tmp remove lamdba #6039

georgepstaylor · 2024-05-10T15:03:53Z

No description provided.

github-actions · 2024-05-10T15:06:15Z

`Trivy Scan` Failed

Show Output

```hcl

Trivy will check the following folders:
terraform/environments/delius-jitbit

Running Trivy in terraform/environments/delius-jitbit
2024-05-10T15:06:04Z INFO Need to update DB
2024-05-10T15:06:04Z INFO Downloading DB... repository="ghcr.io/aquasecurity/trivy-db:2"
2024-05-10T15:06:06Z INFO Vulnerability scanning is enabled
2024-05-10T15:06:06Z INFO Misconfiguration scanning is enabled
2024-05-10T15:06:06Z INFO Need to update the built-in policies
2024-05-10T15:06:06Z INFO Downloading the built-in policies...
50.41 KiB / 50.41 KiB [-----------------------------------------------------------] 100.00% ? p/s 0s2024-05-10T15:06:06Z INFO Secret scanning is enabled
2024-05-10T15:06:06Z INFO If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-05-10T15:06:06Z INFO Please see also https://aquasecurity.github.io/trivy/v0.51/docs/scanner/secret/#recommendation for faster secret detection
2024-05-10T15:06:10Z INFO Number of language-specific files num=0
2024-05-10T15:06:10Z INFO Detected config files num=16

ecs.tf (terraform)

Tests: 2 (SUCCESSES: 1, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 0, CRITICAL: 1)

CRITICAL: Security group rule allows egress to multiple public internet addresses.
════════════════════════════════════════
Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.

See https://avd.aquasec.com/misconfig/avd-aws-0104
────────────────────────────────────────
ecs.tf:70
via ecs.tf:64-72 (aws_security_group_rule.allow_all_egress)
────────────────────────────────────────
64 resource "aws_security_group_rule" "allow_all_egress" {
65 description = "Allow all outbound traffic to any IPv4 address"
66 type = "egress"
67 from_port = 0
68 to_port = 0
69 protocol = "-1"
70 [ cidr_blocks = ["0.0.0.0/0"]
71 security_group_id = aws_security_group.jitbit.id
72 }
────────────────────────────────────────

github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.2.1/main.tf (terraform)

Tests: 7 (SUCCESSES: 5, FAILURES: 0, EXCEPTIONS: 2)
Failures: 0 (HIGH: 0, CRITICAL: 0)

github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0/main.tf (terraform)

Tests: 14 (SUCCESSES: 12, FAILURES: 2, EXCEPTIONS: 0)
Failures: 2 (HIGH: 2, CRITICAL: 0)

HIGH: Bucket does not encrypt data with a customer managed key.
════════════════════════════════════════
Encryption using AWS keys provides protection for your S3 buckets. To increase control of the encryption and manage factors like rotation use customer managed keys.

See https://avd.aquasec.com/misconfig/avd-aws-0132
────────────────────────────────────────
github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0/main.tf:157-165
via s3.tf:1-84 (module.jitbit_bucket)
────────────────────────────────────────
157 ┌ resource "aws_s3_bucket_server_side_encryption_configuration" "default" {
158 │ bucket = aws_s3_bucket.default.id
159 │ rule {
160 │ apply_server_side_encryption_by_default {
161 │ sse_algorithm = var.sse_algorithm
162 │ kms_master_key_id = (var.custom_kms_key != "") ? var.custom_kms_key : ""
163 │ }
164 │ }
165 └ }
────────────────────────────────────────

HIGH: Bucket does not encrypt data with a customer managed key.
════════════════════════════════════════
Encryption using AWS keys provides protection for your S3 buckets. To increase control of the encryption and manage factors like rotation use customer managed keys.

See https://avd.aquasec.com/misconfig/avd-aws-0132
────────────────────────────────────────
github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0/main.tf:157-165
via ecs.tf:11-51 (module.s3_bucket_app_deployment)
────────────────────────────────────────
157 ┌ resource "aws_s3_bucket_server_side_encryption_configuration" "default" {
158 │ bucket = aws_s3_bucket.default.id
159 │ rule {
160 │ apply_server_side_encryption_by_default {
161 │ sse_algorithm = var.sse_algorithm
162 │ kms_master_key_id = (var.custom_kms_key != "") ? var.custom_kms_key : ""
163 │ }
164 │ }
165 └ }
────────────────────────────────────────

iam.tf (terraform)

Tests: 6 (SUCCESSES: 0, FAILURES: 0, EXCEPTIONS: 6)
Failures: 0 (HIGH: 0, CRITICAL: 0)

lb.tf (terraform)

Tests: 7 (SUCCESSES: 4, FAILURES: 2, EXCEPTIONS: 1)
Failures: 2 (HIGH: 0, CRITICAL: 2)

CRITICAL: Security group rule allows ingress from public internet.
════════════════════════════════════════
Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.

See https://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
lb.tf:62-70
via lb.tf:35-71 (ingress)
via lb.tf:30-87 (aws_security_group.load_balancer_security_group)
────────────────────────────────────────
30 resource "aws_security_group" "load_balancer_security_group" {
..
62 ┌ ipv6_cidr_blocks = [
63 │ # Route53 Healthcheck Access Cidrs IPv6
64 │ "2406:da18:7ff:f800::/53", # ap-southeast-1 Region
65 │ "2406:da18:fff:f800::/53", # ap-southeast-1 Region
66 │ "2a05:d018:fff:f800::/53", # eu-west-1 Region
67 │ "2a05:d018:7ff:f800::/53", # eu-west-1 Region
68 └ "2600:1f18:7fff:f800::/53", # us-east-1 Region
..
────────────────────────────────────────

CRITICAL: Security group rule allows ingress from public internet.
════════════════════════════════════════
Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.

See https://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
lb.tf:40-60
via lb.tf:35-71 (ingress)
via lb.tf:30-87 (aws_security_group.load_balancer_security_group)
────────────────────────────────────────
30 resource "aws_security_group" "load_balancer_security_group" {
..
40 ┌ cidr_blocks = distinct(flatten([
41 │ "20.49.214.199/32", # Azure Landing Zone Egress
42 │ "20.49.214.228/32", # Azure Landing Zone Egress
43 │ "20.26.11.71/32", # Azure Landing Zone Egress
44 │ "20.26.11.108/32", # Azure Landing Zone Egress
45 │ # Route53 Healthcheck Access Cidrs
46 └ # London Region not support yet, so metrics are not yet publised, can be enabled at later stage for Route53 endpoint monitor
..
────────────────────────────────────────

monitoring.tf (terraform)

Tests: 2 (SUCCESSES: 1, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Topic does not have encryption enabled.
════════════════════════════════════════
Topics should be encrypted to protect their contents.

See https://avd.aquasec.com/misconfig/avd-aws-0095
────────────────────────────────────────
monitoring.tf:6-8
────────────────────────────────────────
6 ┌ resource "aws_sns_topic" "jitbit_alerting" {
7 │ name = "jitbit_alerting"
8 └ }
────────────────────────────────────────

ses-logging.tf (terraform)

Tests: 4 (SUCCESSES: 1, FAILURES: 1, EXCEPTIONS: 2)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Topic does not have encryption enabled.
════════════════════════════════════════
Topics should be encrypted to protect their contents.

See https://avd.aquasec.com/misconfig/avd-aws-0095
────────────────────────────────────────
ses-logging.tf:17-21
────────────────────────────────────────
17 ┌ resource "aws_sns_topic" "jitbit_ses_destination_topic" {
18 │ name = format("%s-ses-destination-topic", local.application_name)
19 │
20 │ tags = local.tags
21 └ }
────────────────────────────────────────

ses.tf (terraform)

Tests: 2 (SUCCESSES: 0, FAILURES: 0, EXCEPTIONS: 2)
Failures: 0 (HIGH: 0, CRITICAL: 0)

ses_bounce.tf (terraform)

Tests: 6 (SUCCESSES: 2, FAILURES: 1, EXCEPTIONS: 3)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Topic does not have encryption enabled.
════════════════════════════════════════
Topics should be encrypted to protect their contents.

See https://avd.aquasec.com/misconfig/avd-aws-0095
────────────────────────────────────────
ses_bounce.tf:1-5
────────────────────────────────────────
1 ┌ resource "aws_sns_topic" "jitbit_ses_destination_topic_bounce_email_notification" {
2 │ name = format("%s-ses-destination-topic-bounce-email-notification", local.application_name)
3 │
4 │ tags = local.tags
5 └ }
────────────────────────────────────────

ses_logging.tf (terraform)

Tests: 5 (SUCCESSES: 2, FAILURES: 1, EXCEPTIONS: 2)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Topic does not have encryption enabled.
════════════════════════════════════════
Topics should be encrypted to protect their contents.

See https://avd.aquasec.com/misconfig/avd-aws-0095
────────────────────────────────────────
ses_logging.tf:4-8
────────────────────────────────────────
4 ┌ resource "aws_sns_topic" "jitbit_ses_destination_topic" {
5 │ name = format("%s-ses-destination-topic", local.application_name)
6 │
7 │ tags = local.tags
8 └ }
────────────────────────────────────────

trivy_exitcode=1

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/delius-jitbit

*****************************

Running Checkov in terraform/environments/delius-jitbit
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2024-05-10 15:06:12,517 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0:None (for external modules, the --download-external-modules flag is required)
2024-05-10 15:06:12,518 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.1.0:None (for external modules, the --download-external-modules flag is required)
2024-05-10 15:06:12,518 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-ecs-cluster//cluster?ref=v2.0.1:None (for external modules, the --download-external-modules flag is required)
2024-05-10 15:06:12,518 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-pagerduty-integration?ref=v2.0.0:None (for external modules, the --download-external-modules flag is required)
2024-05-10 15:06:12,518 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.2.1:None (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 311, Failed checks: 64, Skipped checks: 20

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: bastion_linux
	File: /bastion_linux.tf:6-41
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		6  | module "bastion_linux" {
		7  |   source = "github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.2.1"
		8  | 
		9  |   providers = {
		10 |     aws.share-host   = aws.core-vpc # core-vpc-(environment) holds the networking for all accounts
		11 |     aws.share-tenant = aws          # The default provider (unaliased, `aws`) is the tenant
		12 |   }
		13 | 
		14 |   # s3 - used for logs and user ssh public keys
		15 |   bucket_name = "bastion"
		16 |   # public keys
		17 |   public_key_data = local.public_key_data.keys[local.environment]
		18 |   # logs
		19 |   log_auto_clean       = "Enabled"
		20 |   log_standard_ia_days = 30  # days before moving to IA storage
		21 |   log_glacier_days     = 60  # days before moving to Glacier
		22 |   log_expiry_days      = 180 # days before log expiration
		23 |   # bastion
		24 |   allow_ssh_commands = false
		25 | 
		26 |   app_name      = var.networking[0].application
		27 |   business_unit = local.vpc_name
		28 |   subnet_set    = local.subnet_set
		29 |   environment   = local.environment
		30 |   region        = "eu-west-2"
		31 | 
		32 |   # custom scaling schedule
		33 |   autoscaling_cron = {
		34 |     "down" : "0 21 * * *",
		35 |     "up" : "0 05 * * *"
		36 |   }
		37 | 
		38 |   # Tags
		39 |   tags_common = local.tags
		40 |   tags_prefix = terraform.workspace
		41 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.jitbit
	File: /ecs.tf:84-87
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		84 | resource "aws_cloudwatch_log_group" "jitbit" {
		85 |   name              = format("%s-ecs", local.application_name)
		86 |   retention_in_days = 30
		87 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.jitbit
	File: /ecs.tf:84-87
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		84 | resource "aws_cloudwatch_log_group" "jitbit" {
		85 |   name              = format("%s-ecs", local.application_name)
		86 |   retention_in_days = 30
		87 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: ecs
	File: /ecs.tf:1-8
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		1 | module "ecs" {
		2 |   source = "github.com/ministryofjustice/modernisation-platform-terraform-ecs-cluster//cluster?ref=v2.0.1"
		3 | 
		4 |   environment = local.environment
		5 |   name        = local.application_name
		6 | 
		7 |   tags = local.tags
		8 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: s3_bucket_app_deployment
	File: /ecs.tf:11-51
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		11 | module "s3_bucket_app_deployment" {
		12 | 
		13 |   source = "github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0"
		14 | 
		15 |   providers = {
		16 |     aws.bucket-replication = aws
		17 |   }
		18 |   bucket_name        = "${local.application_name}-${local.environment}-deployment"
		19 |   versioning_enabled = true
		20 | 
		21 |   ownership_controls = "BucketOwnerEnforced"
		22 | 
		23 |   lifecycle_rule = [
		24 |     {
		25 |       id      = "main"
		26 |       enabled = "Enabled"
		27 |       prefix  = ""
		28 | 
		29 |       tags = {
		30 |         rule      = "log"
		31 |         autoclean = "true"
		32 |       }
		33 | 
		34 |       noncurrent_version_transition = [
		35 |         {
		36 |           days          = 90
		37 |           storage_class = "STANDARD_IA"
		38 |           }, {
		39 |           days          = 365
		40 |           storage_class = "GLACIER"
		41 |         }
		42 |       ]
		43 | 
		44 |       noncurrent_version_expiration = {
		45 |         days = 730
		46 |       }
		47 |     }
		48 |   ]
		49 | 
		50 |   tags = local.tags
		51 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.ecs_service_policy
	File: /iam.tf:37-52
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		37 | data "aws_iam_policy_document" "ecs_service_policy" {
		38 |   statement {
		39 |     effect    = "Allow"
		40 |     resources = ["*"]
		41 | 
		42 |     actions = [
		43 |       "elasticloadbalancing:Describe*",
		44 |       "elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
		45 |       "elasticloadbalancing:RegisterInstancesWithLoadBalancer",
		46 |       "ec2:Describe*",
		47 |       "ec2:AuthorizeSecurityGroupIngress",
		48 |       "elasticloadbalancing:RegisterTargets",
		49 |       "elasticloadbalancing:DeregisterTargets"
		50 |     ]
		51 |   }
		52 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.ecs_service_policy
	File: /iam.tf:37-52
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		37 | data "aws_iam_policy_document" "ecs_service_policy" {
		38 |   statement {
		39 |     effect    = "Allow"
		40 |     resources = ["*"]
		41 | 
		42 |     actions = [
		43 |       "elasticloadbalancing:Describe*",
		44 |       "elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
		45 |       "elasticloadbalancing:RegisterInstancesWithLoadBalancer",
		46 |       "ec2:Describe*",
		47 |       "ec2:AuthorizeSecurityGroupIngress",
		48 |       "elasticloadbalancing:RegisterTargets",
		49 |       "elasticloadbalancing:DeregisterTargets"
		50 |     ]
		51 |   }
		52 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.ecs_exec
	File: /iam.tf:98-114
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		98  | data "aws_iam_policy_document" "ecs_exec" {
		99  |   statement {
		100 |     effect    = "Allow"
		101 |     resources = ["*"]
		102 | 
		103 |     actions = [
		104 |       "ssm:GetParameters",
		105 |       "ecr:GetAuthorizationToken",
		106 |       "ecr:BatchCheckLayerAvailability",
		107 |       "ecr:GetDownloadUrlForLayer",
		108 |       "ecr:BatchGetImage",
		109 |       "logs:CreateLogGroup",
		110 |       "logs:CreateLogStream",
		111 |       "logs:PutLogEvents"
		112 |     ]
		113 |   }
		114 | }

Check: CKV_AWS_108: "Ensure IAM policies does not allow data exfiltration"
	FAILED for resource: aws_iam_policy_document.ecs_exec
	File: /iam.tf:98-114
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-data-exfiltration

		98  | data "aws_iam_policy_document" "ecs_exec" {
		99  |   statement {
		100 |     effect    = "Allow"
		101 |     resources = ["*"]
		102 | 
		103 |     actions = [
		104 |       "ssm:GetParameters",
		105 |       "ecr:GetAuthorizationToken",
		106 |       "ecr:BatchCheckLayerAvailability",
		107 |       "ecr:GetDownloadUrlForLayer",
		108 |       "ecr:BatchGetImage",
		109 |       "logs:CreateLogGroup",
		110 |       "logs:CreateLogStream",
		111 |       "logs:PutLogEvents"
		112 |     ]
		113 |   }
		114 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.ecs_exec
	File: /iam.tf:98-114
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		98  | data "aws_iam_policy_document" "ecs_exec" {
		99  |   statement {
		100 |     effect    = "Allow"
		101 |     resources = ["*"]
		102 | 
		103 |     actions = [
		104 |       "ssm:GetParameters",
		105 |       "ecr:GetAuthorizationToken",
		106 |       "ecr:BatchCheckLayerAvailability",
		107 |       "ecr:GetDownloadUrlForLayer",
		108 |       "ecr:BatchGetImage",
		109 |       "logs:CreateLogGroup",
		110 |       "logs:CreateLogStream",
		111 |       "logs:PutLogEvents"
		112 |     ]
		113 |   }
		114 | }

Check: CKV_AWS_26: "Ensure all data stored in the SNS topic is encrypted"
	FAILED for resource: aws_sns_topic.jitbit_alerting
	File: /monitoring.tf:6-8
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-15

		6 | resource "aws_sns_topic" "jitbit_alerting" {
		7 |   name = "jitbit_alerting"
		8 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: pagerduty_core_alerts
	File: /monitoring.tf:37-44
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		37 | module "pagerduty_core_alerts" {
		38 |   depends_on = [
		39 |     aws_sns_topic.jitbit_alerting
		40 |   ]
		41 |   source                    = "github.com/ministryofjustice/modernisation-platform-terraform-pagerduty-integration?ref=v2.0.0"
		42 |   sns_topics                = [aws_sns_topic.jitbit_alerting.name]
		43 |   pagerduty_integration_key = local.pagerduty_integration_key
		44 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.app_logs
	File: /monitoring_app.tf:1-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		1 | resource "aws_cloudwatch_log_group" "app_logs" {
		2 |   name              = "delius-jitbit-ecs"
		3 |   retention_in_days = 30
		4 | 
		5 |   tags = local.tags
		6 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.app_logs
	File: /monitoring_app.tf:1-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		1 | resource "aws_cloudwatch_log_group" "app_logs" {
		2 |   name              = "delius-jitbit-ecs"
		3 |   retention_in_days = 30
		4 | 
		5 |   tags = local.tags
		6 | }

Check: CKV_AWS_354: "Ensure RDS Performance Insights are encrypted using KMS CMKs"
	FAILED for resource: aws_db_instance.jitbit
	File: /rds.tf:40-83
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-354

		40 | resource "aws_db_instance" "jitbit" {
		41 |   engine         = "sqlserver-se"
		42 |   license_model  = "license-included"
		43 |   engine_version = local.application_data.accounts[local.environment].db_engine_version
		44 |   instance_class = local.application_data.accounts[local.environment].db_instance_class
		45 |   identifier     = "${local.application_name}-${local.environment}-database"
		46 |   username       = local.application_data.accounts[local.environment].db_user
		47 | 
		48 |   manage_master_user_password = true
		49 | 
		50 |   snapshot_identifier = try(local.application_data.accounts[local.environment].db_snapshot_identifier, null)
		51 | 
		52 |   # tflint-ignore: aws_db_instance_default_parameter_group
		53 |   parameter_group_name        = "default.sqlserver-se-15.0"
		54 |   deletion_protection         = local.application_data.accounts[local.environment].db_deletion_protection
		55 |   delete_automated_backups    = local.application_data.accounts[local.environment].db_delete_automated_backups
		56 |   skip_final_snapshot         = local.skip_final_snapshot
		57 |   final_snapshot_identifier   = !local.skip_final_snapshot ? "${local.application_name}-${local.environment}-database-final-snapshot" : null
		58 |   allocated_storage           = local.application_data.accounts[local.environment].db_allocated_storage
		59 |   max_allocated_storage       = local.application_data.accounts[local.environment].db_max_allocated_storage
		60 |   storage_type                = local.application_data.accounts[local.environment].db_storage_type
		61 |   maintenance_window          = local.application_data.accounts[local.environment].db_maintenance_window
		62 |   auto_minor_version_upgrade  = local.application_data.accounts[local.environment].db_auto_minor_version_upgrade
		63 |   allow_major_version_upgrade = local.application_data.accounts[local.environment].db_allow_major_version_upgrade
		64 |   backup_window               = local.application_data.accounts[local.environment].db_backup_window
		65 |   backup_retention_period     = local.application_data.accounts[local.environment].db_retention_period
		66 |   #checkov:skip=CKV_AWS_133: "backup_retention enabled, can be edited it application_variables.json"
		67 |   iam_database_authentication_enabled = local.application_data.accounts[local.environment].db_iam_database_authentication_enabled
		68 |   #checkov:skip=CKV_AWS_161: "iam auth enabled, but optional"
		69 |   db_subnet_group_name   = aws_db_subnet_group.jitbit.id
		70 |   vpc_security_group_ids = [aws_security_group.database_security_group.id]
		71 |   multi_az               = local.application_data.accounts[local.environment].db_multi_az
		72 |   #checkov:skip=CKV_AWS_157: "multi-az enabled, but optional"
		73 |   monitoring_interval = local.application_data.accounts[local.environment].db_monitoring_interval
		74 |   monitoring_role_arn = local.application_data.accounts[local.environment].db_monitoring_interval == 0 ? "" : aws_iam_role.rds_enhanced_monitoring[0].arn
		75 |   #checkov:skip=CKV_AWS_118: "enhanced monitoring is enabled, but optional"
		76 |   storage_encrypted               = true
		77 |   performance_insights_enabled    = local.application_data.accounts[local.environment].db_performance_insights_enabled
		78 |   performance_insights_kms_key_id = "" #tfsec:ignore:aws-rds-enable-performance-insights-encryption Left empty so that it will run, however should be populated with real key in scenario.
		79 |   enabled_cloudwatch_logs_exports = local.application_data.accounts[local.environment].db_enabled_cloudwatch_logs_exports
		80 |   tags = merge(local.tags,
		81 |     { Name = lower(format("%s-%s-database", local.application_name, local.environment)) }
		82 |   )
		83 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: jitbit_bucket
	File: /s3.tf:1-84
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.jitbit_sandbox
	File: /sandbox_ecs.tf:92-97
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		92 | resource "aws_cloudwatch_log_group" "jitbit_sandbox" {
		93 |   count = local.is-development ? 1 : 0
		94 | 
		95 |   name              = format("%s-%s-ecs", local.application_name, "sandbox")
		96 |   retention_in_days = 30
		97 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.jitbit_sandbox
	File: /sandbox_ecs.tf:92-97
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		92 | resource "aws_cloudwatch_log_group" "jitbit_sandbox" {
		93 |   count = local.is-development ? 1 : 0
		94 | 
		95 |   name              = format("%s-%s-ecs", local.application_name, "sandbox")
		96 |   retention_in_days = 30
		97 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: ecs_sandbox
	File: /sandbox_ecs.tf:1-10
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		1  | module "ecs_sandbox" {
		2  |   count = local.is-development ? 1 : 0
		3  | 
		4  |   source = "github.com/ministryofjustice/modernisation-platform-terraform-ecs-cluster//cluster?ref=v2.0.1"
		5  | 
		6  |   environment = local.environment
		7  |   name        = "${local.application_name}-sandbox"
		8  | 
		9  |   tags = local.tags
		10 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: s3_bucket_app_deployment_sandbox
	File: /sandbox_ecs.tf:12-53
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		12 | module "s3_bucket_app_deployment_sandbox" {
		13 |   count = local.is-development ? 1 : 0
		14 | 
		15 |   source = "github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0"
		16 | 
		17 |   providers = {
		18 |     aws.bucket-replication = aws
		19 |   }
		20 |   bucket_name        = "${local.application_name}-sandbox-deployment"
		21 |   versioning_enabled = true
		22 | 
		23 |   ownership_controls = "BucketOwnerEnforced"
		24 | 
		25 |   lifecycle_rule = [
		26 |     {
		27 |       id      = "main"
		28 |       enabled = "Enabled"
		29 |       prefix  = ""
		30 | 
		31 |       tags = {
		32 |         rule      = "log"
		33 |         autoclean = "true"
		34 |       }
		35 | 
		36 |       noncurrent_version_transition = [
		37 |         {
		38 |           days          = 90
		39 |           storage_class = "STANDARD_IA"
		40 |           }, {
		41 |           days          = 365
		42 |           storage_class = "GLACIER"
		43 |         }
		44 |       ]
		45 | 
		46 |       noncurrent_version_expiration = {
		47 |         days = 730
		48 |       }
		49 |     }
		50 |   ]
		51 | 
		52 |   tags = local.tags
		53 | }

Check: CKV_AWS_150: "Ensure that Load Balancer has deletion protection enabled"
	FAILED for resource: aws_lb.external_sandbox
	File: /sandbox_lb.tf:2-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-150

		2  | resource "aws_lb" "external_sandbox" {
		3  |   # checkov:skip=CKV_AWS_91
		4  |   # checkov:skip=CKV2_AWS_28
		5  | 
		6  |   count = local.is-development ? 1 : 0
		7  | 
		8  |   name               = "${local.application_name}-lb-sandbox"
		9  |   internal           = false
		10 |   load_balancer_type = "application"
		11 |   security_groups    = [aws_security_group.load_balancer_security_group_sandbox[0].id]
		12 |   subnets            = data.aws_subnets.shared-public.ids
		13 | 
		14 |   drop_invalid_header_fields = true
		15 | 
		16 |   tags = merge(
		17 |     local.tags,
		18 |     {
		19 |       Name = "${local.application_name}-sandbox"
		20 |     }
		21 |   )
		22 | }

Check: CKV_AWS_118: "Ensure that enhanced monitoring is enabled for Amazon RDS instances"
	FAILED for resource: aws_db_instance.jitbit_sandbox
	File: /sandbox_rds.tf:27-70
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/ensure-that-enhanced-monitoring-is-enabled-for-amazon-rds-instances

		27 | resource "aws_db_instance" "jitbit_sandbox" {
		28 |   count = local.is-development ? 1 : 0
		29 | 
		30 |   engine         = "sqlserver-se"
		31 |   license_model  = "license-included"
		32 |   engine_version = local.application_data.accounts["sandbox"].db_engine_version
		33 |   instance_class = local.application_data.accounts["sandbox"].db_instance_class
		34 |   identifier     = "${local.application_name}-sandbox-database"
		35 |   username       = local.application_data.accounts["sandbox"].db_user
		36 | 
		37 |   manage_master_user_password = true
		38 | 
		39 |   snapshot_identifier = try(local.application_data.accounts["sandbox"].db_snapshot_identifier, null)
		40 | 
		41 |   # tflint-ignore: aws_db_instance_default_parameter_group
		42 |   parameter_group_name        = "default.sqlserver-se-15.0"
		43 |   deletion_protection         = local.application_data.accounts["sandbox"].db_deletion_protection
		44 |   delete_automated_backups    = local.application_data.accounts["sandbox"].db_delete_automated_backups
		45 |   skip_final_snapshot         = local.application_data.accounts["sandbox"].db_skip_final_snapshot
		46 |   final_snapshot_identifier   = !local.skip_final_snapshot ? "${local.application_name}-sandbox-database-final-snapshot" : null
		47 |   allocated_storage           = local.application_data.accounts["sandbox"].db_allocated_storage
		48 |   max_allocated_storage       = local.application_data.accounts["sandbox"].db_max_allocated_storage
		49 |   storage_type                = local.application_data.accounts["sandbox"].db_storage_type
		50 |   maintenance_window          = local.application_data.accounts["sandbox"].db_maintenance_window
		51 |   auto_minor_version_upgrade  = local.application_data.accounts["sandbox"].db_auto_minor_version_upgrade
		52 |   allow_major_version_upgrade = local.application_data.accounts["sandbox"].db_allow_major_version_upgrade
		53 |   backup_window               = local.application_data.accounts["sandbox"].db_backup_window
		54 |   backup_retention_period     = local.application_data.accounts["sandbox"].db_retention_period
		55 |   #checkov:skip=CKV_AWS_133: "backup_retention enabled, can be edited it application_variables.json"
		56 |   iam_database_authentication_enabled = local.application_data.accounts["sandbox"].db_iam_database_authentication_enabled
		57 |   #checkov:skip=CKV_AWS_161: "iam auth enabled, but optional"
		58 |   db_subnet_group_name   = aws_db_subnet_group.jitbit.id
		59 |   vpc_security_group_ids = [aws_security_group.database_security_group_sandbox[0].id]
		60 |   multi_az               = local.application_data.accounts["sandbox"].db_multi_az
		61 |   #checkov:skip=CKV_AWS_157: "multi-az enabled, but optional"
		62 |   storage_encrypted = true
		63 | 
		64 |   tags = merge(
		65 |     local.tags,
		66 |     {
		67 |       Name = lower(format("%s-%s-database", local.application_name, "sandbox"))
		68 |     }
		69 |   )
		70 | }

Check: CKV_AWS_129: "Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled"
	FAILED for resource: aws_db_instance.jitbit_sandbox
	File: /sandbox_rds.tf:27-70
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-that-respective-logs-of-amazon-relational-database-service-amazon-rds-are-enabled

		27 | resource "aws_db_instance" "jitbit_sandbox" {
		28 |   count = local.is-development ? 1 : 0
		29 | 
		30 |   engine         = "sqlserver-se"
		31 |   license_model  = "license-included"
		32 |   engine_version = local.application_data.accounts["sandbox"].db_engine_version
		33 |   instance_class = local.application_data.accounts["sandbox"].db_instance_class
		34 |   identifier     = "${local.application_name}-sandbox-database"
		35 |   username       = local.application_data.accounts["sandbox"].db_user
		36 | 
		37 |   manage_master_user_password = true
		38 | 
		39 |   snapshot_identifier = try(local.application_data.accounts["sandbox"].db_snapshot_identifier, null)
		40 | 
		41 |   # tflint-ignore: aws_db_instance_default_parameter_group
		42 |   parameter_group_name        = "default.sqlserver-se-15.0"
		43 |   deletion_protection         = local.application_data.accounts["sandbox"].db_deletion_protection
		44 |   delete_automated_backups    = local.application_data.accounts["sandbox"].db_delete_automated_backups
		45 |   skip_final_snapshot         = local.application_data.accounts["sandbox"].db_skip_final_snapshot
		46 |   final_snapshot_identifier   = !local.skip_final_snapshot ? "${local.application_name}-sandbox-database-final-snapshot" : null
		47 |   allocated_storage           = local.application_data.accounts["sandbox"].db_allocated_storage
		48 |   max_allocated_storage       = local.application_data.accounts["sandbox"].db_max_allocated_storage
		49 |   storage_type                = local.application_data.accounts["sandbox"].db_storage_type
		50 |   maintenance_window          = local.application_data.accounts["sandbox"].db_maintenance_window
		51 |   auto_minor_version_upgrade  = local.application_data.accounts["sandbox"].db_auto_minor_version_upgrade
		52 |   allow_major_version_upgrade = local.application_data.accounts["sandbox"].db_allow_major_version_upgrade
		53 |   backup_window               = local.application_data.accounts["sandbox"].db_backup_window
		54 |   backup_retention_period     = local.application_data.accounts["sandbox"].db_retention_period
		55 |   #checkov:skip=CKV_AWS_133: "backup_retention enabled, can be edited it application_variables.json"
		56 |   iam_database_authentication_enabled = local.application_data.accounts["sandbox"].db_iam_database_authentication_enabled
		57 |   #checkov:skip=CKV_AWS_161: "iam auth enabled, but optional"
		58 |   db_subnet_group_name   = aws_db_subnet_group.jitbit.id
		59 |   vpc_security_group_ids = [aws_security_group.database_security_group_sandbox[0].id]
		60 |   multi_az               = local.application_data.accounts["sandbox"].db_multi_az
		61 |   #checkov:skip=CKV_AWS_157: "multi-az enabled, but optional"
		62 |   storage_encrypted = true
		63 | 
		64 |   tags = merge(
		65 |     local.tags,
		66 |     {
		67 |       Name = lower(format("%s-%s-database", local.application_name, "sandbox"))
		68 |     }
		69 |   )
		70 | }

Check: CKV_AWS_354: "Ensure RDS Performance Insights are encrypted using KMS CMKs"
	FAILED for resource: aws_db_instance.jitbit_sandbox
	File: /sandbox_rds.tf:27-70
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-354

		27 | resource "aws_db_instance" "jitbit_sandbox" {
		28 |   count = local.is-development ? 1 : 0
		29 | 
		30 |   engine         = "sqlserver-se"
		31 |   license_model  = "license-included"
		32 |   engine_version = local.application_data.accounts["sandbox"].db_engine_version
		33 |   instance_class = local.application_data.accounts["sandbox"].db_instance_class
		34 |   identifier     = "${local.application_name}-sandbox-database"
		35 |   username       = local.application_data.accounts["sandbox"].db_user
		36 | 
		37 |   manage_master_user_password = true
		38 | 
		39 |   snapshot_identifier = try(local.application_data.accounts["sandbox"].db_snapshot_identifier, null)
		40 | 
		41 |   # tflint-ignore: aws_db_instance_default_parameter_group
		42 |   parameter_group_name        = "default.sqlserver-se-15.0"
		43 |   deletion_protection         = local.application_data.accounts["sandbox"].db_deletion_protection
		44 |   delete_automated_backups    = local.application_data.accounts["sandbox"].db_delete_automated_backups
		45 |   skip_final_snapshot         = local.application_data.accounts["sandbox"].db_skip_final_snapshot
		46 |   final_snapshot_identifier   = !local.skip_final_snapshot ? "${local.application_name}-sandbox-database-final-snapshot" : null
		47 |   allocated_storage           = local.application_data.accounts["sandbox"].db_allocated_storage
		48 |   max_allocated_storage       = local.application_data.accounts["sandbox"].db_max_allocated_storage
		49 |   storage_type                = local.application_data.accounts["sandbox"].db_storage_type
		50 |   maintenance_window          = local.application_data.accounts["sandbox"].db_maintenance_window
		51 |   auto_minor_version_upgrade  = local.application_data.accounts["sandbox"].db_auto_minor_version_upgrade
		52 |   allow_major_version_upgrade = local.application_data.accounts["sandbox"].db_allow_major_version_upgrade
		53 |   backup_window               = local.application_data.accounts["sandbox"].db_backup_window
		54 |   backup_retention_period     = local.application_data.accounts["sandbox"].db_retention_period
		55 |   #checkov:skip=CKV_AWS_133: "backup_retention enabled, can be edited it application_variables.json"
		56 |   iam_database_authentication_enabled = local.application_data.accounts["sandbox"].db_iam_database_authentication_enabled
		57 |   #checkov:skip=CKV_AWS_161: "iam auth enabled, but optional"
		58 |   db_subnet_group_name   = aws_db_subnet_group.jitbit.id
		59 |   vpc_security_group_ids = [aws_security_group.database_security_group_sandbox[0].id]
		60 |   multi_az               = local.application_data.accounts["sandbox"].db_multi_az
		61 |   #checkov:skip=CKV_AWS_157: "multi-az enabled, but optional"
		62 |   storage_encrypted = true
		63 | 
		64 |   tags = merge(
		65 |     local.tags,
		66 |     {
		67 |       Name = lower(format("%s-%s-database", local.application_name, "sandbox"))
		68 |     }
		69 |   )
		70 | }

Check: CKV_AWS_353: "Ensure that RDS instances have performance insights enabled"
	FAILED for resource: aws_db_instance.jitbit_sandbox
	File: /sandbox_rds.tf:27-70
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-353

		27 | resource "aws_db_instance" "jitbit_sandbox" {
		28 |   count = local.is-development ? 1 : 0
		29 | 
		30 |   engine         = "sqlserver-se"
		31 |   license_model  = "license-included"
		32 |   engine_version = local.application_data.accounts["sandbox"].db_engine_version
		33 |   instance_class = local.application_data.accounts["sandbox"].db_instance_class
		34 |   identifier     = "${local.application_name}-sandbox-database"
		35 |   username       = local.application_data.accounts["sandbox"].db_user
		36 | 
		37 |   manage_master_user_password = true
		38 | 
		39 |   snapshot_identifier = try(local.application_data.accounts["sandbox"].db_snapshot_identifier, null)
		40 | 
		41 |   # tflint-ignore: aws_db_instance_default_parameter_group
		42 |   parameter_group_name        = "default.sqlserver-se-15.0"
		43 |   deletion_protection         = local.application_data.accounts["sandbox"].db_deletion_protection
		44 |   delete_automated_backups    = local.application_data.accounts["sandbox"].db_delete_automated_backups
		45 |   skip_final_snapshot         = local.application_data.accounts["sandbox"].db_skip_final_snapshot
		46 |   final_snapshot_identifier   = !local.skip_final_snapshot ? "${local.application_name}-sandbox-database-final-snapshot" : null
		47 |   allocated_storage           = local.application_data.accounts["sandbox"].db_allocated_storage
		48 |   max_allocated_storage       = local.application_data.accounts["sandbox"].db_max_allocated_storage
		49 |   storage_type                = local.application_data.accounts["sandbox"].db_storage_type
		50 |   maintenance_window          = local.application_data.accounts["sandbox"].db_maintenance_window
		51 |   auto_minor_version_upgrade  = local.application_data.accounts["sandbox"].db_auto_minor_version_upgrade
		52 |   allow_major_version_upgrade = local.application_data.accounts["sandbox"].db_allow_major_version_upgrade
		53 |   backup_window               = local.application_data.accounts["sandbox"].db_backup_window
		54 |   backup_retention_period     = local.application_data.accounts["sandbox"].db_retention_period
		55 |   #checkov:skip=CKV_AWS_133: "backup_retention enabled, can be edited it application_variables.json"
		56 |   iam_database_authentication_enabled = local.application_data.accounts["sandbox"].db_iam_database_authentication_enabled
		57 |   #checkov:skip=CKV_AWS_161: "iam auth enabled, but optional"
		58 |   db_subnet_group_name   = aws_db_subnet_group.jitbit.id
		59 |   vpc_security_group_ids = [aws_security_group.database_security_group_sandbox[0].id]
		60 |   multi_az               = local.application_data.accounts["sandbox"].db_multi_az
		61 |   #checkov:skip=CKV_AWS_157: "multi-az enabled, but optional"
		62 |   storage_encrypted = true
		63 | 
		64 |   tags = merge(
		65 |     local.tags,
		66 |     {
		67 |       Name = lower(format("%s-%s-database", local.application_name, "sandbox"))
		68 |     }
		69 |   )
		70 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: jitbit_bucket_sandbox
	File: /sandbox_s3.tf:1-86
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_26: "Ensure all data stored in the SNS topic is encrypted"
	FAILED for resource: aws_sns_topic.jitbit_ses_destination_topic
	File: /ses-logging.tf:17-21
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-15

		17 | resource "aws_sns_topic" "jitbit_ses_destination_topic" {
		18 |   name = format("%s-ses-destination-topic", local.application_name)
		19 | 
		20 |   tags = local.tags
		21 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.sns_logs
	File: /ses-logging.tf:67-72
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		67 | resource "aws_cloudwatch_log_group" "sns_logs" {
		68 |   name              = format("%s-ses-logs", local.application_name)
		69 |   retention_in_days = local.application_data.accounts[local.environment].ses_log_retention_days
		70 | 
		71 |   tags = local.tags
		72 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.execution_logs
	File: /ses-logging.tf:74-79
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		74 | resource "aws_cloudwatch_log_group" "execution_logs" {
		75 |   name              = format("/aws/lambda/%s", aws_lambda_function.sns_to_cloudwatch.function_name)
		76 |   retention_in_days = 3
		77 | 
		78 |   tags = local.tags
		79 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.execution_logs
	File: /ses-logging.tf:74-79
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		74 | resource "aws_cloudwatch_log_group" "execution_logs" {
		75 |   name              = format("/aws/lambda/%s", aws_lambda_function.sns_to_cloudwatch.function_name)
		76 |   retention_in_days = 3
		77 | 
		78 |   tags = local.tags
		79 | }

Check: CKV_AWS_273: "Ensure access is controlled through SSO and not AWS IAM defined users"
	FAILED for resource: aws_iam_user.jitbit_ses_smtp_user
	File: /ses.tf:54-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-273

		54 | resource "aws_iam_user" "jitbit_ses_smtp_user" {
		55 |   name = "${local.environment}-jitbit-smtp-user"
		56 | }

Check: CKV_AWS_290: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_user_policy.jitbit_ses_smtp_user
	File: /ses.tf:62-79
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-290

		62 | resource "aws_iam_user_policy" "jitbit_ses_smtp_user" {
		63 |   name = "${local.environment}-jitbit-ses-smtp-user-policy"
		64 |   user = aws_iam_user.jitbit_ses_smtp_user.name
		65 | 
		66 |   policy = jsonencode({
		67 |     Version = "2012-10-17",
		68 |     Statement = [
		69 |       {
		70 |         Effect = "Allow",
		71 |         Action = [
		72 |           "ses:SendRawEmail",
		73 |           "ses:SendEmail"
		74 |         ],
		75 |         Resource = "*"
		76 |       }
		77 |     ]
		78 |   })
		79 | }

Check: CKV_AWS_355: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_user_policy.jitbit_ses_smtp_user
	File: /ses.tf:62-79
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-355

		62 | resource "aws_iam_user_policy" "jitbit_ses_smtp_user" {
		63 |   name = "${local.environment}-jitbit-ses-smtp-user-policy"
		64 |   user = aws_iam_user.jitbit_ses_smtp_user.name
		65 | 
		66 |   policy = jsonencode({
		67 |     Version = "2012-10-17",
		68 |     Statement = [
		69 |       {
		70 |         Effect = "Allow",
		71 |         Action = [
		72 |           "ses:SendRawEmail",
		73 |           "ses:SendEmail"
		74 |         ],
		75 |         Resource = "*"
		76 |       }
		77 |     ]
		78 |   })
		79 | }

Check: CKV_AWS_337: "Ensure SSM parameters are using KMS CMK"
	FAILED for resource: aws_ssm_parameter.jitbit_ses_smtp_user
	File: /ses.tf:81-91
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-337

		81 | resource "aws_ssm_parameter" "jitbit_ses_smtp_user" {
		82 |   name = "/${local.environment}/jitbit/ses_smtp"
		83 |   type = "SecureString"
		84 |   value = jsonencode({
		85 |     user              = aws_iam_user.jitbit_ses_smtp_user.name,
		86 |     key               = aws_iam_access_key.jitbit_ses_smtp_user.id,
		87 |     secret            = aws_iam_access_key.jitbit_ses_smtp_user.secret
		88 |     ses_smtp_user     = aws_iam_access_key.jitbit_ses_smtp_user.id
		89 |     ses_smtp_password = aws_iam_access_key.jitbit_ses_smtp_user.ses_smtp_password_v4
		90 |   })
		91 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.lambda_policy_bounce_email_notification
	File: /ses_bounce.tf:58-75
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		58 | data "aws_iam_policy_document" "lambda_policy_bounce_email_notification" {
		59 |   statement {
		60 |     actions = [
		61 |       "ses:SendRawEmail",
		62 |       "ses:SendEmail"
		63 |     ]
		64 |     resources = ["*"]
		65 |   }
		66 | 
		67 |   statement {
		68 |     actions = [
		69 |       "logs:CreateLogGroup",
		70 |       "logs:CreateLogStream",
		71 |       "logs:PutLogEvents"
		72 |     ]
		73 |     resources = ["arn:aws:logs:*:*:*"]
		74 |   }
		75 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.lambda_policy_bounce_email_notification
	File: /ses_bounce.tf:58-75
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		58 | data "aws_iam_policy_document" "lambda_policy_bounce_email_notification" {
		59 |   statement {
		60 |     actions = [
		61 |       "ses:SendRawEmail",
		62 |       "ses:SendEmail"
		63 |     ]
		64 |     resources = ["*"]
		65 |   }
		66 | 
		67 |   statement {
		68 |     actions = [
		69 |       "logs:CreateLogGroup",
		70 |       "logs:CreateLogStream",
		71 |       "logs:PutLogEvents"
		72 |     ]
		73 |     resources = ["arn:aws:logs:*:*:*"]
		74 |   }
		75 | }

Check: CKV_AWS_26: "Ensure all data stored in the SNS topic is encrypted"
	FAILED for resource: aws_sns_topic.jitbit_ses_destination_topic_bounce_email_notification
	File: /ses_bounce.tf:1-5
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-15

		1 | resource "aws_sns_topic" "jitbit_ses_destination_topic_bounce_email_notification" {
		2 |   name = format("%s-ses-destination-topic-bounce-email-notification", local.application_name)
		3 | 
		4 |   tags = local.tags
		5 | }

Check: CKV_AWS_115: "Ensure that AWS Lambda function is configured for function-level concurrent execution limit"
	FAILED for resource: aws_lambda_function.bounce_email_notification
	File: /ses_bounce.tf:29-43
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-function-level-concurrent-execution-limit

		29 | resource "aws_lambda_function" "bounce_email_notification" {
		30 |   filename         = "${path.module}/lambda/bounce_email_notification/bounce_email_notification.zip"
		31 |   function_name    = "bounce_email_notification"
		32 |   architectures    = ["arm64"]
		33 |   role             = aws_iam_role.lambda_bounce_email_notification.arn
		34 |   runtime          = "python3.12"
		35 |   handler          = "bounce_email_notification.handler"
		36 |   source_code_hash = data.archive_file.lambda_function_payload_bounce_email_notification.output_base64sha256
		37 | 
		38 |   lifecycle {
		39 |     replace_triggered_by = [aws_iam_role.lambda_bounce_email_notification]
		40 |   }
		41 | 
		42 |   tags = local.tags
		43 | }

Check: CKV_AWS_272: "Ensure AWS Lambda function is configured to validate code-signing"
	FAILED for resource: aws_lambda_function.bounce_email_notification
	File: /ses_bounce.tf:29-43
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-272

		29 | resource "aws_lambda_function" "bounce_email_notification" {
		30 |   filename         = "${path.module}/lambda/bounce_email_notification/bounce_email_notification.zip"
		31 |   function_name    = "bounce_email_notification"
		32 |   architectures    = ["arm64"]
		33 |   role             = aws_iam_role.lambda_bounce_email_notification.arn
		34 |   runtime          = "python3.12"
		35 |   handler          = "bounce_email_notification.handler"
		36 |   source_code_hash = data.archive_file.lambda_function_payload_bounce_email_notification.output_base64sha256
		37 | 
		38 |   lifecycle {
		39 |     replace_triggered_by = [aws_iam_role.lambda_bounce_email_notification]
		40 |   }
		41 | 
		42 |   tags = local.tags
		43 | }

Check: CKV_AWS_117: "Ensure that AWS Lambda function is configured inside a VPC"
	FAILED for resource: aws_lambda_function.bounce_email_notification
	File: /ses_bounce.tf:29-43
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-inside-a-vpc-1

		29 | resource "aws_lambda_function" "bounce_email_notification" {
		30 |   filename         = "${path.module}/lambda/bounce_email_notification/bounce_email_notification.zip"
		31 |   function_name    = "bounce_email_notification"
		32 |   architectures    = ["arm64"]
		33 |   role             = aws_iam_role.lambda_bounce_email_notification.arn
		34 |   runtime          = "python3.12"
		35 |   handler          = "bounce_email_notification.handler"
		36 |   source_code_hash = data.archive_file.lambda_function_payload_bounce_email_notification.output_base64sha256
		37 | 
		38 |   lifecycle {
		39 |     replace_triggered_by = [aws_iam_role.lambda_bounce_email_notification]
		40 |   }
		41 | 
		42 |   tags = local.tags
		43 | }

Check: CKV_AWS_116: "Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)"
	FAILED for resource: aws_lambda_function.bounce_email_notification
	File: /ses_bounce.tf:29-43
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-a-dead-letter-queue-dlq

		29 | resource "aws_lambda_function" "bounce_email_notification" {
		30 |   filename         = "${path.module}/lambda/bounce_email_notification/bounce_email_notification.zip"
		31 |   function_name    = "bounce_email_notification"
		32 |   architectures    = ["arm64"]
		33 |   role             = aws_iam_role.lambda_bounce_email_notification.arn
		34 |   runtime          = "python3.12"
		35 |   handler          = "bounce_email_notification.handler"
		36 |   source_code_hash = data.archive_file.lambda_function_payload_bounce_email_notification.output_base64sha256
		37 | 
		38 |   lifecycle {
		39 |     replace_triggered_by = [aws_iam_role.lambda_bounce_email_notification]
		40 |   }
		41 | 
		42 |   tags = local.tags
		43 | }

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: aws_lambda_function.bounce_email_notification
	File: /ses_bounce.tf:29-43
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		29 | resource "aws_lambda_function" "bounce_email_notification" {
		30 |   filename         = "${path.module}/lambda/bounce_email_notification/bounce_email_notification.zip"
		31 |   function_name    = "bounce_email_notification"
		32 |   architectures    = ["arm64"]
		33 |   role             = aws_iam_role.lambda_bounce_email_notification.arn
		34 |   runtime          = "python3.12"
		35 |   handler          = "bounce_email_notification.handler"
		36 |   source_code_hash = data.archive_file.lambda_function_payload_bounce_email_notification.output_base64sha256
		37 | 
		38 |   lifecycle {
		39 |     replace_triggered_by = [aws_iam_role.lambda_bounce_email_notification]
		40 |   }
		41 | 
		42 |   tags = local.tags
		43 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.bounce_email_notification
	File: /ses_bounce.tf:91-96
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		91 | resource "aws_cloudwatch_log_group" "bounce_email_notification" {
		92 |   name              = "/aws/lambda/bounce_email_notification"
		93 |   retention_in_days = local.application_data.accounts[local.environment].lambda_log_retention_days
		94 | 
		95 |   tags = local.tags
		96 | }
Check: CKV_AWS_26: "Ensure all data stored in the SNS topic is encrypted"
	FAILED for resource: aws_sns_topic.jitbit_ses_destination_topic
	File: /ses_logging.tf:4-8
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-15

		4 | resource "aws_sns_topic" "jitbit_ses_destination_topic" {
		5 |   name = format("%s-ses-destination-topic", local.application_name)
		6 | 
		7 |   tags = local.tags
		8 | }

Check: CKV_AWS_115: "Ensure that AWS Lambda function is configured for function-level concurrent execution limit"
	FAILED for resource: aws_lambda_function.sns_to_cloudwatch
	File: /ses_logging.tf:36-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-function-level-concurrent-execution-limit

		36 | resource "aws_lambda_function" "sns_to_cloudwatch" {
		37 |   filename         = "${path.module}/lambda/sns_to_cloudwatch/sns_to_cloudwatch.zip"
		38 |   function_name    = "sns_to_cloudwatch"
		39 |   architectures    = ["arm64"]
		40 |   role             = aws_iam_role.lambda_logging.arn
		41 |   runtime          = "python3.12"
		42 |   handler          = "sns_to_cloudwatch.handler"
		43 |   source_code_hash = data.archive_file.lambda_function_payload.output_base64sha256
		44 | 
		45 |   environment {
		46 |     variables = {
		47 |       LOG_GROUP_NAME = aws_cloudwatch_log_group.sns_logs.name
		48 |     }
		49 |   }
		50 | 
		51 |   lifecycle {
		52 |     replace_triggered_by = [aws_iam_role.lambda_logging]
		53 |   }
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_272: "Ensure AWS Lambda function is configured to validate code-signing"
	FAILED for resource: aws_lambda_function.sns_to_cloudwatch
	File: /ses_logging.tf:36-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-272

		36 | resource "aws_lambda_function" "sns_to_cloudwatch" {
		37 |   filename         = "${path.module}/lambda/sns_to_cloudwatch/sns_to_cloudwatch.zip"
		38 |   function_name    = "sns_to_cloudwatch"
		39 |   architectures    = ["arm64"]
		40 |   role             = aws_iam_role.lambda_logging.arn
		41 |   runtime          = "python3.12"
		42 |   handler          = "sns_to_cloudwatch.handler"
		43 |   source_code_hash = data.archive_file.lambda_function_payload.output_base64sha256
		44 | 
		45 |   environment {
		46 |     variables = {
		47 |       LOG_GROUP_NAME = aws_cloudwatch_log_group.sns_logs.name
		48 |     }
		49 |   }
		50 | 
		51 |   lifecycle {
		52 |     replace_triggered_by = [aws_iam_role.lambda_logging]
		53 |   }
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_173: "Check encryption settings for Lambda environmental variable"
	FAILED for resource: aws_lambda_function.sns_to_cloudwatch
	File: /ses_logging.tf:36-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-5

		36 | resource "aws_lambda_function" "sns_to_cloudwatch" {
		37 |   filename         = "${path.module}/lambda/sns_to_cloudwatch/sns_to_cloudwatch.zip"
		38 |   function_name    = "sns_to_cloudwatch"
		39 |   architectures    = ["arm64"]
		40 |   role             = aws_iam_role.lambda_logging.arn
		41 |   runtime          = "python3.12"
		42 |   handler          = "sns_to_cloudwatch.handler"
		43 |   source_code_hash = data.archive_file.lambda_function_payload.output_base64sha256
		44 | 
		45 |   environment {
		46 |     variables = {
		47 |       LOG_GROUP_NAME = aws_cloudwatch_log_group.sns_logs.name
		48 |     }
		49 |   }
		50 | 
		51 |   lifecycle {
		52 |     replace_triggered_by = [aws_iam_role.lambda_logging]
		53 |   }
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_117: "Ensure that AWS Lambda function is configured inside a VPC"
	FAILED for resource: aws_lambda_function.sns_to_cloudwatch
	File: /ses_logging.tf:36-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-inside-a-vpc-1

		36 | resource "aws_lambda_function" "sns_to_cloudwatch" {
		37 |   filename         = "${path.module}/lambda/sns_to_cloudwatch/sns_to_cloudwatch.zip"
		38 |   function_name    = "sns_to_cloudwatch"
		39 |   architectures    = ["arm64"]
		40 |   role             = aws_iam_role.lambda_logging.arn
		41 |   runtime          = "python3.12"
		42 |   handler          = "sns_to_cloudwatch.handler"
		43 |   source_code_hash = data.archive_file.lambda_function_payload.output_base64sha256
		44 | 
		45 |   environment {
		46 |     variables = {
		47 |       LOG_GROUP_NAME = aws_cloudwatch_log_group.sns_logs.name
		48 |     }
		49 |   }
		50 | 
		51 |   lifecycle {
		52 |     replace_triggered_by = [aws_iam_role.lambda_logging]
		53 |   }
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_116: "Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)"
	FAILED for resource: aws_lambda_function.sns_to_cloudwatch
	File: /ses_logging.tf:36-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-a-dead-letter-queue-dlq

		36 | resource "aws_lambda_function" "sns_to_cloudwatch" {
		37 |   filename         = "${path.module}/lambda/sns_to_cloudwatch/sns_to_cloudwatch.zip"
		38 |   function_name    = "sns_to_cloudwatch"
		39 |   architectures    = ["arm64"]
		40 |   role             = aws_iam_role.lambda_logging.arn
		41 |   runtime          = "python3.12"
		42 |   handler          = "sns_to_cloudwatch.handler"
		43 |   source_code_hash = data.archive_file.lambda_function_payload.output_base64sha256
		44 | 
		45 |   environment {
		46 |     variables = {
		47 |       LOG_GROUP_NAME = aws_cloudwatch_log_group.sns_logs.name
		48 |     }
		49 |   }
		50 | 
		51 |   lifecycle {
		52 |     replace_triggered_by = [aws_iam_role.lambda_logging]
		53 |   }
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: aws_lambda_function.sns_to_cloudwatch
	File: /ses_logging.tf:36-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		36 | resource "aws_lambda_function" "sns_to_cloudwatch" {
		37 |   filename         = "${path.module}/lambda/sns_to_cloudwatch/sns_to_cloudwatch.zip"
		38 |   function_name    = "sns_to_cloudwatch"
		39 |   architectures    = ["arm64"]
		40 |   role             = aws_iam_role.lambda_logging.arn
		41 |   runtime          = "python3.12"
		42 |   handler          = "sns_to_cloudwatch.handler"
		43 |   source_code_hash = data.archive_file.lambda_function_payload.output_base64sha256
		44 | 
		45 |   environment {
		46 |     variables = {
		47 |       LOG_GROUP_NAME = aws_cloudwatch_log_group.sns_logs.name
		48 |     }
		49 |   }
		50 | 
		51 |   lifecycle {
		52 |     replace_triggered_by = [aws_iam_role.lambda_logging]
		53 |   }
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.sns_logs
	File: /ses_logging.tf:58-63
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		58 | resource "aws_cloudwatch_log_group" "sns_logs" {
		59 |   name              = format("%s-ses-logs", local.application_name)
		60 |   retention_in_days = local.application_data.accounts[local.environment].lambda_log_retention_days
		61 | 
		62 |   tags = local.tags
		63 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.execution_logs
	File: /ses_logging.tf:65-70
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		65 | resource "aws_cloudwatch_log_group" "execution_logs" {
		66 |   name              = format("/aws/lambda/%s", aws_lambda_function.sns_to_cloudwatch.function_name)
		67 |   retention_in_days = 3
		68 | 
		69 |   tags = local.tags
		70 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.execution_logs
	File: /ses_logging.tf:65-70
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		65 | resource "aws_cloudwatch_log_group" "execution_logs" {
		66 |   name              = format("/aws/lambda/%s", aws_lambda_function.sns_to_cloudwatch.function_name)
		67 |   retention_in_days = 3
		68 | 
		69 |   tags = local.tags
		70 | }

Check: CKV_AWS_337: "Ensure SSM parameters are using KMS CMK"
	FAILED for resource: aws_ssm_parameter.app_url
	File: /ssm.tf:2-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-337

		2 | resource "aws_ssm_parameter" "app_url" {
		3 |   name  = "/${var.networking[0].application}/environment/app-url"
		4 |   type  = "String"
		5 |   value = "https://${local.app_url}/"
		6 | }

Check: CKV_AWS_192: "Ensure WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell"
	FAILED for resource: aws_wafv2_web_acl.this
	File: /waf.tf:1-53
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-waf-prevents-message-lookup-in-log4j2

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.waf
	File: /waf.tf:59-63
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		59 | resource "aws_cloudwatch_log_group" "waf" {
		60 |   name              = "aws-waf-logs-${local.application_name}"
		61 |   retention_in_days = 60
		62 |   tags              = local.tags
		63 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.waf
	File: /waf.tf:59-63
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		59 | resource "aws_cloudwatch_log_group" "waf" {
		60 |   name              = "aws-waf-logs-${local.application_name}"
		61 |   retention_in_days = 60
		62 |   tags              = local.tags
		63 | }

Check: CKV2_AWS_60: "Ensure RDS instance with copy tags to snapshots is enabled"
	FAILED for resource: aws_db_instance.jitbit
	File: /rds.tf:40-83
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-60

		40 | resource "aws_db_instance" "jitbit" {
		41 |   engine         = "sqlserver-se"
		42 |   license_model  = "license-included"
		43 |   engine_version = local.application_data.accounts[local.environment].db_engine_version
		44 |   instance_class = local.application_data.accounts[local.environment].db_instance_class
		45 |   identifier     = "${local.application_name}-${local.environment}-database"
		46 |   username       = local.application_data.accounts[local.environment].db_user
		47 | 
		48 |   manage_master_user_password = true
		49 | 
		50 |   snapshot_identifier = try(local.application_data.accounts[local.environment].db_snapshot_identifier, null)
		51 | 
		52 |   # tflint-ignore: aws_db_instance_default_parameter_group
		53 |   parameter_group_name        = "default.sqlserver-se-15.0"
		54 |   deletion_protection         = local.application_data.accounts[local.environment].db_deletion_protection
		55 |   delete_automated_backups    = local.application_data.accounts[local.environment].db_delete_automated_backups
		56 |   skip_final_snapshot         = local.skip_final_snapshot
		57 |   final_snapshot_identifier   = !local.skip_final_snapshot ? "${local.application_name}-${local.environment}-database-final-snapshot" : null
		58 |   allocated_storage           = local.application_data.accounts[local.environment].db_allocated_storage
		59 |   max_allocated_storage       = local.application_data.accounts[local.environment].db_max_allocated_storage
		60 |   storage_type                = local.application_data.accounts[local.environment].db_storage_type
		61 |   maintenance_window          = local.application_data.accounts[local.environment].db_maintenance_window
		62 |   auto_minor_version_upgrade  = local.application_data.accounts[local.environment].db_auto_minor_version_upgrade
		63 |   allow_major_version_upgrade = local.application_data.accounts[local.environment].db_allow_major_version_upgrade
		64 |   backup_window               = local.application_data.accounts[local.environment].db_backup_window
		65 |   backup_retention_period     = local.application_data.accounts[local.environment].db_retention_period
		66 |   #checkov:skip=CKV_AWS_133: "backup_retention enabled, can be edited it application_variables.json"
		67 |   iam_database_authentication_enabled = local.application_data.accounts[local.environment].db_iam_database_authentication_enabled
		68 |   #checkov:skip=CKV_AWS_161: "iam auth enabled, but optional"
		69 |   db_subnet_group_name   = aws_db_subnet_group.jitbit.id
		70 |   vpc_security_group_ids = [aws_security_group.database_security_group.id]
		71 |   multi_az               = local.application_data.accounts[local.environment].db_multi_az
		72 |   #checkov:skip=CKV_AWS_157: "multi-az enabled, but optional"
		73 |   monitoring_interval = local.application_data.accounts[local.environment].db_monitoring_interval
		74 |   monitoring_role_arn = local.application_data.accounts[local.environment].db_monitoring_interval == 0 ? "" : aws_iam_role.rds_enhanced_monitoring[0].arn
		75 |   #checkov:skip=CKV_AWS_118: "enhanced monitoring is enabled, but optional"
		76 |   storage_encrypted               = true
		77 |   performance_insights_enabled    = local.application_data.accounts[local.environment].db_performance_insights_enabled
		78 |   performance_insights_kms_key_id = "" #tfsec:ignore:aws-rds-enable-performance-insights-encryption Left empty so that it will run, however should be populated with real key in scenario.
		79 |   enabled_cloudwatch_logs_exports = local.application_data.accounts[local.environment].db_enabled_cloudwatch_logs_exports
		80 |   tags = merge(local.tags,
		81 |     { Name = lower(format("%s-%s-database", local.application_name, local.environment)) }
		82 |   )
		83 | }

Check: CKV2_AWS_60: "Ensure RDS instance with copy tags to snapshots is enabled"
	FAILED for resource: aws_db_instance.jitbit_sandbox
	File: /sandbox_rds.tf:27-70
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-60

		27 | resource "aws_db_instance" "jitbit_sandbox" {
		28 |   count = local.is-development ? 1 : 0
		29 | 
		30 |   engine         = "sqlserver-se"
		31 |   license_model  = "license-included"
		32 |   engine_version = local.application_data.accounts["sandbox"].db_engine_version
		33 |   instance_class = local.application_data.accounts["sandbox"].db_instance_class
		34 |   identifier     = "${local.application_name}-sandbox-database"
		35 |   username       = local.application_data.accounts["sandbox"].db_user
		36 | 
		37 |   manage_master_user_password = true
		38 | 
		39 |   snapshot_identifier = try(local.application_data.accounts["sandbox"].db_snapshot_identifier, null)
		40 | 
		41 |   # tflint-ignore: aws_db_instance_default_parameter_group
		42 |   parameter_group_name        = "default.sqlserver-se-15.0"
		43 |   deletion_protection         = local.application_data.accounts["sandbox"].db_deletion_protection
		44 |   delete_automated_backups    = local.application_data.accounts["sandbox"].db_delete_automated_backups
		45 |   skip_final_snapshot         = local.application_data.accounts["sandbox"].db_skip_final_snapshot
		46 |   final_snapshot_identifier   = !local.skip_final_snapshot ? "${local.application_name}-sandbox-database-final-snapshot" : null
		47 |   allocated_storage           = local.application_data.accounts["sandbox"].db_allocated_storage
		48 |   max_allocated_storage       = local.application_data.accounts["sandbox"].db_max_allocated_storage
		49 |   storage_type                = local.application_data.accounts["sandbox"].db_storage_type
		50 |   maintenance_window          = local.application_data.accounts["sandbox"].db_maintenance_window
		51 |   auto_minor_version_upgrade  = local.application_data.accounts["sandbox"].db_auto_minor_version_upgrade
		52 |   allow_major_version_upgrade = local.application_data.accounts["sandbox"].db_allow_major_version_upgrade
		53 |   backup_window               = local.application_data.accounts["sandbox"].db_backup_window
		54 |   backup_retention_period     = local.application_data.accounts["sandbox"].db_retention_period
		55 |   #checkov:skip=CKV_AWS_133: "backup_retention enabled, can be edited it application_variables.json"
		56 |   iam_database_authentication_enabled = local.application_data.accounts["sandbox"].db_iam_database_authentication_enabled
		57 |   #checkov:skip=CKV_AWS_161: "iam auth enabled, but optional"
		58 |   db_subnet_group_name   = aws_db_subnet_group.jitbit.id
		59 |   vpc_security_group_ids = [aws_security_group.database_security_group_sandbox[0].id]
		60 |   multi_az               = local.application_data.accounts["sandbox"].db_multi_az
		61 |   #checkov:skip=CKV_AWS_157: "multi-az enabled, but optional"
		62 |   storage_encrypted = true
		63 | 
		64 |   tags = merge(
		65 |     local.tags,
		66 |     {
		67 |       Name = lower(format("%s-%s-database", local.application_name, "sandbox"))
		68 |     }
		69 |   )
		70 | }

Check: CKV2_AWS_34: "AWS SSM Parameter should be Encrypted"
	FAILED for resource: aws_ssm_parameter.app_url
	File: /ssm.tf:2-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-ssm-parameter-is-encrypted

		2 | resource "aws_ssm_parameter" "app_url" {
		3 |   name  = "/${var.networking[0].application}/environment/app-url"
		4 |   type  = "String"
		5 |   value = "https://${local.app_url}/"
		6 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: aws_security_group.jitbit
	File: /ecs.tf:53-62
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		53 | resource "aws_security_group" "jitbit" {
		54 |   vpc_id      = data.aws_vpc.shared.id
		55 |   name        = format("hmpps-%s-%s-service", local.environment, local.application_name)
		56 |   description = "Security group for the ${local.application_name} service"
		57 |   tags        = local.tags
		58 | 
		59 |   lifecycle {
		60 |     create_before_destroy = true
		61 |   }
		62 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: aws_security_group.jitbit_sandbox
	File: /sandbox_ecs.tf:55-66
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		55 | resource "aws_security_group" "jitbit_sandbox" {
		56 |   count = local.is-development ? 1 : 0
		57 | 
		58 |   vpc_id      = data.aws_vpc.shared.id
		59 |   name        = format("hmpps-%s-%s-service", "sandbox", local.application_name)
		60 |   description = "Security group for the ${local.application_name} service"
		61 |   tags        = local.tags
		62 | 
		63 |   lifecycle {
		64 |     create_before_destroy = true
		65 |   }
		66 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.db_app_connection_string_sandbox
	File: /sandbox_secrets.tf:2-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		2  | resource "aws_secretsmanager_secret" "db_app_connection_string_sandbox" {
		3  |   count = local.is-development ? 1 : 0
		4  |   #checkov:skip=CKV_AWS_149
		5  |   name                    = "${var.networking[0].application}-app-connection-string-sandbox"
		6  |   recovery_window_in_days = 0
		7  |   tags = merge(
		8  |     local.tags,
		9  |     {
		10 |       Name = "${var.networking[0].application}-app-connection-string-sandbox"
		11 |     },
		12 |   )
		13 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.db_app_connection_string
	File: /secrets.tf:5-15
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		5  | resource "aws_secretsmanager_secret" "db_app_connection_string" {
		6  |   #checkov:skip=CKV_AWS_149
		7  |   name                    = "${var.networking[0].application}-app-connection-string"
		8  |   recovery_window_in_days = 0
		9  |   tags = merge(
		10 |     local.tags,
		11 |     {
		12 |       Name = "${var.networking[0].application}-app-connection-string"
		13 |     },
		14 |   )
		15 | }


checkov_exitcode=1

`CTFLint Scan` Failed

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.5.0)
tflint will check the following folders:
terraform/environments/delius-jitbit

*****************************

Running tflint in terraform/environments/delius-jitbit
Excluding the following checks: terraform_unused_declarations
1 issue(s) found:

Warning: Missing version constraint for provider "archive" in `required_providers` (terraform_required_providers)

  on terraform/environments/delius-jitbit/ses_bounce.tf line 22:
  22: data "archive_file" "lambda_function_payload_bounce_email_notification" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_required_providers.md

tflint_exitcode=2

`Trivy Scan` Failed

Show Output

*****************************

Trivy will check the following folders:
terraform/environments/delius-jitbit

*****************************

Running Trivy in terraform/environments/delius-jitbit
2024-05-10T15:06:04Z	INFO	Need to update DB
2024-05-10T15:06:04Z	INFO	Downloading DB...	repository="ghcr.io/aquasecurity/trivy-db:2"
2024-05-10T15:06:06Z	INFO	Vulnerability scanning is enabled
2024-05-10T15:06:06Z	INFO	Misconfiguration scanning is enabled
2024-05-10T15:06:06Z	INFO	Need to update the built-in policies
2024-05-10T15:06:06Z	INFO	Downloading the built-in policies...
50.41 KiB / 50.41 KiB [-----------------------------------------------------------] 100.00% ? p/s 0s2024-05-10T15:06:06Z	INFO	Secret scanning is enabled
2024-05-10T15:06:06Z	INFO	If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-05-10T15:06:06Z	INFO	Please see also https://aquasecurity.github.io/trivy/v0.51/docs/scanner/secret/#recommendation for faster secret detection
2024-05-10T15:06:10Z	INFO	Number of language-specific files	num=0
2024-05-10T15:06:10Z	INFO	Detected config files	num=16

ecs.tf (terraform)
==================
Tests: 2 (SUCCESSES: 1, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 0, CRITICAL: 1)

CRITICAL: Security group rule allows egress to multiple public internet addresses.
════════════════════════════════════════
Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.

See https://avd.aquasec.com/misconfig/avd-aws-0104
────────────────────────────────────────
 ecs.tf:70
   via ecs.tf:64-72 (aws_security_group_rule.allow_all_egress)
────────────────────────────────────────
  64   resource "aws_security_group_rule" "allow_all_egress" {
  65     description       = "Allow all outbound traffic to any IPv4 address"
  66     type              = "egress"
  67     from_port         = 0
  68     to_port           = 0
  69     protocol          = "-1"
  70 [   cidr_blocks       = ["0.0.0.0/0"]
  71     security_group_id = aws_security_group.jitbit.id
  72   }
────────────────────────────────────────



github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.2.1/main.tf (terraform)
==========================================================================================================
Tests: 7 (SUCCESSES: 5, FAILURES: 0, EXCEPTIONS: 2)
Failures: 0 (HIGH: 0, CRITICAL: 0)


github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0/main.tf (terraform)
======================================================================================================
Tests: 14 (SUCCESSES: 12, FAILURES: 2, EXCEPTIONS: 0)
Failures: 2 (HIGH: 2, CRITICAL: 0)

HIGH: Bucket does not encrypt data with a customer managed key.
════════════════════════════════════════
Encryption using AWS keys provides protection for your S3 buckets. To increase control of the encryption and manage factors like rotation use customer managed keys.

See https://avd.aquasec.com/misconfig/avd-aws-0132
────────────────────────────────────────
 github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0/main.tf:157-165
   via s3.tf:1-84 (module.jitbit_bucket)
────────────────────────────────────────
 157 ┌ resource "aws_s3_bucket_server_side_encryption_configuration" "default" {
 158 │   bucket = aws_s3_bucket.default.id
 159 │   rule {
 160 │     apply_server_side_encryption_by_default {
 161 │       sse_algorithm     = var.sse_algorithm
 162 │       kms_master_key_id = (var.custom_kms_key != "") ? var.custom_kms_key : ""
 163 │     }
 164 │   }
 165 └ }
────────────────────────────────────────


HIGH: Bucket does not encrypt data with a customer managed key.
════════════════════════════════════════
Encryption using AWS keys provides protection for your S3 buckets. To increase control of the encryption and manage factors like rotation use customer managed keys.

See https://avd.aquasec.com/misconfig/avd-aws-0132
────────────────────────────────────────
 github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0/main.tf:157-165
   via ecs.tf:11-51 (module.s3_bucket_app_deployment)
────────────────────────────────────────
 157 ┌ resource "aws_s3_bucket_server_side_encryption_configuration" "default" {
 158 │   bucket = aws_s3_bucket.default.id
 159 │   rule {
 160 │     apply_server_side_encryption_by_default {
 161 │       sse_algorithm     = var.sse_algorithm
 162 │       kms_master_key_id = (var.custom_kms_key != "") ? var.custom_kms_key : ""
 163 │     }
 164 │   }
 165 └ }
────────────────────────────────────────



iam.tf (terraform)
==================
Tests: 6 (SUCCESSES: 0, FAILURES: 0, EXCEPTIONS: 6)
Failures: 0 (HIGH: 0, CRITICAL: 0)


lb.tf (terraform)
=================
Tests: 7 (SUCCESSES: 4, FAILURES: 2, EXCEPTIONS: 1)
Failures: 2 (HIGH: 0, CRITICAL: 2)

CRITICAL: Security group rule allows ingress from public internet.
════════════════════════════════════════
Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.

See https://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
 lb.tf:62-70
   via lb.tf:35-71 (ingress)
    via lb.tf:30-87 (aws_security_group.load_balancer_security_group)
────────────────────────────────────────
  30   resource "aws_security_group" "load_balancer_security_group" {
  ..   
  62 ┌     ipv6_cidr_blocks = [
  63 │       # Route53 Healthcheck Access Cidrs IPv6
  64 │       "2406:da18:7ff:f800::/53",  # ap-southeast-1 Region
  65 │       "2406:da18:fff:f800::/53",  # ap-southeast-1 Region
  66 │       "2a05:d018:fff:f800::/53",  # eu-west-1 Region
  67 │       "2a05:d018:7ff:f800::/53",  # eu-west-1 Region
  68 └       "2600:1f18:7fff:f800::/53", # us-east-1 Region
  ..   
────────────────────────────────────────


CRITICAL: Security group rule allows ingress from public internet.
════════════════════════════════════════
Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.

See https://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
 lb.tf:40-60
   via lb.tf:35-71 (ingress)
    via lb.tf:30-87 (aws_security_group.load_balancer_security_group)
────────────────────────────────────────
  30   resource "aws_security_group" "load_balancer_security_group" {
  ..   
  40 ┌     cidr_blocks = distinct(flatten([
  41 │       "20.49.214.199/32", # Azure Landing Zone Egress
  42 │       "20.49.214.228/32", # Azure Landing Zone Egress
  43 │       "20.26.11.71/32",   # Azure Landing Zone Egress
  44 │       "20.26.11.108/32",  # Azure Landing Zone Egress
  45 │       # Route53 Healthcheck Access Cidrs
  46 └       # London Region not support yet, so metrics are not yet publised, can be enabled at later stage for Route53 endpoint monitor
  ..   
────────────────────────────────────────



monitoring.tf (terraform)
=========================
Tests: 2 (SUCCESSES: 1, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Topic does not have encryption enabled.
════════════════════════════════════════
Topics should be encrypted to protect their contents.

See https://avd.aquasec.com/misconfig/avd-aws-0095
────────────────────────────────────────
 monitoring.tf:6-8
────────────────────────────────────────
   6 ┌ resource "aws_sns_topic" "jitbit_alerting" {
   7 │   name = "jitbit_alerting"
   8 └ }
────────────────────────────────────────



ses-logging.tf (terraform)
==========================
Tests: 4 (SUCCESSES: 1, FAILURES: 1, EXCEPTIONS: 2)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Topic does not have encryption enabled.
════════════════════════════════════════
Topics should be encrypted to protect their contents.

See https://avd.aquasec.com/misconfig/avd-aws-0095
────────────────────────────────────────
 ses-logging.tf:17-21
────────────────────────────────────────
  17 ┌ resource "aws_sns_topic" "jitbit_ses_destination_topic" {
  18 │   name = format("%s-ses-destination-topic", local.application_name)
  19 │ 
  20 │   tags = local.tags
  21 └ }
────────────────────────────────────────



ses.tf (terraform)
==================
Tests: 2 (SUCCESSES: 0, FAILURES: 0, EXCEPTIONS: 2)
Failures: 0 (HIGH: 0, CRITICAL: 0)


ses_bounce.tf (terraform)
=========================
Tests: 6 (SUCCESSES: 2, FAILURES: 1, EXCEPTIONS: 3)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Topic does not have encryption enabled.
════════════════════════════════════════
Topics should be encrypted to protect their contents.

See https://avd.aquasec.com/misconfig/avd-aws-0095
────────────────────────────────────────
 ses_bounce.tf:1-5
────────────────────────────────────────
   1 ┌ resource "aws_sns_topic" "jitbit_ses_destination_topic_bounce_email_notification" {
   2 │   name = format("%s-ses-destination-topic-bounce-email-notification", local.application_name)
   3 │ 
   4 │   tags = local.tags
   5 └ }
────────────────────────────────────────



ses_logging.tf (terraform)
==========================
Tests: 5 (SUCCESSES: 2, FAILURES: 1, EXCEPTIONS: 2)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Topic does not have encryption enabled.
════════════════════════════════════════
Topics should be encrypted to protect their contents.

See https://avd.aquasec.com/misconfig/avd-aws-0095
────────────────────────────────────────
 ses_logging.tf:4-8
────────────────────────────────────────
   4 ┌ resource "aws_sns_topic" "jitbit_ses_destination_topic" {
   5 │   name = format("%s-ses-destination-topic", local.application_name)
   6 │ 
   7 │   tags = local.tags
   8 └ }
────────────────────────────────────────


trivy_exitcode=1

github-actions · 2024-05-10T15:11:00Z

`Trivy Scan` Failed

Show Output

```hcl

Trivy will check the following folders:
terraform/environments/delius-jitbit

Running Trivy in terraform/environments/delius-jitbit
2024-05-10T15:10:48Z INFO Need to update DB
2024-05-10T15:10:48Z INFO Downloading DB... repository="ghcr.io/aquasecurity/trivy-db:2"
2024-05-10T15:10:50Z INFO Vulnerability scanning is enabled
2024-05-10T15:10:50Z INFO Misconfiguration scanning is enabled
2024-05-10T15:10:50Z INFO Need to update the built-in policies
2024-05-10T15:10:50Z INFO Downloading the built-in policies...
50.41 KiB / 50.41 KiB [-----------------------------------------------------------] 100.00% ? p/s 0s2024-05-10T15:10:50Z INFO Secret scanning is enabled
2024-05-10T15:10:50Z INFO If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-05-10T15:10:50Z INFO Please see also https://aquasecurity.github.io/trivy/v0.51/docs/scanner/secret/#recommendation for faster secret detection
2024-05-10T15:10:53Z INFO Number of language-specific files num=0
2024-05-10T15:10:53Z INFO Detected config files num=14

ecs.tf (terraform)

Tests: 2 (SUCCESSES: 1, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 0, CRITICAL: 1)

CRITICAL: Security group rule allows egress to multiple public internet addresses.
════════════════════════════════════════
Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.

See https://avd.aquasec.com/misconfig/avd-aws-0104
────────────────────────────────────────
ecs.tf:70
via ecs.tf:64-72 (aws_security_group_rule.allow_all_egress)
────────────────────────────────────────
64 resource "aws_security_group_rule" "allow_all_egress" {
65 description = "Allow all outbound traffic to any IPv4 address"
66 type = "egress"
67 from_port = 0
68 to_port = 0
69 protocol = "-1"
70 [ cidr_blocks = ["0.0.0.0/0"]
71 security_group_id = aws_security_group.jitbit.id
72 }
────────────────────────────────────────

github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.2.1/main.tf (terraform)

Tests: 7 (SUCCESSES: 5, FAILURES: 0, EXCEPTIONS: 2)
Failures: 0 (HIGH: 0, CRITICAL: 0)

github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0/main.tf (terraform)

Tests: 14 (SUCCESSES: 12, FAILURES: 2, EXCEPTIONS: 0)
Failures: 2 (HIGH: 2, CRITICAL: 0)

HIGH: Bucket does not encrypt data with a customer managed key.
════════════════════════════════════════
Encryption using AWS keys provides protection for your S3 buckets. To increase control of the encryption and manage factors like rotation use customer managed keys.

See https://avd.aquasec.com/misconfig/avd-aws-0132
────────────────────────────────────────
github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0/main.tf:157-165
via s3.tf:1-84 (module.jitbit_bucket)
────────────────────────────────────────
157 ┌ resource "aws_s3_bucket_server_side_encryption_configuration" "default" {
158 │ bucket = aws_s3_bucket.default.id
159 │ rule {
160 │ apply_server_side_encryption_by_default {
161 │ sse_algorithm = var.sse_algorithm
162 │ kms_master_key_id = (var.custom_kms_key != "") ? var.custom_kms_key : ""
163 │ }
164 │ }
165 └ }
────────────────────────────────────────

HIGH: Bucket does not encrypt data with a customer managed key.
════════════════════════════════════════
Encryption using AWS keys provides protection for your S3 buckets. To increase control of the encryption and manage factors like rotation use customer managed keys.

See https://avd.aquasec.com/misconfig/avd-aws-0132
────────────────────────────────────────
github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0/main.tf:157-165
via ecs.tf:11-51 (module.s3_bucket_app_deployment)
────────────────────────────────────────
157 ┌ resource "aws_s3_bucket_server_side_encryption_configuration" "default" {
158 │ bucket = aws_s3_bucket.default.id
159 │ rule {
160 │ apply_server_side_encryption_by_default {
161 │ sse_algorithm = var.sse_algorithm
162 │ kms_master_key_id = (var.custom_kms_key != "") ? var.custom_kms_key : ""
163 │ }
164 │ }
165 └ }
────────────────────────────────────────

iam.tf (terraform)

Tests: 6 (SUCCESSES: 0, FAILURES: 0, EXCEPTIONS: 6)
Failures: 0 (HIGH: 0, CRITICAL: 0)

lb.tf (terraform)

Tests: 7 (SUCCESSES: 4, FAILURES: 2, EXCEPTIONS: 1)
Failures: 2 (HIGH: 0, CRITICAL: 2)

CRITICAL: Security group rule allows ingress from public internet.
════════════════════════════════════════
Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.

See https://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
lb.tf:62-70
via lb.tf:35-71 (ingress)
via lb.tf:30-87 (aws_security_group.load_balancer_security_group)
────────────────────────────────────────
30 resource "aws_security_group" "load_balancer_security_group" {
..
62 ┌ ipv6_cidr_blocks = [
63 │ # Route53 Healthcheck Access Cidrs IPv6
64 │ "2406:da18:7ff:f800::/53", # ap-southeast-1 Region
65 │ "2406:da18:fff:f800::/53", # ap-southeast-1 Region
66 │ "2a05:d018:fff:f800::/53", # eu-west-1 Region
67 │ "2a05:d018:7ff:f800::/53", # eu-west-1 Region
68 └ "2600:1f18:7fff:f800::/53", # us-east-1 Region
..
────────────────────────────────────────

CRITICAL: Security group rule allows ingress from public internet.
════════════════════════════════════════
Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.

See https://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
lb.tf:40-60
via lb.tf:35-71 (ingress)
via lb.tf:30-87 (aws_security_group.load_balancer_security_group)
────────────────────────────────────────
30 resource "aws_security_group" "load_balancer_security_group" {
..
40 ┌ cidr_blocks = distinct(flatten([
41 │ "20.49.214.199/32", # Azure Landing Zone Egress
42 │ "20.49.214.228/32", # Azure Landing Zone Egress
43 │ "20.26.11.71/32", # Azure Landing Zone Egress
44 │ "20.26.11.108/32", # Azure Landing Zone Egress
45 │ # Route53 Healthcheck Access Cidrs
46 └ # London Region not support yet, so metrics are not yet publised, can be enabled at later stage for Route53 endpoint monitor
..
────────────────────────────────────────

monitoring.tf (terraform)

Tests: 2 (SUCCESSES: 1, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Topic does not have encryption enabled.
════════════════════════════════════════
Topics should be encrypted to protect their contents.

See https://avd.aquasec.com/misconfig/avd-aws-0095
────────────────────────────────────────
monitoring.tf:6-8
────────────────────────────────────────
6 ┌ resource "aws_sns_topic" "jitbit_alerting" {
7 │ name = "jitbit_alerting"
8 └ }
────────────────────────────────────────

ses.tf (terraform)

Tests: 2 (SUCCESSES: 0, FAILURES: 0, EXCEPTIONS: 2)
Failures: 0 (HIGH: 0, CRITICAL: 0)

ses_bounce.tf (terraform)

Tests: 6 (SUCCESSES: 2, FAILURES: 1, EXCEPTIONS: 3)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Topic does not have encryption enabled.
════════════════════════════════════════
Topics should be encrypted to protect their contents.

See https://avd.aquasec.com/misconfig/avd-aws-0095
────────────────────────────────────────
ses_bounce.tf:1-5
────────────────────────────────────────
1 ┌ resource "aws_sns_topic" "jitbit_ses_destination_topic_bounce_email_notification" {
2 │ name = format("%s-ses-destination-topic-bounce-email-notification", local.application_name)
3 │
4 │ tags = local.tags
5 └ }
────────────────────────────────────────

trivy_exitcode=1

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/delius-jitbit

*****************************

Running Checkov in terraform/environments/delius-jitbit
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2024-05-10 15:10:57,094 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0:None (for external modules, the --download-external-modules flag is required)
2024-05-10 15:10:57,094 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.1.0:None (for external modules, the --download-external-modules flag is required)
2024-05-10 15:10:57,094 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-ecs-cluster//cluster?ref=v2.0.1:None (for external modules, the --download-external-modules flag is required)
2024-05-10 15:10:57,094 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-pagerduty-integration?ref=v2.0.0:None (for external modules, the --download-external-modules flag is required)
2024-05-10 15:10:57,094 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.2.1:None (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 245, Failed checks: 50, Skipped checks: 20

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: bastion_linux
	File: /bastion_linux.tf:6-41
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		6  | module "bastion_linux" {
		7  |   source = "github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.2.1"
		8  | 
		9  |   providers = {
		10 |     aws.share-host   = aws.core-vpc # core-vpc-(environment) holds the networking for all accounts
		11 |     aws.share-tenant = aws          # The default provider (unaliased, `aws`) is the tenant
		12 |   }
		13 | 
		14 |   # s3 - used for logs and user ssh public keys
		15 |   bucket_name = "bastion"
		16 |   # public keys
		17 |   public_key_data = local.public_key_data.keys[local.environment]
		18 |   # logs
		19 |   log_auto_clean       = "Enabled"
		20 |   log_standard_ia_days = 30  # days before moving to IA storage
		21 |   log_glacier_days     = 60  # days before moving to Glacier
		22 |   log_expiry_days      = 180 # days before log expiration
		23 |   # bastion
		24 |   allow_ssh_commands = false
		25 | 
		26 |   app_name      = var.networking[0].application
		27 |   business_unit = local.vpc_name
		28 |   subnet_set    = local.subnet_set
		29 |   environment   = local.environment
		30 |   region        = "eu-west-2"
		31 | 
		32 |   # custom scaling schedule
		33 |   autoscaling_cron = {
		34 |     "down" : "0 21 * * *",
		35 |     "up" : "0 05 * * *"
		36 |   }
		37 | 
		38 |   # Tags
		39 |   tags_common = local.tags
		40 |   tags_prefix = terraform.workspace
		41 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.jitbit
	File: /ecs.tf:84-87
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		84 | resource "aws_cloudwatch_log_group" "jitbit" {
		85 |   name              = format("%s-ecs", local.application_name)
		86 |   retention_in_days = 30
		87 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.jitbit
	File: /ecs.tf:84-87
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		84 | resource "aws_cloudwatch_log_group" "jitbit" {
		85 |   name              = format("%s-ecs", local.application_name)
		86 |   retention_in_days = 30
		87 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: ecs
	File: /ecs.tf:1-8
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		1 | module "ecs" {
		2 |   source = "github.com/ministryofjustice/modernisation-platform-terraform-ecs-cluster//cluster?ref=v2.0.1"
		3 | 
		4 |   environment = local.environment
		5 |   name        = local.application_name
		6 | 
		7 |   tags = local.tags
		8 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: s3_bucket_app_deployment
	File: /ecs.tf:11-51
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		11 | module "s3_bucket_app_deployment" {
		12 | 
		13 |   source = "github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0"
		14 | 
		15 |   providers = {
		16 |     aws.bucket-replication = aws
		17 |   }
		18 |   bucket_name        = "${local.application_name}-${local.environment}-deployment"
		19 |   versioning_enabled = true
		20 | 
		21 |   ownership_controls = "BucketOwnerEnforced"
		22 | 
		23 |   lifecycle_rule = [
		24 |     {
		25 |       id      = "main"
		26 |       enabled = "Enabled"
		27 |       prefix  = ""
		28 | 
		29 |       tags = {
		30 |         rule      = "log"
		31 |         autoclean = "true"
		32 |       }
		33 | 
		34 |       noncurrent_version_transition = [
		35 |         {
		36 |           days          = 90
		37 |           storage_class = "STANDARD_IA"
		38 |           }, {
		39 |           days          = 365
		40 |           storage_class = "GLACIER"
		41 |         }
		42 |       ]
		43 | 
		44 |       noncurrent_version_expiration = {
		45 |         days = 730
		46 |       }
		47 |     }
		48 |   ]
		49 | 
		50 |   tags = local.tags
		51 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.ecs_service_policy
	File: /iam.tf:37-52
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		37 | data "aws_iam_policy_document" "ecs_service_policy" {
		38 |   statement {
		39 |     effect    = "Allow"
		40 |     resources = ["*"]
		41 | 
		42 |     actions = [
		43 |       "elasticloadbalancing:Describe*",
		44 |       "elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
		45 |       "elasticloadbalancing:RegisterInstancesWithLoadBalancer",
		46 |       "ec2:Describe*",
		47 |       "ec2:AuthorizeSecurityGroupIngress",
		48 |       "elasticloadbalancing:RegisterTargets",
		49 |       "elasticloadbalancing:DeregisterTargets"
		50 |     ]
		51 |   }
		52 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.ecs_service_policy
	File: /iam.tf:37-52
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		37 | data "aws_iam_policy_document" "ecs_service_policy" {
		38 |   statement {
		39 |     effect    = "Allow"
		40 |     resources = ["*"]
		41 | 
		42 |     actions = [
		43 |       "elasticloadbalancing:Describe*",
		44 |       "elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
		45 |       "elasticloadbalancing:RegisterInstancesWithLoadBalancer",
		46 |       "ec2:Describe*",
		47 |       "ec2:AuthorizeSecurityGroupIngress",
		48 |       "elasticloadbalancing:RegisterTargets",
		49 |       "elasticloadbalancing:DeregisterTargets"
		50 |     ]
		51 |   }
		52 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.ecs_exec
	File: /iam.tf:98-114
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		98  | data "aws_iam_policy_document" "ecs_exec" {
		99  |   statement {
		100 |     effect    = "Allow"
		101 |     resources = ["*"]
		102 | 
		103 |     actions = [
		104 |       "ssm:GetParameters",
		105 |       "ecr:GetAuthorizationToken",
		106 |       "ecr:BatchCheckLayerAvailability",
		107 |       "ecr:GetDownloadUrlForLayer",
		108 |       "ecr:BatchGetImage",
		109 |       "logs:CreateLogGroup",
		110 |       "logs:CreateLogStream",
		111 |       "logs:PutLogEvents"
		112 |     ]
		113 |   }
		114 | }

Check: CKV_AWS_108: "Ensure IAM policies does not allow data exfiltration"
	FAILED for resource: aws_iam_policy_document.ecs_exec
	File: /iam.tf:98-114
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-data-exfiltration

		98  | data "aws_iam_policy_document" "ecs_exec" {
		99  |   statement {
		100 |     effect    = "Allow"
		101 |     resources = ["*"]
		102 | 
		103 |     actions = [
		104 |       "ssm:GetParameters",
		105 |       "ecr:GetAuthorizationToken",
		106 |       "ecr:BatchCheckLayerAvailability",
		107 |       "ecr:GetDownloadUrlForLayer",
		108 |       "ecr:BatchGetImage",
		109 |       "logs:CreateLogGroup",
		110 |       "logs:CreateLogStream",
		111 |       "logs:PutLogEvents"
		112 |     ]
		113 |   }
		114 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.ecs_exec
	File: /iam.tf:98-114
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		98  | data "aws_iam_policy_document" "ecs_exec" {
		99  |   statement {
		100 |     effect    = "Allow"
		101 |     resources = ["*"]
		102 | 
		103 |     actions = [
		104 |       "ssm:GetParameters",
		105 |       "ecr:GetAuthorizationToken",
		106 |       "ecr:BatchCheckLayerAvailability",
		107 |       "ecr:GetDownloadUrlForLayer",
		108 |       "ecr:BatchGetImage",
		109 |       "logs:CreateLogGroup",
		110 |       "logs:CreateLogStream",
		111 |       "logs:PutLogEvents"
		112 |     ]
		113 |   }
		114 | }

Check: CKV_AWS_26: "Ensure all data stored in the SNS topic is encrypted"
	FAILED for resource: aws_sns_topic.jitbit_alerting
	File: /monitoring.tf:6-8
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-15

		6 | resource "aws_sns_topic" "jitbit_alerting" {
		7 |   name = "jitbit_alerting"
		8 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: pagerduty_core_alerts
	File: /monitoring.tf:37-44
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		37 | module "pagerduty_core_alerts" {
		38 |   depends_on = [
		39 |     aws_sns_topic.jitbit_alerting
		40 |   ]
		41 |   source                    = "github.com/ministryofjustice/modernisation-platform-terraform-pagerduty-integration?ref=v2.0.0"
		42 |   sns_topics                = [aws_sns_topic.jitbit_alerting.name]
		43 |   pagerduty_integration_key = local.pagerduty_integration_key
		44 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.app_logs
	File: /monitoring_app.tf:1-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		1 | resource "aws_cloudwatch_log_group" "app_logs" {
		2 |   name              = "delius-jitbit-ecs"
		3 |   retention_in_days = 30
		4 | 
		5 |   tags = local.tags
		6 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.app_logs
	File: /monitoring_app.tf:1-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		1 | resource "aws_cloudwatch_log_group" "app_logs" {
		2 |   name              = "delius-jitbit-ecs"
		3 |   retention_in_days = 30
		4 | 
		5 |   tags = local.tags
		6 | }

Check: CKV_AWS_354: "Ensure RDS Performance Insights are encrypted using KMS CMKs"
	FAILED for resource: aws_db_instance.jitbit
	File: /rds.tf:40-83
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-354

		40 | resource "aws_db_instance" "jitbit" {
		41 |   engine         = "sqlserver-se"
		42 |   license_model  = "license-included"
		43 |   engine_version = local.application_data.accounts[local.environment].db_engine_version
		44 |   instance_class = local.application_data.accounts[local.environment].db_instance_class
		45 |   identifier     = "${local.application_name}-${local.environment}-database"
		46 |   username       = local.application_data.accounts[local.environment].db_user
		47 | 
		48 |   manage_master_user_password = true
		49 | 
		50 |   snapshot_identifier = try(local.application_data.accounts[local.environment].db_snapshot_identifier, null)
		51 | 
		52 |   # tflint-ignore: aws_db_instance_default_parameter_group
		53 |   parameter_group_name        = "default.sqlserver-se-15.0"
		54 |   deletion_protection         = local.application_data.accounts[local.environment].db_deletion_protection
		55 |   delete_automated_backups    = local.application_data.accounts[local.environment].db_delete_automated_backups
		56 |   skip_final_snapshot         = local.skip_final_snapshot
		57 |   final_snapshot_identifier   = !local.skip_final_snapshot ? "${local.application_name}-${local.environment}-database-final-snapshot" : null
		58 |   allocated_storage           = local.application_data.accounts[local.environment].db_allocated_storage
		59 |   max_allocated_storage       = local.application_data.accounts[local.environment].db_max_allocated_storage
		60 |   storage_type                = local.application_data.accounts[local.environment].db_storage_type
		61 |   maintenance_window          = local.application_data.accounts[local.environment].db_maintenance_window
		62 |   auto_minor_version_upgrade  = local.application_data.accounts[local.environment].db_auto_minor_version_upgrade
		63 |   allow_major_version_upgrade = local.application_data.accounts[local.environment].db_allow_major_version_upgrade
		64 |   backup_window               = local.application_data.accounts[local.environment].db_backup_window
		65 |   backup_retention_period     = local.application_data.accounts[local.environment].db_retention_period
		66 |   #checkov:skip=CKV_AWS_133: "backup_retention enabled, can be edited it application_variables.json"
		67 |   iam_database_authentication_enabled = local.application_data.accounts[local.environment].db_iam_database_authentication_enabled
		68 |   #checkov:skip=CKV_AWS_161: "iam auth enabled, but optional"
		69 |   db_subnet_group_name   = aws_db_subnet_group.jitbit.id
		70 |   vpc_security_group_ids = [aws_security_group.database_security_group.id]
		71 |   multi_az               = local.application_data.accounts[local.environment].db_multi_az
		72 |   #checkov:skip=CKV_AWS_157: "multi-az enabled, but optional"
		73 |   monitoring_interval = local.application_data.accounts[local.environment].db_monitoring_interval
		74 |   monitoring_role_arn = local.application_data.accounts[local.environment].db_monitoring_interval == 0 ? "" : aws_iam_role.rds_enhanced_monitoring[0].arn
		75 |   #checkov:skip=CKV_AWS_118: "enhanced monitoring is enabled, but optional"
		76 |   storage_encrypted               = true
		77 |   performance_insights_enabled    = local.application_data.accounts[local.environment].db_performance_insights_enabled
		78 |   performance_insights_kms_key_id = "" #tfsec:ignore:aws-rds-enable-performance-insights-encryption Left empty so that it will run, however should be populated with real key in scenario.
		79 |   enabled_cloudwatch_logs_exports = local.application_data.accounts[local.environment].db_enabled_cloudwatch_logs_exports
		80 |   tags = merge(local.tags,
		81 |     { Name = lower(format("%s-%s-database", local.application_name, local.environment)) }
		82 |   )
		83 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: jitbit_bucket
	File: /s3.tf:1-84
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.jitbit_sandbox
	File: /sandbox_ecs.tf:92-97
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		92 | resource "aws_cloudwatch_log_group" "jitbit_sandbox" {
		93 |   count = local.is-development ? 1 : 0
		94 | 
		95 |   name              = format("%s-%s-ecs", local.application_name, "sandbox")
		96 |   retention_in_days = 30
		97 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.jitbit_sandbox
	File: /sandbox_ecs.tf:92-97
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		92 | resource "aws_cloudwatch_log_group" "jitbit_sandbox" {
		93 |   count = local.is-development ? 1 : 0
		94 | 
		95 |   name              = format("%s-%s-ecs", local.application_name, "sandbox")
		96 |   retention_in_days = 30
		97 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: ecs_sandbox
	File: /sandbox_ecs.tf:1-10
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		1  | module "ecs_sandbox" {
		2  |   count = local.is-development ? 1 : 0
		3  | 
		4  |   source = "github.com/ministryofjustice/modernisation-platform-terraform-ecs-cluster//cluster?ref=v2.0.1"
		5  | 
		6  |   environment = local.environment
		7  |   name        = "${local.application_name}-sandbox"
		8  | 
		9  |   tags = local.tags
		10 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: s3_bucket_app_deployment_sandbox
	File: /sandbox_ecs.tf:12-53
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		12 | module "s3_bucket_app_deployment_sandbox" {
		13 |   count = local.is-development ? 1 : 0
		14 | 
		15 |   source = "github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0"
		16 | 
		17 |   providers = {
		18 |     aws.bucket-replication = aws
		19 |   }
		20 |   bucket_name        = "${local.application_name}-sandbox-deployment"
		21 |   versioning_enabled = true
		22 | 
		23 |   ownership_controls = "BucketOwnerEnforced"
		24 | 
		25 |   lifecycle_rule = [
		26 |     {
		27 |       id      = "main"
		28 |       enabled = "Enabled"
		29 |       prefix  = ""
		30 | 
		31 |       tags = {
		32 |         rule      = "log"
		33 |         autoclean = "true"
		34 |       }
		35 | 
		36 |       noncurrent_version_transition = [
		37 |         {
		38 |           days          = 90
		39 |           storage_class = "STANDARD_IA"
		40 |           }, {
		41 |           days          = 365
		42 |           storage_class = "GLACIER"
		43 |         }
		44 |       ]
		45 | 
		46 |       noncurrent_version_expiration = {
		47 |         days = 730
		48 |       }
		49 |     }
		50 |   ]
		51 | 
		52 |   tags = local.tags
		53 | }

Check: CKV_AWS_150: "Ensure that Load Balancer has deletion protection enabled"
	FAILED for resource: aws_lb.external_sandbox
	File: /sandbox_lb.tf:2-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-150

		2  | resource "aws_lb" "external_sandbox" {
		3  |   # checkov:skip=CKV_AWS_91
		4  |   # checkov:skip=CKV2_AWS_28
		5  | 
		6  |   count = local.is-development ? 1 : 0
		7  | 
		8  |   name               = "${local.application_name}-lb-sandbox"
		9  |   internal           = false
		10 |   load_balancer_type = "application"
		11 |   security_groups    = [aws_security_group.load_balancer_security_group_sandbox[0].id]
		12 |   subnets            = data.aws_subnets.shared-public.ids
		13 | 
		14 |   drop_invalid_header_fields = true
		15 | 
		16 |   tags = merge(
		17 |     local.tags,
		18 |     {
		19 |       Name = "${local.application_name}-sandbox"
		20 |     }
		21 |   )
		22 | }

Check: CKV_AWS_118: "Ensure that enhanced monitoring is enabled for Amazon RDS instances"
	FAILED for resource: aws_db_instance.jitbit_sandbox
	File: /sandbox_rds.tf:27-70
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/ensure-that-enhanced-monitoring-is-enabled-for-amazon-rds-instances

		27 | resource "aws_db_instance" "jitbit_sandbox" {
		28 |   count = local.is-development ? 1 : 0
		29 | 
		30 |   engine         = "sqlserver-se"
		31 |   license_model  = "license-included"
		32 |   engine_version = local.application_data.accounts["sandbox"].db_engine_version
		33 |   instance_class = local.application_data.accounts["sandbox"].db_instance_class
		34 |   identifier     = "${local.application_name}-sandbox-database"
		35 |   username       = local.application_data.accounts["sandbox"].db_user
		36 | 
		37 |   manage_master_user_password = true
		38 | 
		39 |   snapshot_identifier = try(local.application_data.accounts["sandbox"].db_snapshot_identifier, null)
		40 | 
		41 |   # tflint-ignore: aws_db_instance_default_parameter_group
		42 |   parameter_group_name        = "default.sqlserver-se-15.0"
		43 |   deletion_protection         = local.application_data.accounts["sandbox"].db_deletion_protection
		44 |   delete_automated_backups    = local.application_data.accounts["sandbox"].db_delete_automated_backups
		45 |   skip_final_snapshot         = local.application_data.accounts["sandbox"].db_skip_final_snapshot
		46 |   final_snapshot_identifier   = !local.skip_final_snapshot ? "${local.application_name}-sandbox-database-final-snapshot" : null
		47 |   allocated_storage           = local.application_data.accounts["sandbox"].db_allocated_storage
		48 |   max_allocated_storage       = local.application_data.accounts["sandbox"].db_max_allocated_storage
		49 |   storage_type                = local.application_data.accounts["sandbox"].db_storage_type
		50 |   maintenance_window          = local.application_data.accounts["sandbox"].db_maintenance_window
		51 |   auto_minor_version_upgrade  = local.application_data.accounts["sandbox"].db_auto_minor_version_upgrade
		52 |   allow_major_version_upgrade = local.application_data.accounts["sandbox"].db_allow_major_version_upgrade
		53 |   backup_window               = local.application_data.accounts["sandbox"].db_backup_window
		54 |   backup_retention_period     = local.application_data.accounts["sandbox"].db_retention_period
		55 |   #checkov:skip=CKV_AWS_133: "backup_retention enabled, can be edited it application_variables.json"
		56 |   iam_database_authentication_enabled = local.application_data.accounts["sandbox"].db_iam_database_authentication_enabled
		57 |   #checkov:skip=CKV_AWS_161: "iam auth enabled, but optional"
		58 |   db_subnet_group_name   = aws_db_subnet_group.jitbit.id
		59 |   vpc_security_group_ids = [aws_security_group.database_security_group_sandbox[0].id]
		60 |   multi_az               = local.application_data.accounts["sandbox"].db_multi_az
		61 |   #checkov:skip=CKV_AWS_157: "multi-az enabled, but optional"
		62 |   storage_encrypted = true
		63 | 
		64 |   tags = merge(
		65 |     local.tags,
		66 |     {
		67 |       Name = lower(format("%s-%s-database", local.application_name, "sandbox"))
		68 |     }
		69 |   )
		70 | }

Check: CKV_AWS_129: "Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled"
	FAILED for resource: aws_db_instance.jitbit_sandbox
	File: /sandbox_rds.tf:27-70
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-that-respective-logs-of-amazon-relational-database-service-amazon-rds-are-enabled

		27 | resource "aws_db_instance" "jitbit_sandbox" {
		28 |   count = local.is-development ? 1 : 0
		29 | 
		30 |   engine         = "sqlserver-se"
		31 |   license_model  = "license-included"
		32 |   engine_version = local.application_data.accounts["sandbox"].db_engine_version
		33 |   instance_class = local.application_data.accounts["sandbox"].db_instance_class
		34 |   identifier     = "${local.application_name}-sandbox-database"
		35 |   username       = local.application_data.accounts["sandbox"].db_user
		36 | 
		37 |   manage_master_user_password = true
		38 | 
		39 |   snapshot_identifier = try(local.application_data.accounts["sandbox"].db_snapshot_identifier, null)
		40 | 
		41 |   # tflint-ignore: aws_db_instance_default_parameter_group
		42 |   parameter_group_name        = "default.sqlserver-se-15.0"
		43 |   deletion_protection         = local.application_data.accounts["sandbox"].db_deletion_protection
		44 |   delete_automated_backups    = local.application_data.accounts["sandbox"].db_delete_automated_backups
		45 |   skip_final_snapshot         = local.application_data.accounts["sandbox"].db_skip_final_snapshot
		46 |   final_snapshot_identifier   = !local.skip_final_snapshot ? "${local.application_name}-sandbox-database-final-snapshot" : null
		47 |   allocated_storage           = local.application_data.accounts["sandbox"].db_allocated_storage
		48 |   max_allocated_storage       = local.application_data.accounts["sandbox"].db_max_allocated_storage
		49 |   storage_type                = local.application_data.accounts["sandbox"].db_storage_type
		50 |   maintenance_window          = local.application_data.accounts["sandbox"].db_maintenance_window
		51 |   auto_minor_version_upgrade  = local.application_data.accounts["sandbox"].db_auto_minor_version_upgrade
		52 |   allow_major_version_upgrade = local.application_data.accounts["sandbox"].db_allow_major_version_upgrade
		53 |   backup_window               = local.application_data.accounts["sandbox"].db_backup_window
		54 |   backup_retention_period     = local.application_data.accounts["sandbox"].db_retention_period
		55 |   #checkov:skip=CKV_AWS_133: "backup_retention enabled, can be edited it application_variables.json"
		56 |   iam_database_authentication_enabled = local.application_data.accounts["sandbox"].db_iam_database_authentication_enabled
		57 |   #checkov:skip=CKV_AWS_161: "iam auth enabled, but optional"
		58 |   db_subnet_group_name   = aws_db_subnet_group.jitbit.id
		59 |   vpc_security_group_ids = [aws_security_group.database_security_group_sandbox[0].id]
		60 |   multi_az               = local.application_data.accounts["sandbox"].db_multi_az
		61 |   #checkov:skip=CKV_AWS_157: "multi-az enabled, but optional"
		62 |   storage_encrypted = true
		63 | 
		64 |   tags = merge(
		65 |     local.tags,
		66 |     {
		67 |       Name = lower(format("%s-%s-database", local.application_name, "sandbox"))
		68 |     }
		69 |   )
		70 | }

Check: CKV_AWS_354: "Ensure RDS Performance Insights are encrypted using KMS CMKs"
	FAILED for resource: aws_db_instance.jitbit_sandbox
	File: /sandbox_rds.tf:27-70
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-354

		27 | resource "aws_db_instance" "jitbit_sandbox" {
		28 |   count = local.is-development ? 1 : 0
		29 | 
		30 |   engine         = "sqlserver-se"
		31 |   license_model  = "license-included"
		32 |   engine_version = local.application_data.accounts["sandbox"].db_engine_version
		33 |   instance_class = local.application_data.accounts["sandbox"].db_instance_class
		34 |   identifier     = "${local.application_name}-sandbox-database"
		35 |   username       = local.application_data.accounts["sandbox"].db_user
		36 | 
		37 |   manage_master_user_password = true
		38 | 
		39 |   snapshot_identifier = try(local.application_data.accounts["sandbox"].db_snapshot_identifier, null)
		40 | 
		41 |   # tflint-ignore: aws_db_instance_default_parameter_group
		42 |   parameter_group_name        = "default.sqlserver-se-15.0"
		43 |   deletion_protection         = local.application_data.accounts["sandbox"].db_deletion_protection
		44 |   delete_automated_backups    = local.application_data.accounts["sandbox"].db_delete_automated_backups
		45 |   skip_final_snapshot         = local.application_data.accounts["sandbox"].db_skip_final_snapshot
		46 |   final_snapshot_identifier   = !local.skip_final_snapshot ? "${local.application_name}-sandbox-database-final-snapshot" : null
		47 |   allocated_storage           = local.application_data.accounts["sandbox"].db_allocated_storage
		48 |   max_allocated_storage       = local.application_data.accounts["sandbox"].db_max_allocated_storage
		49 |   storage_type                = local.application_data.accounts["sandbox"].db_storage_type
		50 |   maintenance_window          = local.application_data.accounts["sandbox"].db_maintenance_window
		51 |   auto_minor_version_upgrade  = local.application_data.accounts["sandbox"].db_auto_minor_version_upgrade
		52 |   allow_major_version_upgrade = local.application_data.accounts["sandbox"].db_allow_major_version_upgrade
		53 |   backup_window               = local.application_data.accounts["sandbox"].db_backup_window
		54 |   backup_retention_period     = local.application_data.accounts["sandbox"].db_retention_period
		55 |   #checkov:skip=CKV_AWS_133: "backup_retention enabled, can be edited it application_variables.json"
		56 |   iam_database_authentication_enabled = local.application_data.accounts["sandbox"].db_iam_database_authentication_enabled
		57 |   #checkov:skip=CKV_AWS_161: "iam auth enabled, but optional"
		58 |   db_subnet_group_name   = aws_db_subnet_group.jitbit.id
		59 |   vpc_security_group_ids = [aws_security_group.database_security_group_sandbox[0].id]
		60 |   multi_az               = local.application_data.accounts["sandbox"].db_multi_az
		61 |   #checkov:skip=CKV_AWS_157: "multi-az enabled, but optional"
		62 |   storage_encrypted = true
		63 | 
		64 |   tags = merge(
		65 |     local.tags,
		66 |     {
		67 |       Name = lower(format("%s-%s-database", local.application_name, "sandbox"))
		68 |     }
		69 |   )
		70 | }

Check: CKV_AWS_353: "Ensure that RDS instances have performance insights enabled"
	FAILED for resource: aws_db_instance.jitbit_sandbox
	File: /sandbox_rds.tf:27-70
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-353

		27 | resource "aws_db_instance" "jitbit_sandbox" {
		28 |   count = local.is-development ? 1 : 0
		29 | 
		30 |   engine         = "sqlserver-se"
		31 |   license_model  = "license-included"
		32 |   engine_version = local.application_data.accounts["sandbox"].db_engine_version
		33 |   instance_class = local.application_data.accounts["sandbox"].db_instance_class
		34 |   identifier     = "${local.application_name}-sandbox-database"
		35 |   username       = local.application_data.accounts["sandbox"].db_user
		36 | 
		37 |   manage_master_user_password = true
		38 | 
		39 |   snapshot_identifier = try(local.application_data.accounts["sandbox"].db_snapshot_identifier, null)
		40 | 
		41 |   # tflint-ignore: aws_db_instance_default_parameter_group
		42 |   parameter_group_name        = "default.sqlserver-se-15.0"
		43 |   deletion_protection         = local.application_data.accounts["sandbox"].db_deletion_protection
		44 |   delete_automated_backups    = local.application_data.accounts["sandbox"].db_delete_automated_backups
		45 |   skip_final_snapshot         = local.application_data.accounts["sandbox"].db_skip_final_snapshot
		46 |   final_snapshot_identifier   = !local.skip_final_snapshot ? "${local.application_name}-sandbox-database-final-snapshot" : null
		47 |   allocated_storage           = local.application_data.accounts["sandbox"].db_allocated_storage
		48 |   max_allocated_storage       = local.application_data.accounts["sandbox"].db_max_allocated_storage
		49 |   storage_type                = local.application_data.accounts["sandbox"].db_storage_type
		50 |   maintenance_window          = local.application_data.accounts["sandbox"].db_maintenance_window
		51 |   auto_minor_version_upgrade  = local.application_data.accounts["sandbox"].db_auto_minor_version_upgrade
		52 |   allow_major_version_upgrade = local.application_data.accounts["sandbox"].db_allow_major_version_upgrade
		53 |   backup_window               = local.application_data.accounts["sandbox"].db_backup_window
		54 |   backup_retention_period     = local.application_data.accounts["sandbox"].db_retention_period
		55 |   #checkov:skip=CKV_AWS_133: "backup_retention enabled, can be edited it application_variables.json"
		56 |   iam_database_authentication_enabled = local.application_data.accounts["sandbox"].db_iam_database_authentication_enabled
		57 |   #checkov:skip=CKV_AWS_161: "iam auth enabled, but optional"
		58 |   db_subnet_group_name   = aws_db_subnet_group.jitbit.id
		59 |   vpc_security_group_ids = [aws_security_group.database_security_group_sandbox[0].id]
		60 |   multi_az               = local.application_data.accounts["sandbox"].db_multi_az
		61 |   #checkov:skip=CKV_AWS_157: "multi-az enabled, but optional"
		62 |   storage_encrypted = true
		63 | 
		64 |   tags = merge(
		65 |     local.tags,
		66 |     {
		67 |       Name = lower(format("%s-%s-database", local.application_name, "sandbox"))
		68 |     }
		69 |   )
		70 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: jitbit_bucket_sandbox
	File: /sandbox_s3.tf:1-86
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_273: "Ensure access is controlled through SSO and not AWS IAM defined users"
	FAILED for resource: aws_iam_user.jitbit_ses_smtp_user
	File: /ses.tf:54-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-273

		54 | resource "aws_iam_user" "jitbit_ses_smtp_user" {
		55 |   name = "${local.environment}-jitbit-smtp-user"
		56 | }

Check: CKV_AWS_290: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_user_policy.jitbit_ses_smtp_user
	File: /ses.tf:62-79
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-290

		62 | resource "aws_iam_user_policy" "jitbit_ses_smtp_user" {
		63 |   name = "${local.environment}-jitbit-ses-smtp-user-policy"
		64 |   user = aws_iam_user.jitbit_ses_smtp_user.name
		65 | 
		66 |   policy = jsonencode({
		67 |     Version = "2012-10-17",
		68 |     Statement = [
		69 |       {
		70 |         Effect = "Allow",
		71 |         Action = [
		72 |           "ses:SendRawEmail",
		73 |           "ses:SendEmail"
		74 |         ],
		75 |         Resource = "*"
		76 |       }
		77 |     ]
		78 |   })
		79 | }

Check: CKV_AWS_355: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_user_policy.jitbit_ses_smtp_user
	File: /ses.tf:62-79
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-355

		62 | resource "aws_iam_user_policy" "jitbit_ses_smtp_user" {
		63 |   name = "${local.environment}-jitbit-ses-smtp-user-policy"
		64 |   user = aws_iam_user.jitbit_ses_smtp_user.name
		65 | 
		66 |   policy = jsonencode({
		67 |     Version = "2012-10-17",
		68 |     Statement = [
		69 |       {
		70 |         Effect = "Allow",
		71 |         Action = [
		72 |           "ses:SendRawEmail",
		73 |           "ses:SendEmail"
		74 |         ],
		75 |         Resource = "*"
		76 |       }
		77 |     ]
		78 |   })
		79 | }

Check: CKV_AWS_337: "Ensure SSM parameters are using KMS CMK"
	FAILED for resource: aws_ssm_parameter.jitbit_ses_smtp_user
	File: /ses.tf:81-91
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-337

		81 | resource "aws_ssm_parameter" "jitbit_ses_smtp_user" {
		82 |   name = "/${local.environment}/jitbit/ses_smtp"
		83 |   type = "SecureString"
		84 |   value = jsonencode({
		85 |     user              = aws_iam_user.jitbit_ses_smtp_user.name,
		86 |     key               = aws_iam_access_key.jitbit_ses_smtp_user.id,
		87 |     secret            = aws_iam_access_key.jitbit_ses_smtp_user.secret
		88 |     ses_smtp_user     = aws_iam_access_key.jitbit_ses_smtp_user.id
		89 |     ses_smtp_password = aws_iam_access_key.jitbit_ses_smtp_user.ses_smtp_password_v4
		90 |   })
		91 | }

Check: CKV_AWS_26: "Ensure all data stored in the SNS topic is encrypted"
	FAILED for resource: aws_sns_topic.jitbit_ses_destination_topic_bounce_email_notification
	File: /ses_bounce.tf:1-5
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-15

		1 | resource "aws_sns_topic" "jitbit_ses_destination_topic_bounce_email_notification" {
		2 |   name = format("%s-ses-destination-topic-bounce-email-notification", local.application_name)
		3 | 
		4 |   tags = local.tags
		5 | }

Check: CKV_AWS_115: "Ensure that AWS Lambda function is configured for function-level concurrent execution limit"
	FAILED for resource: aws_lambda_function.bounce_email_notification
	File: /ses_bounce.tf:29-43
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-function-level-concurrent-execution-limit

		29 | resource "aws_lambda_function" "bounce_email_notification" {
		30 |   filename         = "${path.module}/lambda/bounce_email_notification/bounce_email_notification.zip"
		31 |   function_name    = "bounce_email_notification"
		32 |   architectures    = ["arm64"]
		33 |   role             = aws_iam_role.lambda_bounce_email_notification.arn
		34 |   runtime          = "python3.12"
		35 |   handler          = "bounce_email_notification.handler"
		36 |   source_code_hash = data.archive_file.lambda_function_payload_bounce_email_notification.output_base64sha256
		37 | 
		38 |   lifecycle {
		39 |     replace_triggered_by = [aws_iam_role.lambda_bounce_email_notification]
		40 |   }
		41 | 
		42 |   tags = local.tags
		43 | }

Check: CKV_AWS_272: "Ensure AWS Lambda function is configured to validate code-signing"
	FAILED for resource: aws_lambda_function.bounce_email_notification
	File: /ses_bounce.tf:29-43
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-272

		29 | resource "aws_lambda_function" "bounce_email_notification" {
		30 |   filename         = "${path.module}/lambda/bounce_email_notification/bounce_email_notification.zip"
		31 |   function_name    = "bounce_email_notification"
		32 |   architectures    = ["arm64"]
		33 |   role             = aws_iam_role.lambda_bounce_email_notification.arn
		34 |   runtime          = "python3.12"
		35 |   handler          = "bounce_email_notification.handler"
		36 |   source_code_hash = data.archive_file.lambda_function_payload_bounce_email_notification.output_base64sha256
		37 | 
		38 |   lifecycle {
		39 |     replace_triggered_by = [aws_iam_role.lambda_bounce_email_notification]
		40 |   }
		41 | 
		42 |   tags = local.tags
		43 | }

Check: CKV_AWS_117: "Ensure that AWS Lambda function is configured inside a VPC"
	FAILED for resource: aws_lambda_function.bounce_email_notification
	File: /ses_bounce.tf:29-43
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-inside-a-vpc-1

		29 | resource "aws_lambda_function" "bounce_email_notification" {
		30 |   filename         = "${path.module}/lambda/bounce_email_notification/bounce_email_notification.zip"
		31 |   function_name    = "bounce_email_notification"
		32 |   architectures    = ["arm64"]
		33 |   role             = aws_iam_role.lambda_bounce_email_notification.arn
		34 |   runtime          = "python3.12"
		35 |   handler          = "bounce_email_notification.handler"
		36 |   source_code_hash = data.archive_file.lambda_function_payload_bounce_email_notification.output_base64sha256
		37 | 
		38 |   lifecycle {
		39 |     replace_triggered_by = [aws_iam_role.lambda_bounce_email_notification]
		40 |   }
		41 | 
		42 |   tags = local.tags
		43 | }

Check: CKV_AWS_116: "Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)"
	FAILED for resource: aws_lambda_function.bounce_email_notification
	File: /ses_bounce.tf:29-43
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-a-dead-letter-queue-dlq

		29 | resource "aws_lambda_function" "bounce_email_notification" {
		30 |   filename         = "${path.module}/lambda/bounce_email_notification/bounce_email_notification.zip"
		31 |   function_name    = "bounce_email_notification"
		32 |   architectures    = ["arm64"]
		33 |   role             = aws_iam_role.lambda_bounce_email_notification.arn
		34 |   runtime          = "python3.12"
		35 |   handler          = "bounce_email_notification.handler"
		36 |   source_code_hash = data.archive_file.lambda_function_payload_bounce_email_notification.output_base64sha256
		37 | 
		38 |   lifecycle {
		39 |     replace_triggered_by = [aws_iam_role.lambda_bounce_email_notification]
		40 |   }
		41 | 
		42 |   tags = local.tags
		43 | }

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: aws_lambda_function.bounce_email_notification
	File: /ses_bounce.tf:29-43
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		29 | resource "aws_lambda_function" "bounce_email_notification" {
		30 |   filename         = "${path.module}/lambda/bounce_email_notification/bounce_email_notification.zip"
		31 |   function_name    = "bounce_email_notification"
		32 |   architectures    = ["arm64"]
		33 |   role             = aws_iam_role.lambda_bounce_email_notification.arn
		34 |   runtime          = "python3.12"
		35 |   handler          = "bounce_email_notification.handler"
		36 |   source_code_hash = data.archive_file.lambda_function_payload_bounce_email_notification.output_base64sha256
		37 | 
		38 |   lifecycle {
		39 |     replace_triggered_by = [aws_iam_role.lambda_bounce_email_notification]
		40 |   }
		41 | 
		42 |   tags = local.tags
		43 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.bounce_email_notification
	File: /ses_bounce.tf:91-96
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		91 | resource "aws_cloudwatch_log_group" "bounce_email_notification" {
		92 |   name              = "/aws/lambda/bounce_email_notification"
		93 |   retention_in_days = local.application_data.accounts[local.environment].lambda_log_retention_days
		94 | 
		95 |   tags = local.tags
		96 | }
Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.lambda_policy_bounce_email_notification
	File: /ses_bounce.tf:58-75
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		58 | data "aws_iam_policy_document" "lambda_policy_bounce_email_notification" {
		59 |   statement {
		60 |     actions = [
		61 |       "ses:SendRawEmail",
		62 |       "ses:SendEmail"
		63 |     ]
		64 |     resources = ["*"]
		65 |   }
		66 | 
		67 |   statement {
		68 |     actions = [
		69 |       "logs:CreateLogGroup",
		70 |       "logs:CreateLogStream",
		71 |       "logs:PutLogEvents"
		72 |     ]
		73 |     resources = ["arn:aws:logs:*:*:*"]
		74 |   }
		75 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.lambda_policy_bounce_email_notification
	File: /ses_bounce.tf:58-75
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		58 | data "aws_iam_policy_document" "lambda_policy_bounce_email_notification" {
		59 |   statement {
		60 |     actions = [
		61 |       "ses:SendRawEmail",
		62 |       "ses:SendEmail"
		63 |     ]
		64 |     resources = ["*"]
		65 |   }
		66 | 
		67 |   statement {
		68 |     actions = [
		69 |       "logs:CreateLogGroup",
		70 |       "logs:CreateLogStream",
		71 |       "logs:PutLogEvents"
		72 |     ]
		73 |     resources = ["arn:aws:logs:*:*:*"]
		74 |   }
		75 | }

Check: CKV_AWS_337: "Ensure SSM parameters are using KMS CMK"
	FAILED for resource: aws_ssm_parameter.app_url
	File: /ssm.tf:2-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-337

		2 | resource "aws_ssm_parameter" "app_url" {
		3 |   name  = "/${var.networking[0].application}/environment/app-url"
		4 |   type  = "String"
		5 |   value = "https://${local.app_url}/"
		6 | }

Check: CKV_AWS_192: "Ensure WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell"
	FAILED for resource: aws_wafv2_web_acl.this
	File: /waf.tf:1-53
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-waf-prevents-message-lookup-in-log4j2

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.waf
	File: /waf.tf:59-63
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		59 | resource "aws_cloudwatch_log_group" "waf" {
		60 |   name              = "aws-waf-logs-${local.application_name}"
		61 |   retention_in_days = 60
		62 |   tags              = local.tags
		63 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.waf
	File: /waf.tf:59-63
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		59 | resource "aws_cloudwatch_log_group" "waf" {
		60 |   name              = "aws-waf-logs-${local.application_name}"
		61 |   retention_in_days = 60
		62 |   tags              = local.tags
		63 | }

Check: CKV2_AWS_60: "Ensure RDS instance with copy tags to snapshots is enabled"
	FAILED for resource: aws_db_instance.jitbit
	File: /rds.tf:40-83
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-60

		40 | resource "aws_db_instance" "jitbit" {
		41 |   engine         = "sqlserver-se"
		42 |   license_model  = "license-included"
		43 |   engine_version = local.application_data.accounts[local.environment].db_engine_version
		44 |   instance_class = local.application_data.accounts[local.environment].db_instance_class
		45 |   identifier     = "${local.application_name}-${local.environment}-database"
		46 |   username       = local.application_data.accounts[local.environment].db_user
		47 | 
		48 |   manage_master_user_password = true
		49 | 
		50 |   snapshot_identifier = try(local.application_data.accounts[local.environment].db_snapshot_identifier, null)
		51 | 
		52 |   # tflint-ignore: aws_db_instance_default_parameter_group
		53 |   parameter_group_name        = "default.sqlserver-se-15.0"
		54 |   deletion_protection         = local.application_data.accounts[local.environment].db_deletion_protection
		55 |   delete_automated_backups    = local.application_data.accounts[local.environment].db_delete_automated_backups
		56 |   skip_final_snapshot         = local.skip_final_snapshot
		57 |   final_snapshot_identifier   = !local.skip_final_snapshot ? "${local.application_name}-${local.environment}-database-final-snapshot" : null
		58 |   allocated_storage           = local.application_data.accounts[local.environment].db_allocated_storage
		59 |   max_allocated_storage       = local.application_data.accounts[local.environment].db_max_allocated_storage
		60 |   storage_type                = local.application_data.accounts[local.environment].db_storage_type
		61 |   maintenance_window          = local.application_data.accounts[local.environment].db_maintenance_window
		62 |   auto_minor_version_upgrade  = local.application_data.accounts[local.environment].db_auto_minor_version_upgrade
		63 |   allow_major_version_upgrade = local.application_data.accounts[local.environment].db_allow_major_version_upgrade
		64 |   backup_window               = local.application_data.accounts[local.environment].db_backup_window
		65 |   backup_retention_period     = local.application_data.accounts[local.environment].db_retention_period
		66 |   #checkov:skip=CKV_AWS_133: "backup_retention enabled, can be edited it application_variables.json"
		67 |   iam_database_authentication_enabled = local.application_data.accounts[local.environment].db_iam_database_authentication_enabled
		68 |   #checkov:skip=CKV_AWS_161: "iam auth enabled, but optional"
		69 |   db_subnet_group_name   = aws_db_subnet_group.jitbit.id
		70 |   vpc_security_group_ids = [aws_security_group.database_security_group.id]
		71 |   multi_az               = local.application_data.accounts[local.environment].db_multi_az
		72 |   #checkov:skip=CKV_AWS_157: "multi-az enabled, but optional"
		73 |   monitoring_interval = local.application_data.accounts[local.environment].db_monitoring_interval
		74 |   monitoring_role_arn = local.application_data.accounts[local.environment].db_monitoring_interval == 0 ? "" : aws_iam_role.rds_enhanced_monitoring[0].arn
		75 |   #checkov:skip=CKV_AWS_118: "enhanced monitoring is enabled, but optional"
		76 |   storage_encrypted               = true
		77 |   performance_insights_enabled    = local.application_data.accounts[local.environment].db_performance_insights_enabled
		78 |   performance_insights_kms_key_id = "" #tfsec:ignore:aws-rds-enable-performance-insights-encryption Left empty so that it will run, however should be populated with real key in scenario.
		79 |   enabled_cloudwatch_logs_exports = local.application_data.accounts[local.environment].db_enabled_cloudwatch_logs_exports
		80 |   tags = merge(local.tags,
		81 |     { Name = lower(format("%s-%s-database", local.application_name, local.environment)) }
		82 |   )
		83 | }

Check: CKV2_AWS_60: "Ensure RDS instance with copy tags to snapshots is enabled"
	FAILED for resource: aws_db_instance.jitbit_sandbox
	File: /sandbox_rds.tf:27-70
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-60

		27 | resource "aws_db_instance" "jitbit_sandbox" {
		28 |   count = local.is-development ? 1 : 0
		29 | 
		30 |   engine         = "sqlserver-se"
		31 |   license_model  = "license-included"
		32 |   engine_version = local.application_data.accounts["sandbox"].db_engine_version
		33 |   instance_class = local.application_data.accounts["sandbox"].db_instance_class
		34 |   identifier     = "${local.application_name}-sandbox-database"
		35 |   username       = local.application_data.accounts["sandbox"].db_user
		36 | 
		37 |   manage_master_user_password = true
		38 | 
		39 |   snapshot_identifier = try(local.application_data.accounts["sandbox"].db_snapshot_identifier, null)
		40 | 
		41 |   # tflint-ignore: aws_db_instance_default_parameter_group
		42 |   parameter_group_name        = "default.sqlserver-se-15.0"
		43 |   deletion_protection         = local.application_data.accounts["sandbox"].db_deletion_protection
		44 |   delete_automated_backups    = local.application_data.accounts["sandbox"].db_delete_automated_backups
		45 |   skip_final_snapshot         = local.application_data.accounts["sandbox"].db_skip_final_snapshot
		46 |   final_snapshot_identifier   = !local.skip_final_snapshot ? "${local.application_name}-sandbox-database-final-snapshot" : null
		47 |   allocated_storage           = local.application_data.accounts["sandbox"].db_allocated_storage
		48 |   max_allocated_storage       = local.application_data.accounts["sandbox"].db_max_allocated_storage
		49 |   storage_type                = local.application_data.accounts["sandbox"].db_storage_type
		50 |   maintenance_window          = local.application_data.accounts["sandbox"].db_maintenance_window
		51 |   auto_minor_version_upgrade  = local.application_data.accounts["sandbox"].db_auto_minor_version_upgrade
		52 |   allow_major_version_upgrade = local.application_data.accounts["sandbox"].db_allow_major_version_upgrade
		53 |   backup_window               = local.application_data.accounts["sandbox"].db_backup_window
		54 |   backup_retention_period     = local.application_data.accounts["sandbox"].db_retention_period
		55 |   #checkov:skip=CKV_AWS_133: "backup_retention enabled, can be edited it application_variables.json"
		56 |   iam_database_authentication_enabled = local.application_data.accounts["sandbox"].db_iam_database_authentication_enabled
		57 |   #checkov:skip=CKV_AWS_161: "iam auth enabled, but optional"
		58 |   db_subnet_group_name   = aws_db_subnet_group.jitbit.id
		59 |   vpc_security_group_ids = [aws_security_group.database_security_group_sandbox[0].id]
		60 |   multi_az               = local.application_data.accounts["sandbox"].db_multi_az
		61 |   #checkov:skip=CKV_AWS_157: "multi-az enabled, but optional"
		62 |   storage_encrypted = true
		63 | 
		64 |   tags = merge(
		65 |     local.tags,
		66 |     {
		67 |       Name = lower(format("%s-%s-database", local.application_name, "sandbox"))
		68 |     }
		69 |   )
		70 | }

Check: CKV2_AWS_34: "AWS SSM Parameter should be Encrypted"
	FAILED for resource: aws_ssm_parameter.app_url
	File: /ssm.tf:2-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-ssm-parameter-is-encrypted

		2 | resource "aws_ssm_parameter" "app_url" {
		3 |   name  = "/${var.networking[0].application}/environment/app-url"
		4 |   type  = "String"
		5 |   value = "https://${local.app_url}/"
		6 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: aws_security_group.jitbit
	File: /ecs.tf:53-62
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		53 | resource "aws_security_group" "jitbit" {
		54 |   vpc_id      = data.aws_vpc.shared.id
		55 |   name        = format("hmpps-%s-%s-service", local.environment, local.application_name)
		56 |   description = "Security group for the ${local.application_name} service"
		57 |   tags        = local.tags
		58 | 
		59 |   lifecycle {
		60 |     create_before_destroy = true
		61 |   }
		62 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: aws_security_group.jitbit_sandbox
	File: /sandbox_ecs.tf:55-66
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		55 | resource "aws_security_group" "jitbit_sandbox" {
		56 |   count = local.is-development ? 1 : 0
		57 | 
		58 |   vpc_id      = data.aws_vpc.shared.id
		59 |   name        = format("hmpps-%s-%s-service", "sandbox", local.application_name)
		60 |   description = "Security group for the ${local.application_name} service"
		61 |   tags        = local.tags
		62 | 
		63 |   lifecycle {
		64 |     create_before_destroy = true
		65 |   }
		66 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.db_app_connection_string_sandbox
	File: /sandbox_secrets.tf:2-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		2  | resource "aws_secretsmanager_secret" "db_app_connection_string_sandbox" {
		3  |   count = local.is-development ? 1 : 0
		4  |   #checkov:skip=CKV_AWS_149
		5  |   name                    = "${var.networking[0].application}-app-connection-string-sandbox"
		6  |   recovery_window_in_days = 0
		7  |   tags = merge(
		8  |     local.tags,
		9  |     {
		10 |       Name = "${var.networking[0].application}-app-connection-string-sandbox"
		11 |     },
		12 |   )
		13 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.db_app_connection_string
	File: /secrets.tf:5-15
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		5  | resource "aws_secretsmanager_secret" "db_app_connection_string" {
		6  |   #checkov:skip=CKV_AWS_149
		7  |   name                    = "${var.networking[0].application}-app-connection-string"
		8  |   recovery_window_in_days = 0
		9  |   tags = merge(
		10 |     local.tags,
		11 |     {
		12 |       Name = "${var.networking[0].application}-app-connection-string"
		13 |     },
		14 |   )
		15 | }


checkov_exitcode=1

`CTFLint Scan` Failed

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.5.0)
tflint will check the following folders:
terraform/environments/delius-jitbit

*****************************

Running tflint in terraform/environments/delius-jitbit
Excluding the following checks: terraform_unused_declarations
1 issue(s) found:

Warning: Missing version constraint for provider "archive" in `required_providers` (terraform_required_providers)

  on terraform/environments/delius-jitbit/ses_bounce.tf line 22:
  22: data "archive_file" "lambda_function_payload_bounce_email_notification" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_required_providers.md

tflint_exitcode=2

`Trivy Scan` Failed

Show Output

*****************************

Trivy will check the following folders:
terraform/environments/delius-jitbit

*****************************

Running Trivy in terraform/environments/delius-jitbit
2024-05-10T15:10:48Z	INFO	Need to update DB
2024-05-10T15:10:48Z	INFO	Downloading DB...	repository="ghcr.io/aquasecurity/trivy-db:2"
2024-05-10T15:10:50Z	INFO	Vulnerability scanning is enabled
2024-05-10T15:10:50Z	INFO	Misconfiguration scanning is enabled
2024-05-10T15:10:50Z	INFO	Need to update the built-in policies
2024-05-10T15:10:50Z	INFO	Downloading the built-in policies...
50.41 KiB / 50.41 KiB [-----------------------------------------------------------] 100.00% ? p/s 0s2024-05-10T15:10:50Z	INFO	Secret scanning is enabled
2024-05-10T15:10:50Z	INFO	If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-05-10T15:10:50Z	INFO	Please see also https://aquasecurity.github.io/trivy/v0.51/docs/scanner/secret/#recommendation for faster secret detection
2024-05-10T15:10:53Z	INFO	Number of language-specific files	num=0
2024-05-10T15:10:53Z	INFO	Detected config files	num=14

ecs.tf (terraform)
==================
Tests: 2 (SUCCESSES: 1, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 0, CRITICAL: 1)

CRITICAL: Security group rule allows egress to multiple public internet addresses.
════════════════════════════════════════
Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.

See https://avd.aquasec.com/misconfig/avd-aws-0104
────────────────────────────────────────
 ecs.tf:70
   via ecs.tf:64-72 (aws_security_group_rule.allow_all_egress)
────────────────────────────────────────
  64   resource "aws_security_group_rule" "allow_all_egress" {
  65     description       = "Allow all outbound traffic to any IPv4 address"
  66     type              = "egress"
  67     from_port         = 0
  68     to_port           = 0
  69     protocol          = "-1"
  70 [   cidr_blocks       = ["0.0.0.0/0"]
  71     security_group_id = aws_security_group.jitbit.id
  72   }
────────────────────────────────────────



github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.2.1/main.tf (terraform)
==========================================================================================================
Tests: 7 (SUCCESSES: 5, FAILURES: 0, EXCEPTIONS: 2)
Failures: 0 (HIGH: 0, CRITICAL: 0)


github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0/main.tf (terraform)
======================================================================================================
Tests: 14 (SUCCESSES: 12, FAILURES: 2, EXCEPTIONS: 0)
Failures: 2 (HIGH: 2, CRITICAL: 0)

HIGH: Bucket does not encrypt data with a customer managed key.
════════════════════════════════════════
Encryption using AWS keys provides protection for your S3 buckets. To increase control of the encryption and manage factors like rotation use customer managed keys.

See https://avd.aquasec.com/misconfig/avd-aws-0132
────────────────────────────────────────
 github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0/main.tf:157-165
   via s3.tf:1-84 (module.jitbit_bucket)
────────────────────────────────────────
 157 ┌ resource "aws_s3_bucket_server_side_encryption_configuration" "default" {
 158 │   bucket = aws_s3_bucket.default.id
 159 │   rule {
 160 │     apply_server_side_encryption_by_default {
 161 │       sse_algorithm     = var.sse_algorithm
 162 │       kms_master_key_id = (var.custom_kms_key != "") ? var.custom_kms_key : ""
 163 │     }
 164 │   }
 165 └ }
────────────────────────────────────────


HIGH: Bucket does not encrypt data with a customer managed key.
════════════════════════════════════════
Encryption using AWS keys provides protection for your S3 buckets. To increase control of the encryption and manage factors like rotation use customer managed keys.

See https://avd.aquasec.com/misconfig/avd-aws-0132
────────────────────────────────────────
 github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0/main.tf:157-165
   via ecs.tf:11-51 (module.s3_bucket_app_deployment)
────────────────────────────────────────
 157 ┌ resource "aws_s3_bucket_server_side_encryption_configuration" "default" {
 158 │   bucket = aws_s3_bucket.default.id
 159 │   rule {
 160 │     apply_server_side_encryption_by_default {
 161 │       sse_algorithm     = var.sse_algorithm
 162 │       kms_master_key_id = (var.custom_kms_key != "") ? var.custom_kms_key : ""
 163 │     }
 164 │   }
 165 └ }
────────────────────────────────────────



iam.tf (terraform)
==================
Tests: 6 (SUCCESSES: 0, FAILURES: 0, EXCEPTIONS: 6)
Failures: 0 (HIGH: 0, CRITICAL: 0)


lb.tf (terraform)
=================
Tests: 7 (SUCCESSES: 4, FAILURES: 2, EXCEPTIONS: 1)
Failures: 2 (HIGH: 0, CRITICAL: 2)

CRITICAL: Security group rule allows ingress from public internet.
════════════════════════════════════════
Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.

See https://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
 lb.tf:62-70
   via lb.tf:35-71 (ingress)
    via lb.tf:30-87 (aws_security_group.load_balancer_security_group)
────────────────────────────────────────
  30   resource "aws_security_group" "load_balancer_security_group" {
  ..   
  62 ┌     ipv6_cidr_blocks = [
  63 │       # Route53 Healthcheck Access Cidrs IPv6
  64 │       "2406:da18:7ff:f800::/53",  # ap-southeast-1 Region
  65 │       "2406:da18:fff:f800::/53",  # ap-southeast-1 Region
  66 │       "2a05:d018:fff:f800::/53",  # eu-west-1 Region
  67 │       "2a05:d018:7ff:f800::/53",  # eu-west-1 Region
  68 └       "2600:1f18:7fff:f800::/53", # us-east-1 Region
  ..   
────────────────────────────────────────


CRITICAL: Security group rule allows ingress from public internet.
════════════════════════════════════════
Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.

See https://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
 lb.tf:40-60
   via lb.tf:35-71 (ingress)
    via lb.tf:30-87 (aws_security_group.load_balancer_security_group)
────────────────────────────────────────
  30   resource "aws_security_group" "load_balancer_security_group" {
  ..   
  40 ┌     cidr_blocks = distinct(flatten([
  41 │       "20.49.214.199/32", # Azure Landing Zone Egress
  42 │       "20.49.214.228/32", # Azure Landing Zone Egress
  43 │       "20.26.11.71/32",   # Azure Landing Zone Egress
  44 │       "20.26.11.108/32",  # Azure Landing Zone Egress
  45 │       # Route53 Healthcheck Access Cidrs
  46 └       # London Region not support yet, so metrics are not yet publised, can be enabled at later stage for Route53 endpoint monitor
  ..   
────────────────────────────────────────



monitoring.tf (terraform)
=========================
Tests: 2 (SUCCESSES: 1, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Topic does not have encryption enabled.
════════════════════════════════════════
Topics should be encrypted to protect their contents.

See https://avd.aquasec.com/misconfig/avd-aws-0095
────────────────────────────────────────
 monitoring.tf:6-8
────────────────────────────────────────
   6 ┌ resource "aws_sns_topic" "jitbit_alerting" {
   7 │   name = "jitbit_alerting"
   8 └ }
────────────────────────────────────────



ses.tf (terraform)
==================
Tests: 2 (SUCCESSES: 0, FAILURES: 0, EXCEPTIONS: 2)
Failures: 0 (HIGH: 0, CRITICAL: 0)


ses_bounce.tf (terraform)
=========================
Tests: 6 (SUCCESSES: 2, FAILURES: 1, EXCEPTIONS: 3)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Topic does not have encryption enabled.
════════════════════════════════════════
Topics should be encrypted to protect their contents.

See https://avd.aquasec.com/misconfig/avd-aws-0095
────────────────────────────────────────
 ses_bounce.tf:1-5
────────────────────────────────────────
   1 ┌ resource "aws_sns_topic" "jitbit_ses_destination_topic_bounce_email_notification" {
   2 │   name = format("%s-ses-destination-topic-bounce-email-notification", local.application_name)
   3 │ 
   4 │   tags = local.tags
   5 └ }
────────────────────────────────────────


trivy_exitcode=1

github-actions · 2024-05-10T15:12:55Z

`Trivy Scan` Failed

Show Output

```hcl

Trivy will check the following folders:
terraform/environments/delius-jitbit

Running Trivy in terraform/environments/delius-jitbit
2024-05-10T15:12:45Z INFO Need to update DB
2024-05-10T15:12:45Z INFO Downloading DB... repository="ghcr.io/aquasecurity/trivy-db:2"
2024-05-10T15:12:47Z INFO Vulnerability scanning is enabled
2024-05-10T15:12:47Z INFO Misconfiguration scanning is enabled
2024-05-10T15:12:47Z INFO Need to update the built-in policies
2024-05-10T15:12:47Z INFO Downloading the built-in policies...
50.41 KiB / 50.41 KiB [-----------------------------------------------------------] 100.00% ? p/s 0s2024-05-10T15:12:47Z INFO Secret scanning is enabled
2024-05-10T15:12:47Z INFO If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-05-10T15:12:47Z INFO Please see also https://aquasecurity.github.io/trivy/v0.51/docs/scanner/secret/#recommendation for faster secret detection
2024-05-10T15:12:50Z INFO Number of language-specific files num=0
2024-05-10T15:12:50Z INFO Detected config files num=14

ecs.tf (terraform)

Tests: 2 (SUCCESSES: 1, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 0, CRITICAL: 1)

CRITICAL: Security group rule allows egress to multiple public internet addresses.
════════════════════════════════════════
Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.

See https://avd.aquasec.com/misconfig/avd-aws-0104
────────────────────────────────────────
ecs.tf:70
via ecs.tf:64-72 (aws_security_group_rule.allow_all_egress)
────────────────────────────────────────
64 resource "aws_security_group_rule" "allow_all_egress" {
65 description = "Allow all outbound traffic to any IPv4 address"
66 type = "egress"
67 from_port = 0
68 to_port = 0
69 protocol = "-1"
70 [ cidr_blocks = ["0.0.0.0/0"]
71 security_group_id = aws_security_group.jitbit.id
72 }
────────────────────────────────────────

github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.2.1/main.tf (terraform)

Tests: 7 (SUCCESSES: 5, FAILURES: 0, EXCEPTIONS: 2)
Failures: 0 (HIGH: 0, CRITICAL: 0)

github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0/main.tf (terraform)

Tests: 14 (SUCCESSES: 12, FAILURES: 2, EXCEPTIONS: 0)
Failures: 2 (HIGH: 2, CRITICAL: 0)

HIGH: Bucket does not encrypt data with a customer managed key.
════════════════════════════════════════
Encryption using AWS keys provides protection for your S3 buckets. To increase control of the encryption and manage factors like rotation use customer managed keys.

See https://avd.aquasec.com/misconfig/avd-aws-0132
────────────────────────────────────────
github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0/main.tf:157-165
via s3.tf:1-84 (module.jitbit_bucket)
────────────────────────────────────────
157 ┌ resource "aws_s3_bucket_server_side_encryption_configuration" "default" {
158 │ bucket = aws_s3_bucket.default.id
159 │ rule {
160 │ apply_server_side_encryption_by_default {
161 │ sse_algorithm = var.sse_algorithm
162 │ kms_master_key_id = (var.custom_kms_key != "") ? var.custom_kms_key : ""
163 │ }
164 │ }
165 └ }
────────────────────────────────────────

HIGH: Bucket does not encrypt data with a customer managed key.
════════════════════════════════════════
Encryption using AWS keys provides protection for your S3 buckets. To increase control of the encryption and manage factors like rotation use customer managed keys.

See https://avd.aquasec.com/misconfig/avd-aws-0132
────────────────────────────────────────
github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0/main.tf:157-165
via ecs.tf:11-51 (module.s3_bucket_app_deployment)
────────────────────────────────────────
157 ┌ resource "aws_s3_bucket_server_side_encryption_configuration" "default" {
158 │ bucket = aws_s3_bucket.default.id
159 │ rule {
160 │ apply_server_side_encryption_by_default {
161 │ sse_algorithm = var.sse_algorithm
162 │ kms_master_key_id = (var.custom_kms_key != "") ? var.custom_kms_key : ""
163 │ }
164 │ }
165 └ }
────────────────────────────────────────

iam.tf (terraform)

Tests: 6 (SUCCESSES: 0, FAILURES: 0, EXCEPTIONS: 6)
Failures: 0 (HIGH: 0, CRITICAL: 0)

lb.tf (terraform)

Tests: 7 (SUCCESSES: 4, FAILURES: 2, EXCEPTIONS: 1)
Failures: 2 (HIGH: 0, CRITICAL: 2)

CRITICAL: Security group rule allows ingress from public internet.
════════════════════════════════════════
Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.

See https://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
lb.tf:62-70
via lb.tf:35-71 (ingress)
via lb.tf:30-87 (aws_security_group.load_balancer_security_group)
────────────────────────────────────────
30 resource "aws_security_group" "load_balancer_security_group" {
..
62 ┌ ipv6_cidr_blocks = [
63 │ # Route53 Healthcheck Access Cidrs IPv6
64 │ "2406:da18:7ff:f800::/53", # ap-southeast-1 Region
65 │ "2406:da18:fff:f800::/53", # ap-southeast-1 Region
66 │ "2a05:d018:fff:f800::/53", # eu-west-1 Region
67 │ "2a05:d018:7ff:f800::/53", # eu-west-1 Region
68 └ "2600:1f18:7fff:f800::/53", # us-east-1 Region
..
────────────────────────────────────────

CRITICAL: Security group rule allows ingress from public internet.
════════════════════════════════════════
Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.

See https://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
lb.tf:40-60
via lb.tf:35-71 (ingress)
via lb.tf:30-87 (aws_security_group.load_balancer_security_group)
────────────────────────────────────────
30 resource "aws_security_group" "load_balancer_security_group" {
..
40 ┌ cidr_blocks = distinct(flatten([
41 │ "20.49.214.199/32", # Azure Landing Zone Egress
42 │ "20.49.214.228/32", # Azure Landing Zone Egress
43 │ "20.26.11.71/32", # Azure Landing Zone Egress
44 │ "20.26.11.108/32", # Azure Landing Zone Egress
45 │ # Route53 Healthcheck Access Cidrs
46 └ # London Region not support yet, so metrics are not yet publised, can be enabled at later stage for Route53 endpoint monitor
..
────────────────────────────────────────

monitoring.tf (terraform)

Tests: 2 (SUCCESSES: 1, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Topic does not have encryption enabled.
════════════════════════════════════════
Topics should be encrypted to protect their contents.

See https://avd.aquasec.com/misconfig/avd-aws-0095
────────────────────────────────────────
monitoring.tf:6-8
────────────────────────────────────────
6 ┌ resource "aws_sns_topic" "jitbit_alerting" {
7 │ name = "jitbit_alerting"
8 └ }
────────────────────────────────────────

ses.tf (terraform)

Tests: 2 (SUCCESSES: 0, FAILURES: 0, EXCEPTIONS: 2)
Failures: 0 (HIGH: 0, CRITICAL: 0)

ses_bounce.tf (terraform)

Tests: 6 (SUCCESSES: 2, FAILURES: 1, EXCEPTIONS: 3)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Topic does not have encryption enabled.
════════════════════════════════════════
Topics should be encrypted to protect their contents.

See https://avd.aquasec.com/misconfig/avd-aws-0095
────────────────────────────────────────
ses_bounce.tf:1-5
────────────────────────────────────────
1 ┌ resource "aws_sns_topic" "jitbit_ses_destination_topic_bounce_email_notification" {
2 │ name = format("%s-ses-destination-topic-bounce-email-notification", local.application_name)
3 │
4 │ tags = local.tags
5 └ }
────────────────────────────────────────

trivy_exitcode=1

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/delius-jitbit

*****************************

Running Checkov in terraform/environments/delius-jitbit
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2024-05-10 15:12:52,404 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0:None (for external modules, the --download-external-modules flag is required)
2024-05-10 15:12:52,405 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.1.0:None (for external modules, the --download-external-modules flag is required)
2024-05-10 15:12:52,405 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-ecs-cluster//cluster?ref=v2.0.1:None (for external modules, the --download-external-modules flag is required)
2024-05-10 15:12:52,405 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-pagerduty-integration?ref=v2.0.0:None (for external modules, the --download-external-modules flag is required)
2024-05-10 15:12:52,405 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.2.1:None (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 256, Failed checks: 50, Skipped checks: 20

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: bastion_linux
	File: /bastion_linux.tf:6-41
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		6  | module "bastion_linux" {
		7  |   source = "github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.2.1"
		8  | 
		9  |   providers = {
		10 |     aws.share-host   = aws.core-vpc # core-vpc-(environment) holds the networking for all accounts
		11 |     aws.share-tenant = aws          # The default provider (unaliased, `aws`) is the tenant
		12 |   }
		13 | 
		14 |   # s3 - used for logs and user ssh public keys
		15 |   bucket_name = "bastion"
		16 |   # public keys
		17 |   public_key_data = local.public_key_data.keys[local.environment]
		18 |   # logs
		19 |   log_auto_clean       = "Enabled"
		20 |   log_standard_ia_days = 30  # days before moving to IA storage
		21 |   log_glacier_days     = 60  # days before moving to Glacier
		22 |   log_expiry_days      = 180 # days before log expiration
		23 |   # bastion
		24 |   allow_ssh_commands = false
		25 | 
		26 |   app_name      = var.networking[0].application
		27 |   business_unit = local.vpc_name
		28 |   subnet_set    = local.subnet_set
		29 |   environment   = local.environment
		30 |   region        = "eu-west-2"
		31 | 
		32 |   # custom scaling schedule
		33 |   autoscaling_cron = {
		34 |     "down" : "0 21 * * *",
		35 |     "up" : "0 05 * * *"
		36 |   }
		37 | 
		38 |   # Tags
		39 |   tags_common = local.tags
		40 |   tags_prefix = terraform.workspace
		41 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.jitbit
	File: /ecs.tf:84-87
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		84 | resource "aws_cloudwatch_log_group" "jitbit" {
		85 |   name              = format("%s-ecs", local.application_name)
		86 |   retention_in_days = 30
		87 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.jitbit
	File: /ecs.tf:84-87
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		84 | resource "aws_cloudwatch_log_group" "jitbit" {
		85 |   name              = format("%s-ecs", local.application_name)
		86 |   retention_in_days = 30
		87 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: ecs
	File: /ecs.tf:1-8
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		1 | module "ecs" {
		2 |   source = "github.com/ministryofjustice/modernisation-platform-terraform-ecs-cluster//cluster?ref=v2.0.1"
		3 | 
		4 |   environment = local.environment
		5 |   name        = local.application_name
		6 | 
		7 |   tags = local.tags
		8 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: s3_bucket_app_deployment
	File: /ecs.tf:11-51
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		11 | module "s3_bucket_app_deployment" {
		12 | 
		13 |   source = "github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0"
		14 | 
		15 |   providers = {
		16 |     aws.bucket-replication = aws
		17 |   }
		18 |   bucket_name        = "${local.application_name}-${local.environment}-deployment"
		19 |   versioning_enabled = true
		20 | 
		21 |   ownership_controls = "BucketOwnerEnforced"
		22 | 
		23 |   lifecycle_rule = [
		24 |     {
		25 |       id      = "main"
		26 |       enabled = "Enabled"
		27 |       prefix  = ""
		28 | 
		29 |       tags = {
		30 |         rule      = "log"
		31 |         autoclean = "true"
		32 |       }
		33 | 
		34 |       noncurrent_version_transition = [
		35 |         {
		36 |           days          = 90
		37 |           storage_class = "STANDARD_IA"
		38 |           }, {
		39 |           days          = 365
		40 |           storage_class = "GLACIER"
		41 |         }
		42 |       ]
		43 | 
		44 |       noncurrent_version_expiration = {
		45 |         days = 730
		46 |       }
		47 |     }
		48 |   ]
		49 | 
		50 |   tags = local.tags
		51 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.ecs_service_policy
	File: /iam.tf:37-52
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		37 | data "aws_iam_policy_document" "ecs_service_policy" {
		38 |   statement {
		39 |     effect    = "Allow"
		40 |     resources = ["*"]
		41 | 
		42 |     actions = [
		43 |       "elasticloadbalancing:Describe*",
		44 |       "elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
		45 |       "elasticloadbalancing:RegisterInstancesWithLoadBalancer",
		46 |       "ec2:Describe*",
		47 |       "ec2:AuthorizeSecurityGroupIngress",
		48 |       "elasticloadbalancing:RegisterTargets",
		49 |       "elasticloadbalancing:DeregisterTargets"
		50 |     ]
		51 |   }
		52 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.ecs_service_policy
	File: /iam.tf:37-52
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		37 | data "aws_iam_policy_document" "ecs_service_policy" {
		38 |   statement {
		39 |     effect    = "Allow"
		40 |     resources = ["*"]
		41 | 
		42 |     actions = [
		43 |       "elasticloadbalancing:Describe*",
		44 |       "elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
		45 |       "elasticloadbalancing:RegisterInstancesWithLoadBalancer",
		46 |       "ec2:Describe*",
		47 |       "ec2:AuthorizeSecurityGroupIngress",
		48 |       "elasticloadbalancing:RegisterTargets",
		49 |       "elasticloadbalancing:DeregisterTargets"
		50 |     ]
		51 |   }
		52 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.ecs_exec
	File: /iam.tf:98-114
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		98  | data "aws_iam_policy_document" "ecs_exec" {
		99  |   statement {
		100 |     effect    = "Allow"
		101 |     resources = ["*"]
		102 | 
		103 |     actions = [
		104 |       "ssm:GetParameters",
		105 |       "ecr:GetAuthorizationToken",
		106 |       "ecr:BatchCheckLayerAvailability",
		107 |       "ecr:GetDownloadUrlForLayer",
		108 |       "ecr:BatchGetImage",
		109 |       "logs:CreateLogGroup",
		110 |       "logs:CreateLogStream",
		111 |       "logs:PutLogEvents"
		112 |     ]
		113 |   }
		114 | }

Check: CKV_AWS_108: "Ensure IAM policies does not allow data exfiltration"
	FAILED for resource: aws_iam_policy_document.ecs_exec
	File: /iam.tf:98-114
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-data-exfiltration

		98  | data "aws_iam_policy_document" "ecs_exec" {
		99  |   statement {
		100 |     effect    = "Allow"
		101 |     resources = ["*"]
		102 | 
		103 |     actions = [
		104 |       "ssm:GetParameters",
		105 |       "ecr:GetAuthorizationToken",
		106 |       "ecr:BatchCheckLayerAvailability",
		107 |       "ecr:GetDownloadUrlForLayer",
		108 |       "ecr:BatchGetImage",
		109 |       "logs:CreateLogGroup",
		110 |       "logs:CreateLogStream",
		111 |       "logs:PutLogEvents"
		112 |     ]
		113 |   }
		114 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.ecs_exec
	File: /iam.tf:98-114
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		98  | data "aws_iam_policy_document" "ecs_exec" {
		99  |   statement {
		100 |     effect    = "Allow"
		101 |     resources = ["*"]
		102 | 
		103 |     actions = [
		104 |       "ssm:GetParameters",
		105 |       "ecr:GetAuthorizationToken",
		106 |       "ecr:BatchCheckLayerAvailability",
		107 |       "ecr:GetDownloadUrlForLayer",
		108 |       "ecr:BatchGetImage",
		109 |       "logs:CreateLogGroup",
		110 |       "logs:CreateLogStream",
		111 |       "logs:PutLogEvents"
		112 |     ]
		113 |   }
		114 | }

Check: CKV_AWS_26: "Ensure all data stored in the SNS topic is encrypted"
	FAILED for resource: aws_sns_topic.jitbit_alerting
	File: /monitoring.tf:6-8
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-15

		6 | resource "aws_sns_topic" "jitbit_alerting" {
		7 |   name = "jitbit_alerting"
		8 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: pagerduty_core_alerts
	File: /monitoring.tf:37-44
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		37 | module "pagerduty_core_alerts" {
		38 |   depends_on = [
		39 |     aws_sns_topic.jitbit_alerting
		40 |   ]
		41 |   source                    = "github.com/ministryofjustice/modernisation-platform-terraform-pagerduty-integration?ref=v2.0.0"
		42 |   sns_topics                = [aws_sns_topic.jitbit_alerting.name]
		43 |   pagerduty_integration_key = local.pagerduty_integration_key
		44 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.app_logs
	File: /monitoring_app.tf:1-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		1 | resource "aws_cloudwatch_log_group" "app_logs" {
		2 |   name              = "delius-jitbit-ecs"
		3 |   retention_in_days = 30
		4 | 
		5 |   tags = local.tags
		6 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.app_logs
	File: /monitoring_app.tf:1-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		1 | resource "aws_cloudwatch_log_group" "app_logs" {
		2 |   name              = "delius-jitbit-ecs"
		3 |   retention_in_days = 30
		4 | 
		5 |   tags = local.tags
		6 | }

Check: CKV_AWS_354: "Ensure RDS Performance Insights are encrypted using KMS CMKs"
	FAILED for resource: aws_db_instance.jitbit
	File: /rds.tf:40-83
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-354

		40 | resource "aws_db_instance" "jitbit" {
		41 |   engine         = "sqlserver-se"
		42 |   license_model  = "license-included"
		43 |   engine_version = local.application_data.accounts[local.environment].db_engine_version
		44 |   instance_class = local.application_data.accounts[local.environment].db_instance_class
		45 |   identifier     = "${local.application_name}-${local.environment}-database"
		46 |   username       = local.application_data.accounts[local.environment].db_user
		47 | 
		48 |   manage_master_user_password = true
		49 | 
		50 |   snapshot_identifier = try(local.application_data.accounts[local.environment].db_snapshot_identifier, null)
		51 | 
		52 |   # tflint-ignore: aws_db_instance_default_parameter_group
		53 |   parameter_group_name        = "default.sqlserver-se-15.0"
		54 |   deletion_protection         = local.application_data.accounts[local.environment].db_deletion_protection
		55 |   delete_automated_backups    = local.application_data.accounts[local.environment].db_delete_automated_backups
		56 |   skip_final_snapshot         = local.skip_final_snapshot
		57 |   final_snapshot_identifier   = !local.skip_final_snapshot ? "${local.application_name}-${local.environment}-database-final-snapshot" : null
		58 |   allocated_storage           = local.application_data.accounts[local.environment].db_allocated_storage
		59 |   max_allocated_storage       = local.application_data.accounts[local.environment].db_max_allocated_storage
		60 |   storage_type                = local.application_data.accounts[local.environment].db_storage_type
		61 |   maintenance_window          = local.application_data.accounts[local.environment].db_maintenance_window
		62 |   auto_minor_version_upgrade  = local.application_data.accounts[local.environment].db_auto_minor_version_upgrade
		63 |   allow_major_version_upgrade = local.application_data.accounts[local.environment].db_allow_major_version_upgrade
		64 |   backup_window               = local.application_data.accounts[local.environment].db_backup_window
		65 |   backup_retention_period     = local.application_data.accounts[local.environment].db_retention_period
		66 |   #checkov:skip=CKV_AWS_133: "backup_retention enabled, can be edited it application_variables.json"
		67 |   iam_database_authentication_enabled = local.application_data.accounts[local.environment].db_iam_database_authentication_enabled
		68 |   #checkov:skip=CKV_AWS_161: "iam auth enabled, but optional"
		69 |   db_subnet_group_name   = aws_db_subnet_group.jitbit.id
		70 |   vpc_security_group_ids = [aws_security_group.database_security_group.id]
		71 |   multi_az               = local.application_data.accounts[local.environment].db_multi_az
		72 |   #checkov:skip=CKV_AWS_157: "multi-az enabled, but optional"
		73 |   monitoring_interval = local.application_data.accounts[local.environment].db_monitoring_interval
		74 |   monitoring_role_arn = local.application_data.accounts[local.environment].db_monitoring_interval == 0 ? "" : aws_iam_role.rds_enhanced_monitoring[0].arn
		75 |   #checkov:skip=CKV_AWS_118: "enhanced monitoring is enabled, but optional"
		76 |   storage_encrypted               = true
		77 |   performance_insights_enabled    = local.application_data.accounts[local.environment].db_performance_insights_enabled
		78 |   performance_insights_kms_key_id = "" #tfsec:ignore:aws-rds-enable-performance-insights-encryption Left empty so that it will run, however should be populated with real key in scenario.
		79 |   enabled_cloudwatch_logs_exports = local.application_data.accounts[local.environment].db_enabled_cloudwatch_logs_exports
		80 |   tags = merge(local.tags,
		81 |     { Name = lower(format("%s-%s-database", local.application_name, local.environment)) }
		82 |   )
		83 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: jitbit_bucket
	File: /s3.tf:1-84
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.jitbit_sandbox
	File: /sandbox_ecs.tf:92-97
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		92 | resource "aws_cloudwatch_log_group" "jitbit_sandbox" {
		93 |   count = local.is-development ? 1 : 0
		94 | 
		95 |   name              = format("%s-%s-ecs", local.application_name, "sandbox")
		96 |   retention_in_days = 30
		97 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.jitbit_sandbox
	File: /sandbox_ecs.tf:92-97
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		92 | resource "aws_cloudwatch_log_group" "jitbit_sandbox" {
		93 |   count = local.is-development ? 1 : 0
		94 | 
		95 |   name              = format("%s-%s-ecs", local.application_name, "sandbox")
		96 |   retention_in_days = 30
		97 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: ecs_sandbox
	File: /sandbox_ecs.tf:1-10
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		1  | module "ecs_sandbox" {
		2  |   count = local.is-development ? 1 : 0
		3  | 
		4  |   source = "github.com/ministryofjustice/modernisation-platform-terraform-ecs-cluster//cluster?ref=v2.0.1"
		5  | 
		6  |   environment = local.environment
		7  |   name        = "${local.application_name}-sandbox"
		8  | 
		9  |   tags = local.tags
		10 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: s3_bucket_app_deployment_sandbox
	File: /sandbox_ecs.tf:12-53
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		12 | module "s3_bucket_app_deployment_sandbox" {
		13 |   count = local.is-development ? 1 : 0
		14 | 
		15 |   source = "github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0"
		16 | 
		17 |   providers = {
		18 |     aws.bucket-replication = aws
		19 |   }
		20 |   bucket_name        = "${local.application_name}-sandbox-deployment"
		21 |   versioning_enabled = true
		22 | 
		23 |   ownership_controls = "BucketOwnerEnforced"
		24 | 
		25 |   lifecycle_rule = [
		26 |     {
		27 |       id      = "main"
		28 |       enabled = "Enabled"
		29 |       prefix  = ""
		30 | 
		31 |       tags = {
		32 |         rule      = "log"
		33 |         autoclean = "true"
		34 |       }
		35 | 
		36 |       noncurrent_version_transition = [
		37 |         {
		38 |           days          = 90
		39 |           storage_class = "STANDARD_IA"
		40 |           }, {
		41 |           days          = 365
		42 |           storage_class = "GLACIER"
		43 |         }
		44 |       ]
		45 | 
		46 |       noncurrent_version_expiration = {
		47 |         days = 730
		48 |       }
		49 |     }
		50 |   ]
		51 | 
		52 |   tags = local.tags
		53 | }

Check: CKV_AWS_150: "Ensure that Load Balancer has deletion protection enabled"
	FAILED for resource: aws_lb.external_sandbox
	File: /sandbox_lb.tf:2-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-150

		2  | resource "aws_lb" "external_sandbox" {
		3  |   # checkov:skip=CKV_AWS_91
		4  |   # checkov:skip=CKV2_AWS_28
		5  | 
		6  |   count = local.is-development ? 1 : 0
		7  | 
		8  |   name               = "${local.application_name}-lb-sandbox"
		9  |   internal           = false
		10 |   load_balancer_type = "application"
		11 |   security_groups    = [aws_security_group.load_balancer_security_group_sandbox[0].id]
		12 |   subnets            = data.aws_subnets.shared-public.ids
		13 | 
		14 |   drop_invalid_header_fields = true
		15 | 
		16 |   tags = merge(
		17 |     local.tags,
		18 |     {
		19 |       Name = "${local.application_name}-sandbox"
		20 |     }
		21 |   )
		22 | }

Check: CKV_AWS_118: "Ensure that enhanced monitoring is enabled for Amazon RDS instances"
	FAILED for resource: aws_db_instance.jitbit_sandbox
	File: /sandbox_rds.tf:27-70
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/ensure-that-enhanced-monitoring-is-enabled-for-amazon-rds-instances

		27 | resource "aws_db_instance" "jitbit_sandbox" {
		28 |   count = local.is-development ? 1 : 0
		29 | 
		30 |   engine         = "sqlserver-se"
		31 |   license_model  = "license-included"
		32 |   engine_version = local.application_data.accounts["sandbox"].db_engine_version
		33 |   instance_class = local.application_data.accounts["sandbox"].db_instance_class
		34 |   identifier     = "${local.application_name}-sandbox-database"
		35 |   username       = local.application_data.accounts["sandbox"].db_user
		36 | 
		37 |   manage_master_user_password = true
		38 | 
		39 |   snapshot_identifier = try(local.application_data.accounts["sandbox"].db_snapshot_identifier, null)
		40 | 
		41 |   # tflint-ignore: aws_db_instance_default_parameter_group
		42 |   parameter_group_name        = "default.sqlserver-se-15.0"
		43 |   deletion_protection         = local.application_data.accounts["sandbox"].db_deletion_protection
		44 |   delete_automated_backups    = local.application_data.accounts["sandbox"].db_delete_automated_backups
		45 |   skip_final_snapshot         = local.application_data.accounts["sandbox"].db_skip_final_snapshot
		46 |   final_snapshot_identifier   = !local.skip_final_snapshot ? "${local.application_name}-sandbox-database-final-snapshot" : null
		47 |   allocated_storage           = local.application_data.accounts["sandbox"].db_allocated_storage
		48 |   max_allocated_storage       = local.application_data.accounts["sandbox"].db_max_allocated_storage
		49 |   storage_type                = local.application_data.accounts["sandbox"].db_storage_type
		50 |   maintenance_window          = local.application_data.accounts["sandbox"].db_maintenance_window
		51 |   auto_minor_version_upgrade  = local.application_data.accounts["sandbox"].db_auto_minor_version_upgrade
		52 |   allow_major_version_upgrade = local.application_data.accounts["sandbox"].db_allow_major_version_upgrade
		53 |   backup_window               = local.application_data.accounts["sandbox"].db_backup_window
		54 |   backup_retention_period     = local.application_data.accounts["sandbox"].db_retention_period
		55 |   #checkov:skip=CKV_AWS_133: "backup_retention enabled, can be edited it application_variables.json"
		56 |   iam_database_authentication_enabled = local.application_data.accounts["sandbox"].db_iam_database_authentication_enabled
		57 |   #checkov:skip=CKV_AWS_161: "iam auth enabled, but optional"
		58 |   db_subnet_group_name   = aws_db_subnet_group.jitbit.id
		59 |   vpc_security_group_ids = [aws_security_group.database_security_group_sandbox[0].id]
		60 |   multi_az               = local.application_data.accounts["sandbox"].db_multi_az
		61 |   #checkov:skip=CKV_AWS_157: "multi-az enabled, but optional"
		62 |   storage_encrypted = true
		63 | 
		64 |   tags = merge(
		65 |     local.tags,
		66 |     {
		67 |       Name = lower(format("%s-%s-database", local.application_name, "sandbox"))
		68 |     }
		69 |   )
		70 | }

Check: CKV_AWS_129: "Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled"
	FAILED for resource: aws_db_instance.jitbit_sandbox
	File: /sandbox_rds.tf:27-70
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-that-respective-logs-of-amazon-relational-database-service-amazon-rds-are-enabled

		27 | resource "aws_db_instance" "jitbit_sandbox" {
		28 |   count = local.is-development ? 1 : 0
		29 | 
		30 |   engine         = "sqlserver-se"
		31 |   license_model  = "license-included"
		32 |   engine_version = local.application_data.accounts["sandbox"].db_engine_version
		33 |   instance_class = local.application_data.accounts["sandbox"].db_instance_class
		34 |   identifier     = "${local.application_name}-sandbox-database"
		35 |   username       = local.application_data.accounts["sandbox"].db_user
		36 | 
		37 |   manage_master_user_password = true
		38 | 
		39 |   snapshot_identifier = try(local.application_data.accounts["sandbox"].db_snapshot_identifier, null)
		40 | 
		41 |   # tflint-ignore: aws_db_instance_default_parameter_group
		42 |   parameter_group_name        = "default.sqlserver-se-15.0"
		43 |   deletion_protection         = local.application_data.accounts["sandbox"].db_deletion_protection
		44 |   delete_automated_backups    = local.application_data.accounts["sandbox"].db_delete_automated_backups
		45 |   skip_final_snapshot         = local.application_data.accounts["sandbox"].db_skip_final_snapshot
		46 |   final_snapshot_identifier   = !local.skip_final_snapshot ? "${local.application_name}-sandbox-database-final-snapshot" : null
		47 |   allocated_storage           = local.application_data.accounts["sandbox"].db_allocated_storage
		48 |   max_allocated_storage       = local.application_data.accounts["sandbox"].db_max_allocated_storage
		49 |   storage_type                = local.application_data.accounts["sandbox"].db_storage_type
		50 |   maintenance_window          = local.application_data.accounts["sandbox"].db_maintenance_window
		51 |   auto_minor_version_upgrade  = local.application_data.accounts["sandbox"].db_auto_minor_version_upgrade
		52 |   allow_major_version_upgrade = local.application_data.accounts["sandbox"].db_allow_major_version_upgrade
		53 |   backup_window               = local.application_data.accounts["sandbox"].db_backup_window
		54 |   backup_retention_period     = local.application_data.accounts["sandbox"].db_retention_period
		55 |   #checkov:skip=CKV_AWS_133: "backup_retention enabled, can be edited it application_variables.json"
		56 |   iam_database_authentication_enabled = local.application_data.accounts["sandbox"].db_iam_database_authentication_enabled
		57 |   #checkov:skip=CKV_AWS_161: "iam auth enabled, but optional"
		58 |   db_subnet_group_name   = aws_db_subnet_group.jitbit.id
		59 |   vpc_security_group_ids = [aws_security_group.database_security_group_sandbox[0].id]
		60 |   multi_az               = local.application_data.accounts["sandbox"].db_multi_az
		61 |   #checkov:skip=CKV_AWS_157: "multi-az enabled, but optional"
		62 |   storage_encrypted = true
		63 | 
		64 |   tags = merge(
		65 |     local.tags,
		66 |     {
		67 |       Name = lower(format("%s-%s-database", local.application_name, "sandbox"))
		68 |     }
		69 |   )
		70 | }

Check: CKV_AWS_354: "Ensure RDS Performance Insights are encrypted using KMS CMKs"
	FAILED for resource: aws_db_instance.jitbit_sandbox
	File: /sandbox_rds.tf:27-70
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-354

		27 | resource "aws_db_instance" "jitbit_sandbox" {
		28 |   count = local.is-development ? 1 : 0
		29 | 
		30 |   engine         = "sqlserver-se"
		31 |   license_model  = "license-included"
		32 |   engine_version = local.application_data.accounts["sandbox"].db_engine_version
		33 |   instance_class = local.application_data.accounts["sandbox"].db_instance_class
		34 |   identifier     = "${local.application_name}-sandbox-database"
		35 |   username       = local.application_data.accounts["sandbox"].db_user
		36 | 
		37 |   manage_master_user_password = true
		38 | 
		39 |   snapshot_identifier = try(local.application_data.accounts["sandbox"].db_snapshot_identifier, null)
		40 | 
		41 |   # tflint-ignore: aws_db_instance_default_parameter_group
		42 |   parameter_group_name        = "default.sqlserver-se-15.0"
		43 |   deletion_protection         = local.application_data.accounts["sandbox"].db_deletion_protection
		44 |   delete_automated_backups    = local.application_data.accounts["sandbox"].db_delete_automated_backups
		45 |   skip_final_snapshot         = local.application_data.accounts["sandbox"].db_skip_final_snapshot
		46 |   final_snapshot_identifier   = !local.skip_final_snapshot ? "${local.application_name}-sandbox-database-final-snapshot" : null
		47 |   allocated_storage           = local.application_data.accounts["sandbox"].db_allocated_storage
		48 |   max_allocated_storage       = local.application_data.accounts["sandbox"].db_max_allocated_storage
		49 |   storage_type                = local.application_data.accounts["sandbox"].db_storage_type
		50 |   maintenance_window          = local.application_data.accounts["sandbox"].db_maintenance_window
		51 |   auto_minor_version_upgrade  = local.application_data.accounts["sandbox"].db_auto_minor_version_upgrade
		52 |   allow_major_version_upgrade = local.application_data.accounts["sandbox"].db_allow_major_version_upgrade
		53 |   backup_window               = local.application_data.accounts["sandbox"].db_backup_window
		54 |   backup_retention_period     = local.application_data.accounts["sandbox"].db_retention_period
		55 |   #checkov:skip=CKV_AWS_133: "backup_retention enabled, can be edited it application_variables.json"
		56 |   iam_database_authentication_enabled = local.application_data.accounts["sandbox"].db_iam_database_authentication_enabled
		57 |   #checkov:skip=CKV_AWS_161: "iam auth enabled, but optional"
		58 |   db_subnet_group_name   = aws_db_subnet_group.jitbit.id
		59 |   vpc_security_group_ids = [aws_security_group.database_security_group_sandbox[0].id]
		60 |   multi_az               = local.application_data.accounts["sandbox"].db_multi_az
		61 |   #checkov:skip=CKV_AWS_157: "multi-az enabled, but optional"
		62 |   storage_encrypted = true
		63 | 
		64 |   tags = merge(
		65 |     local.tags,
		66 |     {
		67 |       Name = lower(format("%s-%s-database", local.application_name, "sandbox"))
		68 |     }
		69 |   )
		70 | }

Check: CKV_AWS_353: "Ensure that RDS instances have performance insights enabled"
	FAILED for resource: aws_db_instance.jitbit_sandbox
	File: /sandbox_rds.tf:27-70
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-353

		27 | resource "aws_db_instance" "jitbit_sandbox" {
		28 |   count = local.is-development ? 1 : 0
		29 | 
		30 |   engine         = "sqlserver-se"
		31 |   license_model  = "license-included"
		32 |   engine_version = local.application_data.accounts["sandbox"].db_engine_version
		33 |   instance_class = local.application_data.accounts["sandbox"].db_instance_class
		34 |   identifier     = "${local.application_name}-sandbox-database"
		35 |   username       = local.application_data.accounts["sandbox"].db_user
		36 | 
		37 |   manage_master_user_password = true
		38 | 
		39 |   snapshot_identifier = try(local.application_data.accounts["sandbox"].db_snapshot_identifier, null)
		40 | 
		41 |   # tflint-ignore: aws_db_instance_default_parameter_group
		42 |   parameter_group_name        = "default.sqlserver-se-15.0"
		43 |   deletion_protection         = local.application_data.accounts["sandbox"].db_deletion_protection
		44 |   delete_automated_backups    = local.application_data.accounts["sandbox"].db_delete_automated_backups
		45 |   skip_final_snapshot         = local.application_data.accounts["sandbox"].db_skip_final_snapshot
		46 |   final_snapshot_identifier   = !local.skip_final_snapshot ? "${local.application_name}-sandbox-database-final-snapshot" : null
		47 |   allocated_storage           = local.application_data.accounts["sandbox"].db_allocated_storage
		48 |   max_allocated_storage       = local.application_data.accounts["sandbox"].db_max_allocated_storage
		49 |   storage_type                = local.application_data.accounts["sandbox"].db_storage_type
		50 |   maintenance_window          = local.application_data.accounts["sandbox"].db_maintenance_window
		51 |   auto_minor_version_upgrade  = local.application_data.accounts["sandbox"].db_auto_minor_version_upgrade
		52 |   allow_major_version_upgrade = local.application_data.accounts["sandbox"].db_allow_major_version_upgrade
		53 |   backup_window               = local.application_data.accounts["sandbox"].db_backup_window
		54 |   backup_retention_period     = local.application_data.accounts["sandbox"].db_retention_period
		55 |   #checkov:skip=CKV_AWS_133: "backup_retention enabled, can be edited it application_variables.json"
		56 |   iam_database_authentication_enabled = local.application_data.accounts["sandbox"].db_iam_database_authentication_enabled
		57 |   #checkov:skip=CKV_AWS_161: "iam auth enabled, but optional"
		58 |   db_subnet_group_name   = aws_db_subnet_group.jitbit.id
		59 |   vpc_security_group_ids = [aws_security_group.database_security_group_sandbox[0].id]
		60 |   multi_az               = local.application_data.accounts["sandbox"].db_multi_az
		61 |   #checkov:skip=CKV_AWS_157: "multi-az enabled, but optional"
		62 |   storage_encrypted = true
		63 | 
		64 |   tags = merge(
		65 |     local.tags,
		66 |     {
		67 |       Name = lower(format("%s-%s-database", local.application_name, "sandbox"))
		68 |     }
		69 |   )
		70 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: jitbit_bucket_sandbox
	File: /sandbox_s3.tf:1-86
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_273: "Ensure access is controlled through SSO and not AWS IAM defined users"
	FAILED for resource: aws_iam_user.jitbit_ses_smtp_user
	File: /ses.tf:54-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-273

		54 | resource "aws_iam_user" "jitbit_ses_smtp_user" {
		55 |   name = "${local.environment}-jitbit-smtp-user"
		56 | }

Check: CKV_AWS_290: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_user_policy.jitbit_ses_smtp_user
	File: /ses.tf:62-79
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-290

		62 | resource "aws_iam_user_policy" "jitbit_ses_smtp_user" {
		63 |   name = "${local.environment}-jitbit-ses-smtp-user-policy"
		64 |   user = aws_iam_user.jitbit_ses_smtp_user.name
		65 | 
		66 |   policy = jsonencode({
		67 |     Version = "2012-10-17",
		68 |     Statement = [
		69 |       {
		70 |         Effect = "Allow",
		71 |         Action = [
		72 |           "ses:SendRawEmail",
		73 |           "ses:SendEmail"
		74 |         ],
		75 |         Resource = "*"
		76 |       }
		77 |     ]
		78 |   })
		79 | }

Check: CKV_AWS_355: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_user_policy.jitbit_ses_smtp_user
	File: /ses.tf:62-79
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-355

		62 | resource "aws_iam_user_policy" "jitbit_ses_smtp_user" {
		63 |   name = "${local.environment}-jitbit-ses-smtp-user-policy"
		64 |   user = aws_iam_user.jitbit_ses_smtp_user.name
		65 | 
		66 |   policy = jsonencode({
		67 |     Version = "2012-10-17",
		68 |     Statement = [
		69 |       {
		70 |         Effect = "Allow",
		71 |         Action = [
		72 |           "ses:SendRawEmail",
		73 |           "ses:SendEmail"
		74 |         ],
		75 |         Resource = "*"
		76 |       }
		77 |     ]
		78 |   })
		79 | }

Check: CKV_AWS_337: "Ensure SSM parameters are using KMS CMK"
	FAILED for resource: aws_ssm_parameter.jitbit_ses_smtp_user
	File: /ses.tf:81-91
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-337

		81 | resource "aws_ssm_parameter" "jitbit_ses_smtp_user" {
		82 |   name = "/${local.environment}/jitbit/ses_smtp"
		83 |   type = "SecureString"
		84 |   value = jsonencode({
		85 |     user              = aws_iam_user.jitbit_ses_smtp_user.name,
		86 |     key               = aws_iam_access_key.jitbit_ses_smtp_user.id,
		87 |     secret            = aws_iam_access_key.jitbit_ses_smtp_user.secret
		88 |     ses_smtp_user     = aws_iam_access_key.jitbit_ses_smtp_user.id
		89 |     ses_smtp_password = aws_iam_access_key.jitbit_ses_smtp_user.ses_smtp_password_v4
		90 |   })
		91 | }

Check: CKV_AWS_26: "Ensure all data stored in the SNS topic is encrypted"
	FAILED for resource: aws_sns_topic.jitbit_ses_destination_topic_bounce_email_notification
	File: /ses_bounce.tf:1-5
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-15

		1 | resource "aws_sns_topic" "jitbit_ses_destination_topic_bounce_email_notification" {
		2 |   name = format("%s-ses-destination-topic-bounce-email-notification", local.application_name)
		3 | 
		4 |   tags = local.tags
		5 | }

Check: CKV_AWS_115: "Ensure that AWS Lambda function is configured for function-level concurrent execution limit"
	FAILED for resource: aws_lambda_function.bounce_email_notification
	File: /ses_bounce.tf:29-43
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-function-level-concurrent-execution-limit

		29 | resource "aws_lambda_function" "bounce_email_notification" {
		30 |   filename         = "${path.module}/lambda/bounce_email_notification/bounce_email_notification.zip"
		31 |   function_name    = "bounce_email_notification"
		32 |   architectures    = ["arm64"]
		33 |   role             = aws_iam_role.lambda_bounce_email_notification.arn
		34 |   runtime          = "python3.12"
		35 |   handler          = "bounce_email_notification.handler"
		36 |   source_code_hash = data.archive_file.lambda_function_payload_bounce_email_notification.output_base64sha256
		37 | 
		38 |   lifecycle {
		39 |     replace_triggered_by = [aws_iam_role.lambda_bounce_email_notification]
		40 |   }
		41 | 
		42 |   tags = local.tags
		43 | }

Check: CKV_AWS_272: "Ensure AWS Lambda function is configured to validate code-signing"
	FAILED for resource: aws_lambda_function.bounce_email_notification
	File: /ses_bounce.tf:29-43
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-272

		29 | resource "aws_lambda_function" "bounce_email_notification" {
		30 |   filename         = "${path.module}/lambda/bounce_email_notification/bounce_email_notification.zip"
		31 |   function_name    = "bounce_email_notification"
		32 |   architectures    = ["arm64"]
		33 |   role             = aws_iam_role.lambda_bounce_email_notification.arn
		34 |   runtime          = "python3.12"
		35 |   handler          = "bounce_email_notification.handler"
		36 |   source_code_hash = data.archive_file.lambda_function_payload_bounce_email_notification.output_base64sha256
		37 | 
		38 |   lifecycle {
		39 |     replace_triggered_by = [aws_iam_role.lambda_bounce_email_notification]
		40 |   }
		41 | 
		42 |   tags = local.tags
		43 | }

Check: CKV_AWS_117: "Ensure that AWS Lambda function is configured inside a VPC"
	FAILED for resource: aws_lambda_function.bounce_email_notification
	File: /ses_bounce.tf:29-43
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-inside-a-vpc-1

		29 | resource "aws_lambda_function" "bounce_email_notification" {
		30 |   filename         = "${path.module}/lambda/bounce_email_notification/bounce_email_notification.zip"
		31 |   function_name    = "bounce_email_notification"
		32 |   architectures    = ["arm64"]
		33 |   role             = aws_iam_role.lambda_bounce_email_notification.arn
		34 |   runtime          = "python3.12"
		35 |   handler          = "bounce_email_notification.handler"
		36 |   source_code_hash = data.archive_file.lambda_function_payload_bounce_email_notification.output_base64sha256
		37 | 
		38 |   lifecycle {
		39 |     replace_triggered_by = [aws_iam_role.lambda_bounce_email_notification]
		40 |   }
		41 | 
		42 |   tags = local.tags
		43 | }

Check: CKV_AWS_116: "Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)"
	FAILED for resource: aws_lambda_function.bounce_email_notification
	File: /ses_bounce.tf:29-43
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-a-dead-letter-queue-dlq

		29 | resource "aws_lambda_function" "bounce_email_notification" {
		30 |   filename         = "${path.module}/lambda/bounce_email_notification/bounce_email_notification.zip"
		31 |   function_name    = "bounce_email_notification"
		32 |   architectures    = ["arm64"]
		33 |   role             = aws_iam_role.lambda_bounce_email_notification.arn
		34 |   runtime          = "python3.12"
		35 |   handler          = "bounce_email_notification.handler"
		36 |   source_code_hash = data.archive_file.lambda_function_payload_bounce_email_notification.output_base64sha256
		37 | 
		38 |   lifecycle {
		39 |     replace_triggered_by = [aws_iam_role.lambda_bounce_email_notification]
		40 |   }
		41 | 
		42 |   tags = local.tags
		43 | }

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: aws_lambda_function.bounce_email_notification
	File: /ses_bounce.tf:29-43
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		29 | resource "aws_lambda_function" "bounce_email_notification" {
		30 |   filename         = "${path.module}/lambda/bounce_email_notification/bounce_email_notification.zip"
		31 |   function_name    = "bounce_email_notification"
		32 |   architectures    = ["arm64"]
		33 |   role             = aws_iam_role.lambda_bounce_email_notification.arn
		34 |   runtime          = "python3.12"
		35 |   handler          = "bounce_email_notification.handler"
		36 |   source_code_hash = data.archive_file.lambda_function_payload_bounce_email_notification.output_base64sha256
		37 | 
		38 |   lifecycle {
		39 |     replace_triggered_by = [aws_iam_role.lambda_bounce_email_notification]
		40 |   }
		41 | 
		42 |   tags = local.tags
		43 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.bounce_email_notification
	File: /ses_bounce.tf:91-96
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		91 | resource "aws_cloudwatch_log_group" "bounce_email_notification" {
		92 |   name              = "/aws/lambda/bounce_email_notification"
		93 |   retention_in_days = local.application_data.accounts[local.environment].lambda_log_retention_days
		94 | 
		95 |   tags = local.tags
		96 | }
Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.lambda_policy_bounce_email_notification
	File: /ses_bounce.tf:58-75
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		58 | data "aws_iam_policy_document" "lambda_policy_bounce_email_notification" {
		59 |   statement {
		60 |     actions = [
		61 |       "ses:SendRawEmail",
		62 |       "ses:SendEmail"
		63 |     ]
		64 |     resources = ["*"]
		65 |   }
		66 | 
		67 |   statement {
		68 |     actions = [
		69 |       "logs:CreateLogGroup",
		70 |       "logs:CreateLogStream",
		71 |       "logs:PutLogEvents"
		72 |     ]
		73 |     resources = ["arn:aws:logs:*:*:*"]
		74 |   }
		75 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.lambda_policy_bounce_email_notification
	File: /ses_bounce.tf:58-75
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		58 | data "aws_iam_policy_document" "lambda_policy_bounce_email_notification" {
		59 |   statement {
		60 |     actions = [
		61 |       "ses:SendRawEmail",
		62 |       "ses:SendEmail"
		63 |     ]
		64 |     resources = ["*"]
		65 |   }
		66 | 
		67 |   statement {
		68 |     actions = [
		69 |       "logs:CreateLogGroup",
		70 |       "logs:CreateLogStream",
		71 |       "logs:PutLogEvents"
		72 |     ]
		73 |     resources = ["arn:aws:logs:*:*:*"]
		74 |   }
		75 | }

Check: CKV_AWS_337: "Ensure SSM parameters are using KMS CMK"
	FAILED for resource: aws_ssm_parameter.app_url
	File: /ssm.tf:2-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-337

		2 | resource "aws_ssm_parameter" "app_url" {
		3 |   name  = "/${var.networking[0].application}/environment/app-url"
		4 |   type  = "String"
		5 |   value = "https://${local.app_url}/"
		6 | }

Check: CKV_AWS_192: "Ensure WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell"
	FAILED for resource: aws_wafv2_web_acl.this
	File: /waf.tf:1-53
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-waf-prevents-message-lookup-in-log4j2

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.waf
	File: /waf.tf:59-63
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		59 | resource "aws_cloudwatch_log_group" "waf" {
		60 |   name              = "aws-waf-logs-${local.application_name}"
		61 |   retention_in_days = 60
		62 |   tags              = local.tags
		63 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.waf
	File: /waf.tf:59-63
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		59 | resource "aws_cloudwatch_log_group" "waf" {
		60 |   name              = "aws-waf-logs-${local.application_name}"
		61 |   retention_in_days = 60
		62 |   tags              = local.tags
		63 | }

Check: CKV2_AWS_60: "Ensure RDS instance with copy tags to snapshots is enabled"
	FAILED for resource: aws_db_instance.jitbit
	File: /rds.tf:40-83
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-60

		40 | resource "aws_db_instance" "jitbit" {
		41 |   engine         = "sqlserver-se"
		42 |   license_model  = "license-included"
		43 |   engine_version = local.application_data.accounts[local.environment].db_engine_version
		44 |   instance_class = local.application_data.accounts[local.environment].db_instance_class
		45 |   identifier     = "${local.application_name}-${local.environment}-database"
		46 |   username       = local.application_data.accounts[local.environment].db_user
		47 | 
		48 |   manage_master_user_password = true
		49 | 
		50 |   snapshot_identifier = try(local.application_data.accounts[local.environment].db_snapshot_identifier, null)
		51 | 
		52 |   # tflint-ignore: aws_db_instance_default_parameter_group
		53 |   parameter_group_name        = "default.sqlserver-se-15.0"
		54 |   deletion_protection         = local.application_data.accounts[local.environment].db_deletion_protection
		55 |   delete_automated_backups    = local.application_data.accounts[local.environment].db_delete_automated_backups
		56 |   skip_final_snapshot         = local.skip_final_snapshot
		57 |   final_snapshot_identifier   = !local.skip_final_snapshot ? "${local.application_name}-${local.environment}-database-final-snapshot" : null
		58 |   allocated_storage           = local.application_data.accounts[local.environment].db_allocated_storage
		59 |   max_allocated_storage       = local.application_data.accounts[local.environment].db_max_allocated_storage
		60 |   storage_type                = local.application_data.accounts[local.environment].db_storage_type
		61 |   maintenance_window          = local.application_data.accounts[local.environment].db_maintenance_window
		62 |   auto_minor_version_upgrade  = local.application_data.accounts[local.environment].db_auto_minor_version_upgrade
		63 |   allow_major_version_upgrade = local.application_data.accounts[local.environment].db_allow_major_version_upgrade
		64 |   backup_window               = local.application_data.accounts[local.environment].db_backup_window
		65 |   backup_retention_period     = local.application_data.accounts[local.environment].db_retention_period
		66 |   #checkov:skip=CKV_AWS_133: "backup_retention enabled, can be edited it application_variables.json"
		67 |   iam_database_authentication_enabled = local.application_data.accounts[local.environment].db_iam_database_authentication_enabled
		68 |   #checkov:skip=CKV_AWS_161: "iam auth enabled, but optional"
		69 |   db_subnet_group_name   = aws_db_subnet_group.jitbit.id
		70 |   vpc_security_group_ids = [aws_security_group.database_security_group.id]
		71 |   multi_az               = local.application_data.accounts[local.environment].db_multi_az
		72 |   #checkov:skip=CKV_AWS_157: "multi-az enabled, but optional"
		73 |   monitoring_interval = local.application_data.accounts[local.environment].db_monitoring_interval
		74 |   monitoring_role_arn = local.application_data.accounts[local.environment].db_monitoring_interval == 0 ? "" : aws_iam_role.rds_enhanced_monitoring[0].arn
		75 |   #checkov:skip=CKV_AWS_118: "enhanced monitoring is enabled, but optional"
		76 |   storage_encrypted               = true
		77 |   performance_insights_enabled    = local.application_data.accounts[local.environment].db_performance_insights_enabled
		78 |   performance_insights_kms_key_id = "" #tfsec:ignore:aws-rds-enable-performance-insights-encryption Left empty so that it will run, however should be populated with real key in scenario.
		79 |   enabled_cloudwatch_logs_exports = local.application_data.accounts[local.environment].db_enabled_cloudwatch_logs_exports
		80 |   tags = merge(local.tags,
		81 |     { Name = lower(format("%s-%s-database", local.application_name, local.environment)) }
		82 |   )
		83 | }

Check: CKV2_AWS_60: "Ensure RDS instance with copy tags to snapshots is enabled"
	FAILED for resource: aws_db_instance.jitbit_sandbox
	File: /sandbox_rds.tf:27-70
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-60

		27 | resource "aws_db_instance" "jitbit_sandbox" {
		28 |   count = local.is-development ? 1 : 0
		29 | 
		30 |   engine         = "sqlserver-se"
		31 |   license_model  = "license-included"
		32 |   engine_version = local.application_data.accounts["sandbox"].db_engine_version
		33 |   instance_class = local.application_data.accounts["sandbox"].db_instance_class
		34 |   identifier     = "${local.application_name}-sandbox-database"
		35 |   username       = local.application_data.accounts["sandbox"].db_user
		36 | 
		37 |   manage_master_user_password = true
		38 | 
		39 |   snapshot_identifier = try(local.application_data.accounts["sandbox"].db_snapshot_identifier, null)
		40 | 
		41 |   # tflint-ignore: aws_db_instance_default_parameter_group
		42 |   parameter_group_name        = "default.sqlserver-se-15.0"
		43 |   deletion_protection         = local.application_data.accounts["sandbox"].db_deletion_protection
		44 |   delete_automated_backups    = local.application_data.accounts["sandbox"].db_delete_automated_backups
		45 |   skip_final_snapshot         = local.application_data.accounts["sandbox"].db_skip_final_snapshot
		46 |   final_snapshot_identifier   = !local.skip_final_snapshot ? "${local.application_name}-sandbox-database-final-snapshot" : null
		47 |   allocated_storage           = local.application_data.accounts["sandbox"].db_allocated_storage
		48 |   max_allocated_storage       = local.application_data.accounts["sandbox"].db_max_allocated_storage
		49 |   storage_type                = local.application_data.accounts["sandbox"].db_storage_type
		50 |   maintenance_window          = local.application_data.accounts["sandbox"].db_maintenance_window
		51 |   auto_minor_version_upgrade  = local.application_data.accounts["sandbox"].db_auto_minor_version_upgrade
		52 |   allow_major_version_upgrade = local.application_data.accounts["sandbox"].db_allow_major_version_upgrade
		53 |   backup_window               = local.application_data.accounts["sandbox"].db_backup_window
		54 |   backup_retention_period     = local.application_data.accounts["sandbox"].db_retention_period
		55 |   #checkov:skip=CKV_AWS_133: "backup_retention enabled, can be edited it application_variables.json"
		56 |   iam_database_authentication_enabled = local.application_data.accounts["sandbox"].db_iam_database_authentication_enabled
		57 |   #checkov:skip=CKV_AWS_161: "iam auth enabled, but optional"
		58 |   db_subnet_group_name   = aws_db_subnet_group.jitbit.id
		59 |   vpc_security_group_ids = [aws_security_group.database_security_group_sandbox[0].id]
		60 |   multi_az               = local.application_data.accounts["sandbox"].db_multi_az
		61 |   #checkov:skip=CKV_AWS_157: "multi-az enabled, but optional"
		62 |   storage_encrypted = true
		63 | 
		64 |   tags = merge(
		65 |     local.tags,
		66 |     {
		67 |       Name = lower(format("%s-%s-database", local.application_name, "sandbox"))
		68 |     }
		69 |   )
		70 | }

Check: CKV2_AWS_34: "AWS SSM Parameter should be Encrypted"
	FAILED for resource: aws_ssm_parameter.app_url
	File: /ssm.tf:2-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-ssm-parameter-is-encrypted

		2 | resource "aws_ssm_parameter" "app_url" {
		3 |   name  = "/${var.networking[0].application}/environment/app-url"
		4 |   type  = "String"
		5 |   value = "https://${local.app_url}/"
		6 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: aws_security_group.jitbit
	File: /ecs.tf:53-62
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		53 | resource "aws_security_group" "jitbit" {
		54 |   vpc_id      = data.aws_vpc.shared.id
		55 |   name        = format("hmpps-%s-%s-service", local.environment, local.application_name)
		56 |   description = "Security group for the ${local.application_name} service"
		57 |   tags        = local.tags
		58 | 
		59 |   lifecycle {
		60 |     create_before_destroy = true
		61 |   }
		62 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: aws_security_group.jitbit_sandbox
	File: /sandbox_ecs.tf:55-66
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		55 | resource "aws_security_group" "jitbit_sandbox" {
		56 |   count = local.is-development ? 1 : 0
		57 | 
		58 |   vpc_id      = data.aws_vpc.shared.id
		59 |   name        = format("hmpps-%s-%s-service", "sandbox", local.application_name)
		60 |   description = "Security group for the ${local.application_name} service"
		61 |   tags        = local.tags
		62 | 
		63 |   lifecycle {
		64 |     create_before_destroy = true
		65 |   }
		66 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.db_app_connection_string_sandbox
	File: /sandbox_secrets.tf:2-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		2  | resource "aws_secretsmanager_secret" "db_app_connection_string_sandbox" {
		3  |   count = local.is-development ? 1 : 0
		4  |   #checkov:skip=CKV_AWS_149
		5  |   name                    = "${var.networking[0].application}-app-connection-string-sandbox"
		6  |   recovery_window_in_days = 0
		7  |   tags = merge(
		8  |     local.tags,
		9  |     {
		10 |       Name = "${var.networking[0].application}-app-connection-string-sandbox"
		11 |     },
		12 |   )
		13 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.db_app_connection_string
	File: /secrets.tf:5-15
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		5  | resource "aws_secretsmanager_secret" "db_app_connection_string" {
		6  |   #checkov:skip=CKV_AWS_149
		7  |   name                    = "${var.networking[0].application}-app-connection-string"
		8  |   recovery_window_in_days = 0
		9  |   tags = merge(
		10 |     local.tags,
		11 |     {
		12 |       Name = "${var.networking[0].application}-app-connection-string"
		13 |     },
		14 |   )
		15 | }


checkov_exitcode=1

`CTFLint Scan` Failed

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.5.0)
tflint will check the following folders:
terraform/environments/delius-jitbit

*****************************

Running tflint in terraform/environments/delius-jitbit
Excluding the following checks: terraform_unused_declarations
1 issue(s) found:

Warning: Missing version constraint for provider "archive" in `required_providers` (terraform_required_providers)

  on terraform/environments/delius-jitbit/ses_bounce.tf line 22:
  22: data "archive_file" "lambda_function_payload_bounce_email_notification" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_required_providers.md

tflint_exitcode=2

`Trivy Scan` Failed

Show Output

*****************************

Trivy will check the following folders:
terraform/environments/delius-jitbit

*****************************

Running Trivy in terraform/environments/delius-jitbit
2024-05-10T15:12:45Z	INFO	Need to update DB
2024-05-10T15:12:45Z	INFO	Downloading DB...	repository="ghcr.io/aquasecurity/trivy-db:2"
2024-05-10T15:12:47Z	INFO	Vulnerability scanning is enabled
2024-05-10T15:12:47Z	INFO	Misconfiguration scanning is enabled
2024-05-10T15:12:47Z	INFO	Need to update the built-in policies
2024-05-10T15:12:47Z	INFO	Downloading the built-in policies...
50.41 KiB / 50.41 KiB [-----------------------------------------------------------] 100.00% ? p/s 0s2024-05-10T15:12:47Z	INFO	Secret scanning is enabled
2024-05-10T15:12:47Z	INFO	If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-05-10T15:12:47Z	INFO	Please see also https://aquasecurity.github.io/trivy/v0.51/docs/scanner/secret/#recommendation for faster secret detection
2024-05-10T15:12:50Z	INFO	Number of language-specific files	num=0
2024-05-10T15:12:50Z	INFO	Detected config files	num=14

ecs.tf (terraform)
==================
Tests: 2 (SUCCESSES: 1, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 0, CRITICAL: 1)

CRITICAL: Security group rule allows egress to multiple public internet addresses.
════════════════════════════════════════
Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.

See https://avd.aquasec.com/misconfig/avd-aws-0104
────────────────────────────────────────
 ecs.tf:70
   via ecs.tf:64-72 (aws_security_group_rule.allow_all_egress)
────────────────────────────────────────
  64   resource "aws_security_group_rule" "allow_all_egress" {
  65     description       = "Allow all outbound traffic to any IPv4 address"
  66     type              = "egress"
  67     from_port         = 0
  68     to_port           = 0
  69     protocol          = "-1"
  70 [   cidr_blocks       = ["0.0.0.0/0"]
  71     security_group_id = aws_security_group.jitbit.id
  72   }
────────────────────────────────────────



github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.2.1/main.tf (terraform)
==========================================================================================================
Tests: 7 (SUCCESSES: 5, FAILURES: 0, EXCEPTIONS: 2)
Failures: 0 (HIGH: 0, CRITICAL: 0)


github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0/main.tf (terraform)
======================================================================================================
Tests: 14 (SUCCESSES: 12, FAILURES: 2, EXCEPTIONS: 0)
Failures: 2 (HIGH: 2, CRITICAL: 0)

HIGH: Bucket does not encrypt data with a customer managed key.
════════════════════════════════════════
Encryption using AWS keys provides protection for your S3 buckets. To increase control of the encryption and manage factors like rotation use customer managed keys.

See https://avd.aquasec.com/misconfig/avd-aws-0132
────────────────────────────────────────
 github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0/main.tf:157-165
   via s3.tf:1-84 (module.jitbit_bucket)
────────────────────────────────────────
 157 ┌ resource "aws_s3_bucket_server_side_encryption_configuration" "default" {
 158 │   bucket = aws_s3_bucket.default.id
 159 │   rule {
 160 │     apply_server_side_encryption_by_default {
 161 │       sse_algorithm     = var.sse_algorithm
 162 │       kms_master_key_id = (var.custom_kms_key != "") ? var.custom_kms_key : ""
 163 │     }
 164 │   }
 165 └ }
────────────────────────────────────────


HIGH: Bucket does not encrypt data with a customer managed key.
════════════════════════════════════════
Encryption using AWS keys provides protection for your S3 buckets. To increase control of the encryption and manage factors like rotation use customer managed keys.

See https://avd.aquasec.com/misconfig/avd-aws-0132
────────────────────────────────────────
 github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0/main.tf:157-165
   via ecs.tf:11-51 (module.s3_bucket_app_deployment)
────────────────────────────────────────
 157 ┌ resource "aws_s3_bucket_server_side_encryption_configuration" "default" {
 158 │   bucket = aws_s3_bucket.default.id
 159 │   rule {
 160 │     apply_server_side_encryption_by_default {
 161 │       sse_algorithm     = var.sse_algorithm
 162 │       kms_master_key_id = (var.custom_kms_key != "") ? var.custom_kms_key : ""
 163 │     }
 164 │   }
 165 └ }
────────────────────────────────────────



iam.tf (terraform)
==================
Tests: 6 (SUCCESSES: 0, FAILURES: 0, EXCEPTIONS: 6)
Failures: 0 (HIGH: 0, CRITICAL: 0)


lb.tf (terraform)
=================
Tests: 7 (SUCCESSES: 4, FAILURES: 2, EXCEPTIONS: 1)
Failures: 2 (HIGH: 0, CRITICAL: 2)

CRITICAL: Security group rule allows ingress from public internet.
════════════════════════════════════════
Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.

See https://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
 lb.tf:62-70
   via lb.tf:35-71 (ingress)
    via lb.tf:30-87 (aws_security_group.load_balancer_security_group)
────────────────────────────────────────
  30   resource "aws_security_group" "load_balancer_security_group" {
  ..   
  62 ┌     ipv6_cidr_blocks = [
  63 │       # Route53 Healthcheck Access Cidrs IPv6
  64 │       "2406:da18:7ff:f800::/53",  # ap-southeast-1 Region
  65 │       "2406:da18:fff:f800::/53",  # ap-southeast-1 Region
  66 │       "2a05:d018:fff:f800::/53",  # eu-west-1 Region
  67 │       "2a05:d018:7ff:f800::/53",  # eu-west-1 Region
  68 └       "2600:1f18:7fff:f800::/53", # us-east-1 Region
  ..   
────────────────────────────────────────


CRITICAL: Security group rule allows ingress from public internet.
════════════════════════════════════════
Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.

See https://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
 lb.tf:40-60
   via lb.tf:35-71 (ingress)
    via lb.tf:30-87 (aws_security_group.load_balancer_security_group)
────────────────────────────────────────
  30   resource "aws_security_group" "load_balancer_security_group" {
  ..   
  40 ┌     cidr_blocks = distinct(flatten([
  41 │       "20.49.214.199/32", # Azure Landing Zone Egress
  42 │       "20.49.214.228/32", # Azure Landing Zone Egress
  43 │       "20.26.11.71/32",   # Azure Landing Zone Egress
  44 │       "20.26.11.108/32",  # Azure Landing Zone Egress
  45 │       # Route53 Healthcheck Access Cidrs
  46 └       # London Region not support yet, so metrics are not yet publised, can be enabled at later stage for Route53 endpoint monitor
  ..   
────────────────────────────────────────



monitoring.tf (terraform)
=========================
Tests: 2 (SUCCESSES: 1, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Topic does not have encryption enabled.
════════════════════════════════════════
Topics should be encrypted to protect their contents.

See https://avd.aquasec.com/misconfig/avd-aws-0095
────────────────────────────────────────
 monitoring.tf:6-8
────────────────────────────────────────
   6 ┌ resource "aws_sns_topic" "jitbit_alerting" {
   7 │   name = "jitbit_alerting"
   8 └ }
────────────────────────────────────────



ses.tf (terraform)
==================
Tests: 2 (SUCCESSES: 0, FAILURES: 0, EXCEPTIONS: 2)
Failures: 0 (HIGH: 0, CRITICAL: 0)


ses_bounce.tf (terraform)
=========================
Tests: 6 (SUCCESSES: 2, FAILURES: 1, EXCEPTIONS: 3)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Topic does not have encryption enabled.
════════════════════════════════════════
Topics should be encrypted to protect their contents.

See https://avd.aquasec.com/misconfig/avd-aws-0095
────────────────────────────────────────
 ses_bounce.tf:1-5
────────────────────────────────────────
   1 ┌ resource "aws_sns_topic" "jitbit_ses_destination_topic_bounce_email_notification" {
   2 │   name = format("%s-ses-destination-topic-bounce-email-notification", local.application_name)
   3 │ 
   4 │   tags = local.tags
   5 └ }
────────────────────────────────────────


trivy_exitcode=1

Create ses-logging.tf

6a12074

georgepstaylor requested review from a team as code owners May 10, 2024 15:03

github-actions bot added the environments-repository Used to exclude PRs from this repo in our Slack PR update label May 10, 2024

comment out

d19d09c

andrewmooreio previously approved these changes May 10, 2024

View reviewed changes

Update ses_logging.tf

4d8a57f

georgepstaylor dismissed andrewmooreio’s stale review via 4d8a57f May 10, 2024 15:10

andrewmooreio approved these changes May 10, 2024

View reviewed changes

georgepstaylor had a problem deploying to delius-jitbit-development May 10, 2024 15:11 — with GitHub Actions Failure

georgepstaylor had a problem deploying to delius-jitbit-test May 10, 2024 15:11 — with GitHub Actions Failure

georgepstaylor merged commit 7738e64 into main May 10, 2024
13 of 16 checks passed

georgepstaylor deleted the tmp-remove-lambda branch May 10, 2024 15:12

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

tmp remove lamdba #6039

tmp remove lamdba #6039

georgepstaylor commented May 10, 2024

github-actions bot commented May 10, 2024

ecs.tf (terraform)

github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.2.1/main.tf (terraform)

github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0/main.tf (terraform)

iam.tf (terraform)

lb.tf (terraform)

monitoring.tf (terraform)

ses-logging.tf (terraform)

ses.tf (terraform)

ses_bounce.tf (terraform)

ses_logging.tf (terraform)

github-actions bot commented May 10, 2024

ecs.tf (terraform)

github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.2.1/main.tf (terraform)

github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0/main.tf (terraform)

iam.tf (terraform)

lb.tf (terraform)

monitoring.tf (terraform)

ses.tf (terraform)

ses_bounce.tf (terraform)

github-actions bot commented May 10, 2024

ecs.tf (terraform)

github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.2.1/main.tf (terraform)

github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0/main.tf (terraform)

iam.tf (terraform)

lb.tf (terraform)

monitoring.tf (terraform)

ses.tf (terraform)

ses_bounce.tf (terraform)

tmp remove lamdba #6039

tmp remove lamdba #6039

Conversation

georgepstaylor commented May 10, 2024

github-actions bot commented May 10, 2024

Trivy Scan Failed

ecs.tf (terraform)

github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.2.1/main.tf (terraform)

github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0/main.tf (terraform)

iam.tf (terraform)

lb.tf (terraform)

monitoring.tf (terraform)

ses-logging.tf (terraform)

ses.tf (terraform)

ses_bounce.tf (terraform)

ses_logging.tf (terraform)

CTFLint Scan Failed

Trivy Scan Failed

github-actions bot commented May 10, 2024

Trivy Scan Failed

ecs.tf (terraform)

github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.2.1/main.tf (terraform)

github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0/main.tf (terraform)

iam.tf (terraform)

lb.tf (terraform)

monitoring.tf (terraform)

ses.tf (terraform)

ses_bounce.tf (terraform)

CTFLint Scan Failed

Trivy Scan Failed

github-actions bot commented May 10, 2024

Trivy Scan Failed

ecs.tf (terraform)

github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.2.1/main.tf (terraform)

github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0/main.tf (terraform)

iam.tf (terraform)

lb.tf (terraform)

monitoring.tf (terraform)

ses.tf (terraform)

ses_bounce.tf (terraform)

CTFLint Scan Failed

Trivy Scan Failed

`Trivy Scan` Failed

`CTFLint Scan` Failed

`Trivy Scan` Failed

`Trivy Scan` Failed

`CTFLint Scan` Failed

`Trivy Scan` Failed

`Trivy Scan` Failed

`CTFLint Scan` Failed

`Trivy Scan` Failed