************

Trivy will check the following folders:
terraform/environments/delius-jitbit

*****************************

Running Trivy in terraform/environments/delius-jitbit
2024-05-08T01:06:15Z	INFO	Need to update DB
2024-05-08T01:06:15Z	INFO	Downloading DB...	repository="ghcr.io/aquasecurity/trivy-db:2"
2024-05-08T01:06:17Z	INFO	Vulnerability scanning is enabled
2024-05-08T01:06:17Z	INFO	Misconfiguration scanning is enabled
2024-05-08T01:06:17Z	INFO	Need to update the built-in policies
2024-05-08T01:06:17Z	INFO	Downloading the built-in policies...
50.41 KiB / 50.41 KiB [-----------------------------------------------------------] 100.00% ? p/s 0s2024-05-08T01:06:17Z	INFO	Secret scanning is enabled
2024-05-08T01:06:17Z	INFO	If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-05-08T01:06:17Z	INFO	Please see also https://aquasecurity.github.io/trivy/v0.51/docs/scanner/secret/#recommendation for faster secret detection
2024-05-08T01:06:22Z	INFO	Number of language-specific files	num=0
2024-05-08T01:06:22Z	INFO	Detected config files	num=15

ecs.tf (terraform)
==================
Tests: 2 (SUCCESSES: 1, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 0, CRITICAL: 1)

CRITICAL: Security group rule allows egress to multiple public internet addresses.
════════════════════════════════════════
Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.

See https://avd.aquasec.com/misconfig/avd-aws-0104
────────────────────────────────────────
 ecs.tf:70
   via ecs.tf:64-72 (aws_security_group_rule.allow_all_egress)
────────────────────────────────────────
  64   resource "aws_security_group_rule" "allow_all_egress" {
  65     description       = "Allow all outbound traffic to any IPv4 address"
  66     type              = "egress"
  67     from_port         = 0
  68     to_port           = 0
  69     protocol          = "-1"
  70 [   cidr_blocks       = ["0.0.0.0/0"]
  71     security_group_id = aws_security_group.jitbit.id
  72   }
────────────────────────────────────────



github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.2.1/main.tf (terraform)
==========================================================================================================
Tests: 7 (SUCCESSES: 5, FAILURES: 0, EXCEPTIONS: 2)
Failures: 0 (HIGH: 0, CRITICAL: 0)


github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0/main.tf (terraform)
======================================================================================================
Tests: 14 (SUCCESSES: 12, FAILURES: 2, EXCEPTIONS: 0)
Failures: 2 (HIGH: 2, CRITICAL: 0)

HIGH: Bucket does not encrypt data with a customer managed key.
════════════════════════════════════════
Encryption using AWS keys provides protection for your S3 buckets. To increase control of the encryption and manage factors like rotation use customer managed keys.

See https://avd.aquasec.com/misconfig/avd-aws-0132
────────────────────────────────────────
 github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0/main.tf:157-165
   via s3.tf:1-84 (module.jitbit_bucket)
────────────────────────────────────────
 157 ┌ resource "aws_s3_bucket_server_side_encryption_configuration" "default" {
 158 │   bucket = aws_s3_bucket.default.id
 159 │   rule {
 160 │     apply_server_side_encryption_by_default {
 161 │       sse_algorithm     = var.sse_algorithm
 162 │       kms_master_key_id = (var.custom_kms_key != "") ? var.custom_kms_key : ""
 163 │     }
 164 │   }
 165 └ }
────────────────────────────────────────


HIGH: Bucket does not encrypt data with a customer managed key.
════════════════════════════════════════
Encryption using AWS keys provides protection for your S3 buckets. To increase control of the encryption and manage factors like rotation use customer managed keys.

See https://avd.aquasec.com/misconfig/avd-aws-0132
────────────────────────────────────────
 github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0/main.tf:157-165
   via ecs.tf:11-51 (module.s3_bucket_app_deployment)
────────────────────────────────────────
 157 ┌ resource "aws_s3_bucket_server_side_encryption_configuration" "default" {
 158 │   bucket = aws_s3_bucket.default.id
 159 │   rule {
 160 │     apply_server_side_encryption_by_default {
 161 │       sse_algorithm     = var.sse_algorithm
 162 │       kms_master_key_id = (var.custom_kms_key != "") ? var.custom_kms_key : ""
 163 │     }
 164 │   }
 165 └ }
────────────────────────────────────────



iam.tf (terraform)
==================
Tests: 6 (SUCCESSES: 0, FAILURES: 0, EXCEPTIONS: 6)
Failures: 0 (HIGH: 0, CRITICAL: 0)


lb.tf (terraform)
=================
Tests: 7 (SUCCESSES: 4, FAILURES: 2, EXCEPTIONS: 1)
Failures: 2 (HIGH: 0, CRITICAL: 2)

CRITICAL: Security group rule allows ingress from public internet.
════════════════════════════════════════
Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.

See https://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
 lb.tf:62-70
   via lb.tf:35-71 (ingress)
    via lb.tf:30-87 (aws_security_group.load_balancer_security_group)
────────────────────────────────────────
  30   resource "aws_security_group" "load_balancer_security_group" {
  ..   
  62 ┌     ipv6_cidr_blocks = [
  63 │       # Route53 Healthcheck Access Cidrs IPv6
  64 │       "2406:da18:7ff:f800::/53",  # ap-southeast-1 Region
  65 │       "2406:da18:fff:f800::/53",  # ap-southeast-1 Region
  66 │       "2a05:d018:fff:f800::/53",  # eu-west-1 Region
  67 │       "2a05:d018:7ff:f800::/53",  # eu-west-1 Region
  68 └       "2600:1f18:7fff:f800::/53", # us-east-1 Region
  ..   
────────────────────────────────────────


CRITICAL: Security group rule allows ingress from public internet.
════════════════════════════════════════
Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.

See https://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
 lb.tf:40-60
   via lb.tf:35-71 (ingress)
    via lb.tf:30-87 (aws_security_group.load_balancer_security_group)
────────────────────────────────────────
  30   resource "aws_security_group" "load_balancer_security_group" {
  ..   
  40 ┌     cidr_blocks = distinct(flatten([
  41 │       "20.49.214.199/32", # Azure Landing Zone Egress
  42 │       "20.49.214.228/32", # Azure Landing Zone Egress
  43 │       "20.26.11.71/32",   # Azure Landing Zone Egress
  44 │       "20.26.11.108/32",  # Azure Landing Zone Egress
  45 │       # Route53 Healthcheck Access Cidrs
  46 └       # London Region not support yet, so metrics are not yet publised, can be enabled at later stage for Route53 endpoint monitor
  ..   
────────────────────────────────────────



monitoring.tf (terraform)
=========================
Tests: 2 (SUCCESSES: 1, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Topic does not have encryption enabled.
════════════════════════════════════════
Topics should be encrypted to protect their contents.

See https://avd.aquasec.com/misconfig/avd-aws-0095
────────────────────────────────────────
 monitoring.tf:6-8
────────────────────────────────────────
   6 ┌ resource "aws_sns_topic" "jitbit_alerting" {
   7 │   name = "jitbit_alerting"
   8 └ }
────────────────────────────────────────



ses-logging.tf (terraform)
==========================
Tests: 5 (SUCCESSES: 2, FAILURES: 1, EXCEPTIONS: 2)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Topic does not have encryption enabled.
════════════════════════════════════════
Topics should be encrypted to protect their contents.

See https://avd.aquasec.com/misconfig/avd-aws-0095
────────────────────────────────────────
 ses-logging.tf:17-21
────────────────────────────────────────
  17 ┌ resource "aws_sns_topic" "jitbit_ses_destination_topic" {
  18 │   name = format("%s-ses-destination-topic", local.application_name)
  19 │ 
  20 │   tags = local.tags
  21 └ }
────────────────────────────────────────



ses.tf (terraform)
==================
Tests: 2 (SUCCESSES: 0, FAILURES: 0, EXCEPTIONS: 2)
Failures: 0 (HIGH: 0, CRITICAL: 0)

trivy_exitcode=1

@dependabot Dependabot
Copy link
Contributor Author

dependabot bot commented on behalf of github May 15, 2024

Superseded by #6085.

@dependabot dependabot bot closed this May 15, 2024
@dependabot dependabot bot deleted the dependabot/terraform/terraform/environments/delius-jitbit/ecs--github--ministryofjustice/modernisation-platform-terraform-ecs-cluster--v2.0.1-4.2.1 branch May 15, 2024 00:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file environments-repository Used to exclude PRs from this repo in our Slack PR update terraform Pull requests that update Terraform code
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants