Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bump ap_landing_bucket::modernisation-platform-terraform-s3-bucket from 7.1.0 to 8.0.0 in /terraform/environments/performance-hub #6899

Closed
wants to merge 1 commit into from
Closed

Bump ap_landing_bucket::modernisation-platform-terraform-s3-bucket from 7.1.0 to 8.0.0 in /terraform/environments/performance-hub #6899

wants to merge 1 commit into from

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Jul 5, 2024

Bumps ap_landing_bucket::modernisation-platform-terraform-s3-bucket from 7.1.0 to 8.0.0.

Release notes

Sourced from ap_landing_bucket::modernisation-platform-terraform-s3-bucket's releases.

v8.0.0

Breaking Changes

Module for creating IAM role for replication has been integrated into this S3-bucket module so includes functionality for an IAM role to enable the replication of objects between S3 buckets in different regions.

The breaking changes only apply to pre existing replication buckets, used by this module here. If you currently do not use the replication module, you will not be affected.

  • 'versioning_enabled' is not optional and must be set to true for both source and destination bucket.
  • 'ownership_controls' variable must be set to 'BucketOwnerEnforced' for full control of all objects in the bucket and to disable ACLs.
  • The KMS key used for encryption must be in the same region as the destination bucket.

If any more information is required, feel free to reach out to Khatra Farah or Edd Proctor.

What's Changed

... (truncated)

Commits
  • cadab51 Merge pull request #446 from ministryofjustice/test/s3-replication
  • 26143c6 Commit changes made by code formatters
  • 25e42ee terraform-docs: automated action
  • 19968ac more changes to enable integration of replication role module into the s3 buc...
  • 08263e7 Merge pull request #445 from ministryofjustice/dependabot/github_actions/gith...
  • 114ab56 Bump github/codeql-action from 3.25.7 to 3.25.8
  • 0b7ae44 Merge pull request #442 from ministryofjustice/dependabot/github_actions/terr...
  • f72dcef Merge pull request #444 from ministryofjustice/dependabot/github_actions/brid...
  • dc6715e Bump bridgecrewio/checkov-action from 12.2768.0 to 12.2769.0
  • 31806f8 Merge pull request #443 from ministryofjustice/dependabot/github_actions/brid...
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
Bump ap_landing_bucket::modernisation-platform-terraform-s3-bucket
e3085da 
Bumps [ap_landing_bucket::modernisation-platform-terraform-s3-bucket](https://github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket) from 7.1.0 to 8.0.0.
- [Release notes](https://github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket/releases)
- [Commits](ministryofjustice/modernisation-platform-terraform-s3-bucket@v7.1.0...v8.0.0)

---
updated-dependencies:
- dependency-name: ap_landing_bucket::github::ministryofjustice/modernisation-platform-terraform-s3-bucket::v7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file terraform Pull requests that update Terraform code labels Jul 5, 2024
@dependabot dependabot bot requested review from a team as code owners July 5, 2024 00:55
@github-actions github-actions bot added the environments-repository Used to exclude PRs from this repo in our Slack PR update label Jul 5, 2024
@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Jul 5, 2024

Trivy Scan Failed

Show Output ```hcl

Trivy will check the following folders:
terraform/environments/performance-hub

Running Trivy in terraform/environments/performance-hub
2024-07-05T00:57:53Z INFO Need to update DB
2024-07-05T00:57:53Z INFO Downloading DB... repository="ghcr.io/aquasecurity/trivy-db:2"
2024-07-05T00:57:55Z INFO Vulnerability scanning is enabled
2024-07-05T00:57:55Z INFO Misconfiguration scanning is enabled
2024-07-05T00:57:55Z INFO Need to update the built-in policies
2024-07-05T00:57:55Z INFO Downloading the built-in policies...
74.86 KiB / 74.86 KiB [-----------------------------------------------------------] 100.00% ? p/s 0s2024-07-05T00:57:56Z INFO Secret scanning is enabled
2024-07-05T00:57:56Z INFO If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-07-05T00:57:56Z INFO Please see also https://aquasecurity.github.io/trivy/v0.53/docs/scanner/secret#recommendation for faster secret detection
2024-07-05T00:57:59Z INFO Number of language-specific files num=0
2024-07-05T00:57:59Z INFO Detected config files num=11

database.tf (terraform)

Tests: 16 (SUCCESSES: 11, FAILURES: 4, EXCEPTIONS: 1)
Failures: 4 (HIGH: 4, CRITICAL: 0)

HIGH: No public access block so not blocking public acls
════════════════════════════════════════

S3 buckets should block public ACLs on buckets and any objects they contain. By blocking, PUTs with fail if the object has any public ACL a.

See https://avd.aquasec.com/misconfig/avd-aws-0086
────────────────────────────────────────
database.tf:166-182
────────────────────────────────────────
166 ┌ resource "aws_s3_bucket" "database_backup_files" {
167 │ #checkov:skip=CKV_AWS_18
168 │ #checkov:skip=CKV_AWS_144
169 │ #checkov:skip=CKV2_AWS_6
170 │ bucket = "${local.application_name}-db-backups-${local.environment}"
171 │
172 │ lifecycle {
173 │ prevent_destroy = true
174 └ }
...
────────────────────────────────────────

HIGH: No public access block so not blocking public policies
════════════════════════════════════════

S3 bucket policy should have block public policy to prevent users from putting a policy that enable public access.

See https://avd.aquasec.com/misconfig/avd-aws-0087
────────────────────────────────────────
database.tf:166-182
────────────────────────────────────────
166 ┌ resource "aws_s3_bucket" "database_backup_files" {
167 │ #checkov:skip=CKV_AWS_18
168 │ #checkov:skip=CKV_AWS_144
169 │ #checkov:skip=CKV2_AWS_6
170 │ bucket = "${local.application_name}-db-backups-${local.environment}"
171 │
172 │ lifecycle {
173 │ prevent_destroy = true
174 └ }
...
────────────────────────────────────────

HIGH: No public access block so not ignoring public acls
════════════════════════════════════════

S3 buckets should ignore public ACLs on buckets and any objects they contain. By ignoring rather than blocking, PUT calls with public ACLs will still be applied but the ACL will be ignored.

See https://avd.aquasec.com/misconfig/avd-aws-0091
────────────────────────────────────────
database.tf:166-182
────────────────────────────────────────
166 ┌ resource "aws_s3_bucket" "database_backup_files" {
167 │ #checkov:skip=CKV_AWS_18
168 │ #checkov:skip=CKV_AWS_144
169 │ #checkov:skip=CKV2_AWS_6
170 │ bucket = "${local.application_name}-db-backups-${local.environment}"
171 │
172 │ lifecycle {
173 │ prevent_destroy = true
174 └ }
...
────────────────────────────────────────

HIGH: No public access block so not restricting public buckets
════════════════════════════════════════
S3 buckets should restrict public policies for the bucket. By enabling, the restrict_public_buckets, only the bucket owner and AWS Services can access if it has a public policy.

See https://avd.aquasec.com/misconfig/avd-aws-0093
────────────────────────────────────────
database.tf:166-182
────────────────────────────────────────
166 ┌ resource "aws_s3_bucket" "database_backup_files" {
167 │ #checkov:skip=CKV_AWS_18
168 │ #checkov:skip=CKV_AWS_144
169 │ #checkov:skip=CKV2_AWS_6
170 │ bucket = "${local.application_name}-db-backups-${local.environment}"
171 │
172 │ lifecycle {
173 │ prevent_destroy = true
174 └ }
...
────────────────────────────────────────

db_manager.tf (terraform)

Tests: 2 (SUCCESSES: 1, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 0, CRITICAL: 1)

CRITICAL: Security group rule allows egress to multiple public internet addresses.
════════════════════════════════════════
Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.

See https://avd.aquasec.com/misconfig/avd-aws-0104
────────────────────────────────────────
db_manager.tf:147-149
via db_manager.tf:141-150 (egress)
via db_manager.tf:128-158 (aws_security_group.db_mgmt_server_security_group)
────────────────────────────────────────
128 resource "aws_security_group" "db_mgmt_server_security_group" {
...
147 ┌ cidr_blocks = [
148 │ "0.0.0.0/0",
149 └ ]
...
158 }
────────────────────────────────────────

github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.2.1/main.tf (terraform)

Tests: 16 (SUCCESSES: 5, FAILURES: 0, EXCEPTIONS: 11)
Failures: 0 (HIGH: 0, CRITICAL: 0)

loadbalancer.tf (terraform)

Tests: 9 (SUCCESSES: 3, FAILURES: 6, EXCEPTIONS: 0)
Failures: 6 (HIGH: 2, CRITICAL: 4)

HIGH: Application load balancer is not set to drop invalid headers.
════════════════════════════════════════
Passing unknown or invalid headers through to the target poses a potential risk of compromise.

By setting drop_invalid_header_fields to true, anything that doe not conform to well known, defined headers will be removed by the load balancer.

See https://avd.aquasec.com/misconfig/avd-aws-0052
────────────────────────────────────────
loadbalancer.tf:5-25
────────────────────────────────────────
5 ┌ resource "aws_lb" "external" {
6 │ #checkov:skip=CKV_AWS_91
7 │ #checkov:skip=CKV_AWS_131
8 │ #checkov:skip=CKV2_AWS_20
9 │ #checkov:skip=CKV2_AWS_28
10 │ name = "${local.application_name}-loadbalancer"
11 │ load_balancer_type = "application"
12 │ subnets = data.aws_subnets.shared-public.ids
13 └ enable_deletion_protection = true
..
────────────────────────────────────────

HIGH: Load balancer is exposed publicly.
════════════════════════════════════════
There are many scenarios in which you would want to expose a load balancer to the wider internet, but this check exists as a warning to prevent accidental exposure of internal assets. You should ensure that this resource should be exposed publicly.

See https://avd.aquasec.com/misconfig/avd-aws-0053
────────────────────────────────────────
loadbalancer.tf:5-25
────────────────────────────────────────
5 ┌ resource "aws_lb" "external" {
6 │ #checkov:skip=CKV_AWS_91
7 │ #checkov:skip=CKV_AWS_131
8 │ #checkov:skip=CKV2_AWS_20
9 │ #checkov:skip=CKV2_AWS_28
10 │ name = "${local.application_name}-loadbalancer"
11 │ load_balancer_type = "application"
12 │ subnets = data.aws_subnets.shared-public.ids
13 └ enable_deletion_protection = true
..
────────────────────────────────────────

CRITICAL: Listener for application load balancer does not use HTTPS.
════════════════════════════════════════
Plain HTTP is unencrypted and human-readable. This means that if a malicious actor was to eavesdrop on your connection, they would be able to see all of your data flowing back and forth.

You should use HTTPS, which is HTTP over an encrypted (TLS) connection, meaning eavesdroppers cannot read your traffic.

See https://avd.aquasec.com/misconfig/avd-aws-0054
────────────────────────────────────────
loadbalancer.tf:63
via loadbalancer.tf:58-69 (aws_lb_listener.listener)
────────────────────────────────────────
58 resource "aws_lb_listener" "listener" {
..
63 [ protocol = "HTTP"
..
69 }
────────────────────────────────────────

CRITICAL: Security group rule allows egress to multiple public internet addresses.
════════════════════════════════════════
Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.

See https://avd.aquasec.com/misconfig/avd-aws-0104
────────────────────────────────────────
loadbalancer.tf:116-118
via loadbalancer.tf:110-119 (egress)
via loadbalancer.tf:87-127 (aws_security_group.load_balancer_security_group)
────────────────────────────────────────
87 resource "aws_security_group" "load_balancer_security_group" {
..
116 ┌ cidr_blocks = [
117 │ "0.0.0.0/0",
118 └ ]
...
127 }
────────────────────────────────────────

CRITICAL: Security group rule allows ingress from public internet.
════════════════════════════════════════
Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.

See https://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
loadbalancer.tf:98
via loadbalancer.tf:92-99 (ingress)
via loadbalancer.tf:87-127 (aws_security_group.load_balancer_security_group)
────────────────────────────────────────
87 resource "aws_security_group" "load_balancer_security_group" {
..
98 [ cidr_blocks = ["0.0.0.0/0", ]
...
127 }
────────────────────────────────────────

CRITICAL: Security group rule allows ingress from public internet.
════════════════════════════════════════
Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.

See https://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
loadbalancer.tf:107
via loadbalancer.tf:101-108 (ingress)
via loadbalancer.tf:87-127 (aws_security_group.load_balancer_security_group)
────────────────────────────────────────
87 resource "aws_security_group" "load_balancer_security_group" {
..
107 [ cidr_blocks = ["0.0.0.0/0", ]
...
127 }
────────────────────────────────────────

module/ecs/main.tf (terraform)

Tests: 64 (SUCCESSES: 6, FAILURES: 1, EXCEPTIONS: 57)
Failures: 1 (HIGH: 0, CRITICAL: 1)

CRITICAL: Security group rule allows egress to multiple public internet addresses.
════════════════════════════════════════
Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.

See https://avd.aquasec.com/misconfig/avd-aws-0104
────────────────────────────────────────
module/ecs/main.tf:88
via module/ecs/main.tf:83-90 (content)
via module/ecs/main.tf:81-91 (dynamic.egress["cluster_ec2_lb_egress"])
via module/ecs/main.tf:64-99 (aws_security_group.cluster_ec2)
via ecs.tf:5-33 (module.windows-new-ecs)
────────────────────────────────────────
64 resource "aws_security_group" "cluster_ec2" {
..
88 [ cidr_blocks = lookup(egress.value, "cidr_blocks", null)
..
99 }
────────────────────────────────────────

monitoring.tf (terraform)

Tests: 2 (SUCCESSES: 1, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Topic does not have encryption enabled.
════════════════════════════════════════
Topics should be encrypted to protect their contents.

See https://avd.aquasec.com/misconfig/avd-aws-0095
────────────────────────────────────────
monitoring.tf:21-23
────────────────────────────────────────
21 ┌ resource "aws_sns_topic" "ddos_alarm" {
22 │ name = "ddos_alarm"
23 └ }
────────────────────────────────────────

s3.tf (terraform)

Tests: 11 (SUCCESSES: 3, FAILURES: 4, EXCEPTIONS: 4)
Failures: 4 (HIGH: 4, CRITICAL: 0)

HIGH: No public access block so not blocking public acls
════════════════════════════════════════

S3 buckets should block public ACLs on buckets and any objects they contain. By blocking, PUTs with fail if the object has any public ACL a.

See https://avd.aquasec.com/misconfig/avd-aws-0086
────────────────────────────────────────
s3.tf:7-23
────────────────────────────────────────
7 ┌ resource "aws_s3_bucket" "upload_files" {
8 │ #checkov:skip=CKV_AWS_18
9 │ #checkov:skip=CKV_AWS_144
10 │ #checkov:skip=CKV2_AWS_6
11 │ bucket = "${local.application_name}-uploads-${local.environment}"
12 │
13 │ lifecycle {
14 │ prevent_destroy = true
15 └ }
..
────────────────────────────────────────

HIGH: No public access block so not blocking public policies
════════════════════════════════════════

S3 bucket policy should have block public policy to prevent users from putting a policy that enable public access.

See https://avd.aquasec.com/misconfig/avd-aws-0087
────────────────────────────────────────
s3.tf:7-23
────────────────────────────────────────
7 ┌ resource "aws_s3_bucket" "upload_files" {
8 │ #checkov:skip=CKV_AWS_18
9 │ #checkov:skip=CKV_AWS_144
10 │ #checkov:skip=CKV2_AWS_6
11 │ bucket = "${local.application_name}-uploads-${local.environment}"
12 │
13 │ lifecycle {
14 │ prevent_destroy = true
15 └ }
..
────────────────────────────────────────

HIGH: No public access block so not ignoring public acls
════════════════════════════════════════

S3 buckets should ignore public ACLs on buckets and any objects they contain. By ignoring rather than blocking, PUT calls with public ACLs will still be applied but the ACL will be ignored.

See https://avd.aquasec.com/misconfig/avd-aws-0091
────────────────────────────────────────
s3.tf:7-23
────────────────────────────────────────
7 ┌ resource "aws_s3_bucket" "upload_files" {
8 │ #checkov:skip=CKV_AWS_18
9 │ #checkov:skip=CKV_AWS_144
10 │ #checkov:skip=CKV2_AWS_6
11 │ bucket = "${local.application_name}-uploads-${local.environment}"
12 │
13 │ lifecycle {
14 │ prevent_destroy = true
15 └ }
..
────────────────────────────────────────

HIGH: No public access block so not restricting public buckets
════════════════════════════════════════
S3 buckets should restrict public policies for the bucket. By enabling, the restrict_public_buckets, only the bucket owner and AWS Services can access if it has a public policy.

See https://avd.aquasec.com/misconfig/avd-aws-0093
────────────────────────────────────────
s3.tf:7-23
────────────────────────────────────────
7 ┌ resource "aws_s3_bucket" "upload_files" {
8 │ #checkov:skip=CKV_AWS_18
9 │ #checkov:skip=CKV_AWS_144
10 │ #checkov:skip=CKV2_AWS_6
11 │ bucket = "${local.application_name}-uploads-${local.environment}"
12 │
13 │ lifecycle {
14 │ prevent_destroy = true
15 └ }
..
────────────────────────────────────────

trivy_exitcode=1

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/performance-hub

*****************************

Running Checkov in terraform/environments/performance-hub
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2024-07-05 00:58:02,399 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.2.1:None (for external modules, the --download-external-modules flag is required)
2024-07-05 00:58:02,400 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-pagerduty-integration?ref=v2.0.0:None (for external modules, the --download-external-modules flag is required)
2024-07-05 00:58:02,400 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v8.0.0:None (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 247, Failed checks: 41, Skipped checks: 32

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: bastion_linux
	File: /bastion_linux.tf:6-35
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		6  | module "bastion_linux" {
		7  |   source = "github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.2.1"
		8  | 
		9  |   providers = {
		10 |     aws.share-host   = aws.core-vpc # core-vpc-(environment) holds the networking for all accounts
		11 |     aws.share-tenant = aws          # The default provider (unaliased, `aws`) is the tenant
		12 |   }
		13 | 
		14 |   # s3 - used for logs and user ssh public keys
		15 |   bucket_name = "bastion"
		16 |   # public keys
		17 |   public_key_data = local.public_key_data.keys[local.environment]
		18 |   # logs
		19 |   log_auto_clean       = "Enabled"
		20 |   log_standard_ia_days = 30  # days before moving to IA storage
		21 |   log_glacier_days     = 60  # days before moving to Glacier
		22 |   log_expiry_days      = 180 # days before log expiration
		23 |   # bastion
		24 |   allow_ssh_commands = false
		25 | 
		26 |   app_name      = var.networking[0].application
		27 |   business_unit = local.vpc_name
		28 |   subnet_set    = local.subnet_set
		29 |   environment   = local.environment
		30 |   region        = "eu-west-2"
		31 | 
		32 |   # Tags
		33 |   tags_common = local.tags
		34 |   tags_prefix = terraform.workspace
		35 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.rds-kms
	File: /database.tf:306-319
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		306 | data "aws_iam_policy_document" "rds-kms" {
		307 |   #checkov:skip=CKV_AWS_111
		308 |   #checkov:skip=CKV_AWS_109
		309 |   statement {
		310 |     effect    = "Allow"
		311 |     actions   = ["kms:*"]
		312 |     resources = ["*"]
		313 | 
		314 |     principals {
		315 |       type        = "AWS"
		316 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		317 |     }
		318 |   }
		319 | }

Check: CKV_AWS_353: "Ensure that RDS instances have performance insights enabled"
	FAILED for resource: aws_db_instance.database
	File: /database.tf:5-51
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-353

		5  | resource "aws_db_instance" "database" {
		6  |   #tfsec:ignore:AWS099
		7  |   #checkov:skip=CKV_AWS_118
		8  |   #checkov:skip=CKV_AWS_157
		9  |   count                               = local.app_data.accounts[local.environment].db_enabled ? 1 : 0
		10 |   identifier                          = local.application_name
		11 |   allocated_storage                   = local.app_data.accounts[local.environment].db_allocated_storage
		12 |   storage_type                        = "gp2"
		13 |   engine                              = "sqlserver-se"
		14 |   engine_version                      = "15.00.4073.23.v1"
		15 |   license_model                       = "license-included"
		16 |   instance_class                      = local.app_data.accounts[local.environment].db_instance_class
		17 |   multi_az                            = false
		18 |   username                            = local.app_data.accounts[local.environment].db_user
		19 |   password                            = aws_secretsmanager_secret_version.db_password.arn
		20 |   storage_encrypted                   = true
		21 |   iam_database_authentication_enabled = false
		22 |   vpc_security_group_ids              = [aws_security_group.db.id]
		23 |   snapshot_identifier                 = format("arn:aws:rds:eu-west-2:%s:snapshot:%s", data.aws_caller_identity.current.account_id, local.app_data.accounts[local.environment].db_snapshot_identifier)
		24 |   backup_retention_period             = 30
		25 |   maintenance_window                  = "Mon:00:00-Mon:03:00"
		26 |   backup_window                       = "03:00-06:00"
		27 |   final_snapshot_identifier           = "final-snapshot"
		28 |   kms_key_id                          = aws_kms_key.rds.arn
		29 |   deletion_protection                 = false
		30 |   option_group_name                   = aws_db_option_group.db_option_group.name
		31 |   db_subnet_group_name                = aws_db_subnet_group.db.id
		32 |   enabled_cloudwatch_logs_exports     = ["error"]
		33 | 
		34 |   # timeouts {
		35 |   #   create = "40m"
		36 |   #   delete = "40m"
		37 |   #   update = "80m"
		38 |   # }
		39 | 
		40 |   lifecycle {
		41 |     prevent_destroy = true
		42 |   }
		43 | 
		44 |   tags = merge(
		45 |     local.tags,
		46 |     {
		47 |       Name                = "${local.application_name}-database",
		48 |       instance-scheduling = "skip-scheduling"
		49 |     }
		50 |   )
		51 | }

Check: CKV_AWS_354: "Ensure RDS Performance Insights are encrypted using KMS CMKs"
	FAILED for resource: aws_db_instance.database
	File: /database.tf:5-51
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-354

		5  | resource "aws_db_instance" "database" {
		6  |   #tfsec:ignore:AWS099
		7  |   #checkov:skip=CKV_AWS_118
		8  |   #checkov:skip=CKV_AWS_157
		9  |   count                               = local.app_data.accounts[local.environment].db_enabled ? 1 : 0
		10 |   identifier                          = local.application_name
		11 |   allocated_storage                   = local.app_data.accounts[local.environment].db_allocated_storage
		12 |   storage_type                        = "gp2"
		13 |   engine                              = "sqlserver-se"
		14 |   engine_version                      = "15.00.4073.23.v1"
		15 |   license_model                       = "license-included"
		16 |   instance_class                      = local.app_data.accounts[local.environment].db_instance_class
		17 |   multi_az                            = false
		18 |   username                            = local.app_data.accounts[local.environment].db_user
		19 |   password                            = aws_secretsmanager_secret_version.db_password.arn
		20 |   storage_encrypted                   = true
		21 |   iam_database_authentication_enabled = false
		22 |   vpc_security_group_ids              = [aws_security_group.db.id]
		23 |   snapshot_identifier                 = format("arn:aws:rds:eu-west-2:%s:snapshot:%s", data.aws_caller_identity.current.account_id, local.app_data.accounts[local.environment].db_snapshot_identifier)
		24 |   backup_retention_period             = 30
		25 |   maintenance_window                  = "Mon:00:00-Mon:03:00"
		26 |   backup_window                       = "03:00-06:00"
		27 |   final_snapshot_identifier           = "final-snapshot"
		28 |   kms_key_id                          = aws_kms_key.rds.arn
		29 |   deletion_protection                 = false
		30 |   option_group_name                   = aws_db_option_group.db_option_group.name
		31 |   db_subnet_group_name                = aws_db_subnet_group.db.id
		32 |   enabled_cloudwatch_logs_exports     = ["error"]
		33 | 
		34 |   # timeouts {
		35 |   #   create = "40m"
		36 |   #   delete = "40m"
		37 |   #   update = "80m"
		38 |   # }
		39 | 
		40 |   lifecycle {
		41 |     prevent_destroy = true
		42 |   }
		43 | 
		44 |   tags = merge(
		45 |     local.tags,
		46 |     {
		47 |       Name                = "${local.application_name}-database",
		48 |       instance-scheduling = "skip-scheduling"
		49 |     }
		50 |   )
		51 | }

Check: CKV_AWS_226: "Ensure DB instance gets all minor upgrades automatically"
	FAILED for resource: aws_db_instance.database
	File: /database.tf:5-51
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-db-instance-gets-all-minor-upgrades-automatically

		5  | resource "aws_db_instance" "database" {
		6  |   #tfsec:ignore:AWS099
		7  |   #checkov:skip=CKV_AWS_118
		8  |   #checkov:skip=CKV_AWS_157
		9  |   count                               = local.app_data.accounts[local.environment].db_enabled ? 1 : 0
		10 |   identifier                          = local.application_name
		11 |   allocated_storage                   = local.app_data.accounts[local.environment].db_allocated_storage
		12 |   storage_type                        = "gp2"
		13 |   engine                              = "sqlserver-se"
		14 |   engine_version                      = "15.00.4073.23.v1"
		15 |   license_model                       = "license-included"
		16 |   instance_class                      = local.app_data.accounts[local.environment].db_instance_class
		17 |   multi_az                            = false
		18 |   username                            = local.app_data.accounts[local.environment].db_user
		19 |   password                            = aws_secretsmanager_secret_version.db_password.arn
		20 |   storage_encrypted                   = true
		21 |   iam_database_authentication_enabled = false
		22 |   vpc_security_group_ids              = [aws_security_group.db.id]
		23 |   snapshot_identifier                 = format("arn:aws:rds:eu-west-2:%s:snapshot:%s", data.aws_caller_identity.current.account_id, local.app_data.accounts[local.environment].db_snapshot_identifier)
		24 |   backup_retention_period             = 30
		25 |   maintenance_window                  = "Mon:00:00-Mon:03:00"
		26 |   backup_window                       = "03:00-06:00"
		27 |   final_snapshot_identifier           = "final-snapshot"
		28 |   kms_key_id                          = aws_kms_key.rds.arn
		29 |   deletion_protection                 = false
		30 |   option_group_name                   = aws_db_option_group.db_option_group.name
		31 |   db_subnet_group_name                = aws_db_subnet_group.db.id
		32 |   enabled_cloudwatch_logs_exports     = ["error"]
		33 | 
		34 |   # timeouts {
		35 |   #   create = "40m"
		36 |   #   delete = "40m"
		37 |   #   update = "80m"
		38 |   # }
		39 | 
		40 |   lifecycle {
		41 |     prevent_destroy = true
		42 |   }
		43 | 
		44 |   tags = merge(
		45 |     local.tags,
		46 |     {
		47 |       Name                = "${local.application_name}-database",
		48 |       instance-scheduling = "skip-scheduling"
		49 |     }
		50 |   )
		51 | }

Check: CKV_AWS_293: "Ensure that AWS database instances have deletion protection enabled"
	FAILED for resource: aws_db_instance.database
	File: /database.tf:5-51
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-293

		5  | resource "aws_db_instance" "database" {
		6  |   #tfsec:ignore:AWS099
		7  |   #checkov:skip=CKV_AWS_118
		8  |   #checkov:skip=CKV_AWS_157
		9  |   count                               = local.app_data.accounts[local.environment].db_enabled ? 1 : 0
		10 |   identifier                          = local.application_name
		11 |   allocated_storage                   = local.app_data.accounts[local.environment].db_allocated_storage
		12 |   storage_type                        = "gp2"
		13 |   engine                              = "sqlserver-se"
		14 |   engine_version                      = "15.00.4073.23.v1"
		15 |   license_model                       = "license-included"
		16 |   instance_class                      = local.app_data.accounts[local.environment].db_instance_class
		17 |   multi_az                            = false
		18 |   username                            = local.app_data.accounts[local.environment].db_user
		19 |   password                            = aws_secretsmanager_secret_version.db_password.arn
		20 |   storage_encrypted                   = true
		21 |   iam_database_authentication_enabled = false
		22 |   vpc_security_group_ids              = [aws_security_group.db.id]
		23 |   snapshot_identifier                 = format("arn:aws:rds:eu-west-2:%s:snapshot:%s", data.aws_caller_identity.current.account_id, local.app_data.accounts[local.environment].db_snapshot_identifier)
		24 |   backup_retention_period             = 30
		25 |   maintenance_window                  = "Mon:00:00-Mon:03:00"
		26 |   backup_window                       = "03:00-06:00"
		27 |   final_snapshot_identifier           = "final-snapshot"
		28 |   kms_key_id                          = aws_kms_key.rds.arn
		29 |   deletion_protection                 = false
		30 |   option_group_name                   = aws_db_option_group.db_option_group.name
		31 |   db_subnet_group_name                = aws_db_subnet_group.db.id
		32 |   enabled_cloudwatch_logs_exports     = ["error"]
		33 | 
		34 |   # timeouts {
		35 |   #   create = "40m"
		36 |   #   delete = "40m"
		37 |   #   update = "80m"
		38 |   # }
		39 | 
		40 |   lifecycle {
		41 |     prevent_destroy = true
		42 |   }
		43 | 
		44 |   tags = merge(
		45 |     local.tags,
		46 |     {
		47 |       Name                = "${local.application_name}-database",
		48 |       instance-scheduling = "skip-scheduling"
		49 |     }
		50 |   )
		51 | }

Check: CKV_AWS_300: "Ensure S3 lifecycle configuration sets period for aborting failed uploads"
	FAILED for resource: aws_s3_bucket_lifecycle_configuration.database_backup_files
	File: /database.tf:189-204
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-300

		189 | resource "aws_s3_bucket_lifecycle_configuration" "database_backup_files" {
		190 |   bucket = aws_s3_bucket.database_backup_files.id
		191 |   rule {
		192 |     id     = "tf-s3-lifecycle"
		193 |     status = "Enabled"
		194 |     noncurrent_version_transition {
		195 |       noncurrent_days = 30
		196 |       storage_class   = "STANDARD_IA"
		197 |     }
		198 | 
		199 |     transition {
		200 |       days          = 60
		201 |       storage_class = "STANDARD_IA"
		202 |     }
		203 |   }
		204 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.ebs-kms
	File: /db_manager.tf:182-205
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		182 | data "aws_iam_policy_document" "ebs-kms" {
		183 |   #checkov:skip=CKV_AWS_111
		184 |   #checkov:skip=CKV_AWS_109
		185 |   statement {
		186 |     effect    = "Allow"
		187 |     actions   = ["kms:*"]
		188 |     resources = ["*"]
		189 | 
		190 |     principals {
		191 |       type        = "Service"
		192 |       identifiers = ["ec2.amazonaws.com"]
		193 |     }
		194 |   }
		195 |   statement {
		196 |     effect    = "Allow"
		197 |     actions   = ["kms:*"]
		198 |     resources = ["*"]
		199 | 
		200 |     principals {
		201 |       type        = "AWS"
		202 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		203 |     }
		204 |   }
		205 | }

Check: CKV_AWS_290: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy.db_mgmt_policy
	File: /db_manager.tf:95-125
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-290

		95  | resource "aws_iam_policy" "db_mgmt_policy" {
		96  |   name        = "${local.application_name}-db_mgmt-ec2-policy"
		97  |   description = "${local.application_name} ec2-policy"
		98  | 
		99  |   policy = <<EOF
		100 | {
		101 |     "Version": "2012-10-17",
		102 |     "Statement": [
		103 |       {
		104 |         "Effect": "Allow",
		105 |         "Action": "s3:*",
		106 |         "Resource": "*"
		107 |       },
		108 |       {
		109 |         "Effect": "Allow",
		110 |         "Action": [
		111 |           "s3:GetEncryptionConfiguration"
		112 |         ],
		113 |         "Resource": "*"
		114 |       },
		115 |       {
		116 |         "Effect": "Allow",
		117 |         "Action": [
		118 |           "kms:Decrypt"
		119 |         ],
		120 |         "Resource": "arn:aws:kms:eu-west-2:${local.environment_management.account_ids["performance-hub-preproduction"]}:key/c1b9e987-29e2-458f-b5bd-2e9c2b57f049"
		121 |       }
		122 |     ]
		123 | }
		124 | EOF
		125 | }

Check: CKV_AWS_289: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: aws_iam_policy.db_mgmt_policy
	File: /db_manager.tf:95-125
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-289

		95  | resource "aws_iam_policy" "db_mgmt_policy" {
		96  |   name        = "${local.application_name}-db_mgmt-ec2-policy"
		97  |   description = "${local.application_name} ec2-policy"
		98  | 
		99  |   policy = <<EOF
		100 | {
		101 |     "Version": "2012-10-17",
		102 |     "Statement": [
		103 |       {
		104 |         "Effect": "Allow",
		105 |         "Action": "s3:*",
		106 |         "Resource": "*"
		107 |       },
		108 |       {
		109 |         "Effect": "Allow",
		110 |         "Action": [
		111 |           "s3:GetEncryptionConfiguration"
		112 |         ],
		113 |         "Resource": "*"
		114 |       },
		115 |       {
		116 |         "Effect": "Allow",
		117 |         "Action": [
		118 |           "kms:Decrypt"
		119 |         ],
		120 |         "Resource": "arn:aws:kms:eu-west-2:${local.environment_management.account_ids["performance-hub-preproduction"]}:key/c1b9e987-29e2-458f-b5bd-2e9c2b57f049"
		121 |       }
		122 |     ]
		123 | }
		124 | EOF
		125 | }

Check: CKV_AWS_288: "Ensure IAM policies does not allow data exfiltration"
	FAILED for resource: aws_iam_policy.db_mgmt_policy
	File: /db_manager.tf:95-125
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-288

		95  | resource "aws_iam_policy" "db_mgmt_policy" {
		96  |   name        = "${local.application_name}-db_mgmt-ec2-policy"
		97  |   description = "${local.application_name} ec2-policy"
		98  | 
		99  |   policy = <<EOF
		100 | {
		101 |     "Version": "2012-10-17",
		102 |     "Statement": [
		103 |       {
		104 |         "Effect": "Allow",
		105 |         "Action": "s3:*",
		106 |         "Resource": "*"
		107 |       },
		108 |       {
		109 |         "Effect": "Allow",
		110 |         "Action": [
		111 |           "s3:GetEncryptionConfiguration"
		112 |         ],
		113 |         "Resource": "*"
		114 |       },
		115 |       {
		116 |         "Effect": "Allow",
		117 |         "Action": [
		118 |           "kms:Decrypt"
		119 |         ],
		120 |         "Resource": "arn:aws:kms:eu-west-2:${local.environment_management.account_ids["performance-hub-preproduction"]}:key/c1b9e987-29e2-458f-b5bd-2e9c2b57f049"
		121 |       }
		122 |     ]
		123 | }
		124 | EOF
		125 | }

Check: CKV_AWS_355: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy.db_mgmt_policy
	File: /db_manager.tf:95-125
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-355

		95  | resource "aws_iam_policy" "db_mgmt_policy" {
		96  |   name        = "${local.application_name}-db_mgmt-ec2-policy"
		97  |   description = "${local.application_name} ec2-policy"
		98  | 
		99  |   policy = <<EOF
		100 | {
		101 |     "Version": "2012-10-17",
		102 |     "Statement": [
		103 |       {
		104 |         "Effect": "Allow",
		105 |         "Action": "s3:*",
		106 |         "Resource": "*"
		107 |       },
		108 |       {
		109 |         "Effect": "Allow",
		110 |         "Action": [
		111 |           "s3:GetEncryptionConfiguration"
		112 |         ],
		113 |         "Resource": "*"
		114 |       },
		115 |       {
		116 |         "Effect": "Allow",
		117 |         "Action": [
		118 |           "kms:Decrypt"
		119 |         ],
		120 |         "Resource": "arn:aws:kms:eu-west-2:${local.environment_management.account_ids["performance-hub-preproduction"]}:key/c1b9e987-29e2-458f-b5bd-2e9c2b57f049"
		121 |       }
		122 |     ]
		123 | }
		124 | EOF
		125 | }

Check: CKV_AWS_261: "Ensure HTTP HTTPS Target group defines Healthcheck"
	FAILED for resource: aws_lb_target_group.target_group
	File: /loadbalancer.tf:27-55
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-kendra-index-server-side-encryption-uses-customer-managed-keys-cmks

		27 | resource "aws_lb_target_group" "target_group" {
		28 |   name                 = "${local.application_name}-tg-${local.environment}"
		29 |   port                 = local.app_data.accounts[local.environment].server_port
		30 |   protocol             = "HTTP"
		31 |   vpc_id               = data.aws_vpc.shared.id
		32 |   target_type          = "instance"
		33 |   deregistration_delay = 30
		34 | 
		35 |   stickiness {
		36 |     type = "lb_cookie"
		37 |   }
		38 | 
		39 |   health_check {
		40 |     # path                = "/"
		41 |     healthy_threshold   = "5"
		42 |     interval            = "120"
		43 |     protocol            = "HTTP"
		44 |     unhealthy_threshold = "2"
		45 |     matcher             = "200-499"
		46 |     timeout             = "5"
		47 |   }
		48 | 
		49 |   tags = merge(
		50 |     local.tags,
		51 |     {
		52 |       Name = "${local.application_name}-tg-${local.environment}"
		53 |     }
		54 |   )
		55 | }

Check: CKV_AWS_290: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.windows-new-ecs.aws_iam_policy.ec2_instance_policy
	File: /module/ecs/main.tf:190-229
	Calling File: /ecs.tf:5-33
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-290

		190 | resource "aws_iam_policy" "ec2_instance_policy" { #tfsec:ignore:aws-iam-no-policy-wildcards
		191 |   name = "${var.app_name}-ec2-instance-policy"
		192 | 
		193 |   policy = <<EOF
		194 | {
		195 |     "Version": "2012-10-17",
		196 |     "Statement": [
		197 |         {
		198 |             "Effect": "Allow",
		199 |             "Action": [
		200 |                 "ec2:DescribeTags",
		201 |                 "ecs:CreateCluster",
		202 |                 "ecs:DeregisterContainerInstance",
		203 |                 "ecs:DiscoverPollEndpoint",
		204 |                 "ecs:Poll",
		205 |                 "ecs:RegisterContainerInstance",
		206 |                 "ecs:StartTelemetrySession",
		207 |                 "ecs:UpdateContainerInstancesState",
		208 |                 "ecs:Submit*",
		209 |                 "ecr:GetAuthorizationToken",
		210 |                 "ecr:BatchCheckLayerAvailability",
		211 |                 "ecr:GetDownloadUrlForLayer",
		212 |                 "ecr:BatchGetImage",
		213 |                 "logs:CreateLogStream",
		214 |                 "logs:PutLogEvents",
		215 |                 "s3:ListBucket",
		216 |                 "s3:*Object*",
		217 |                 "kms:Decrypt",
		218 |                 "kms:Encrypt",
		219 |                 "kms:GenerateDataKey",
		220 |                 "kms:ReEncrypt",
		221 |                 "kms:GenerateDataKey",
		222 |                 "kms:DescribeKey"
		223 |             ],
		224 |             "Resource": "*"
		225 |         }
		226 |     ]
		227 | }
		228 | EOF
		229 | }

Check: CKV_AWS_289: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: module.windows-new-ecs.aws_iam_policy.ec2_instance_policy
	File: /module/ecs/main.tf:190-229
	Calling File: /ecs.tf:5-33
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-289

		190 | resource "aws_iam_policy" "ec2_instance_policy" { #tfsec:ignore:aws-iam-no-policy-wildcards
		191 |   name = "${var.app_name}-ec2-instance-policy"
		192 | 
		193 |   policy = <<EOF
		194 | {
		195 |     "Version": "2012-10-17",
		196 |     "Statement": [
		197 |         {
		198 |             "Effect": "Allow",
		199 |             "Action": [
		200 |                 "ec2:DescribeTags",
		201 |                 "ecs:CreateCluster",
		202 |                 "ecs:DeregisterContainerInstance",
		203 |                 "ecs:DiscoverPollEndpoint",
		204 |                 "ecs:Poll",
		205 |                 "ecs:RegisterContainerInstance",
		206 |                 "ecs:StartTelemetrySession",
		207 |                 "ecs:UpdateContainerInstancesState",
		208 |                 "ecs:Submit*",
		209 |                 "ecr:GetAuthorizationToken",
		210 |                 "ecr:BatchCheckLayerAvailability",
		211 |                 "ecr:GetDownloadUrlForLayer",
		212 |                 "ecr:BatchGetImage",
		213 |                 "logs:CreateLogStream",
		214 |                 "logs:PutLogEvents",
		215 |                 "s3:ListBucket",
		216 |                 "s3:*Object*",
		217 |                 "kms:Decrypt",
		218 |                 "kms:Encrypt",
		219 |                 "kms:GenerateDataKey",
		220 |                 "kms:ReEncrypt",
		221 |                 "kms:GenerateDataKey",
		222 |                 "kms:DescribeKey"
		223 |             ],
		224 |             "Resource": "*"
		225 |         }
		226 |     ]
		227 | }
		228 | EOF
		229 | }

Check: CKV_AWS_288: "Ensure IAM policies does not allow data exfiltration"
	FAILED for resource: module.windows-new-ecs.aws_iam_policy.ec2_instance_policy
	File: /module/ecs/main.tf:190-229
	Calling File: /ecs.tf:5-33
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-288

		190 | resource "aws_iam_policy" "ec2_instance_policy" { #tfsec:ignore:aws-iam-no-policy-wildcards
		191 |   name = "${var.app_name}-ec2-instance-policy"
		192 | 
		193 |   policy = <<EOF
		194 | {
		195 |     "Version": "2012-10-17",
		196 |     "Statement": [
		197 |         {
		198 |             "Effect": "Allow",
		199 |             "Action": [
		200 |                 "ec2:DescribeTags",
		201 |                 "ecs:CreateCluster",
		202 |                 "ecs:DeregisterContainerInstance",
		203 |                 "ecs:DiscoverPollEndpoint",
		204 |                 "ecs:Poll",
		205 |                 "ecs:RegisterContainerInstance",
		206 |                 "ecs:StartTelemetrySession",
		207 |                 "ecs:UpdateContainerInstancesState",
		208 |                 "ecs:Submit*",
		209 |                 "ecr:GetAuthorizationToken",
		210 |                 "ecr:BatchCheckLayerAvailability",
		211 |                 "ecr:GetDownloadUrlForLayer",
		212 |                 "ecr:BatchGetImage",
		213 |                 "logs:CreateLogStream",
		214 |                 "logs:PutLogEvents",
		215 |                 "s3:ListBucket",
		216 |                 "s3:*Object*",
		217 |                 "kms:Decrypt",
		218 |                 "kms:Encrypt",
		219 |                 "kms:GenerateDataKey",
		220 |                 "kms:ReEncrypt",
		221 |                 "kms:GenerateDataKey",
		222 |                 "kms:DescribeKey"
		223 |             ],
		224 |             "Resource": "*"
		225 |         }
		226 |     ]
		227 | }
		228 | EOF
		229 | }

Check: CKV_AWS_355: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.windows-new-ecs.aws_iam_policy.ec2_instance_policy
	File: /module/ecs/main.tf:190-229
	Calling File: /ecs.tf:5-33
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-355

		190 | resource "aws_iam_policy" "ec2_instance_policy" { #tfsec:ignore:aws-iam-no-policy-wildcards
		191 |   name = "${var.app_name}-ec2-instance-policy"
		192 | 
		193 |   policy = <<EOF
		194 | {
		195 |     "Version": "2012-10-17",
		196 |     "Statement": [
		197 |         {
		198 |             "Effect": "Allow",
		199 |             "Action": [
		200 |                 "ec2:DescribeTags",
		201 |                 "ecs:CreateCluster",
		202 |                 "ecs:DeregisterContainerInstance",
		203 |                 "ecs:DiscoverPollEndpoint",
		204 |                 "ecs:Poll",
		205 |                 "ecs:RegisterContainerInstance",
		206 |                 "ecs:StartTelemetrySession",
		207 |                 "ecs:UpdateContainerInstancesState",
		208 |                 "ecs:Submit*",
		209 |                 "ecr:GetAuthorizationToken",
		210 |                 "ecr:BatchCheckLayerAvailability",
		211 |                 "ecr:GetDownloadUrlForLayer",
		212 |                 "ecr:BatchGetImage",
		213 |                 "logs:CreateLogStream",
		214 |                 "logs:PutLogEvents",
		215 |                 "s3:ListBucket",
		216 |                 "s3:*Object*",
		217 |                 "kms:Decrypt",
		218 |                 "kms:Encrypt",
		219 |                 "kms:GenerateDataKey",
		220 |                 "kms:ReEncrypt",
		221 |                 "kms:GenerateDataKey",
		222 |                 "kms:DescribeKey"
		223 |             ],
		224 |             "Resource": "*"
		225 |         }
		226 |     ]
		227 | }
		228 | EOF
		229 | }

Check: CKV_AWS_290: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.windows-new-ecs.aws_iam_policy.ecs_task_execution_s3_policy
	File: /module/ecs/main.tf:370-393
	Calling File: /ecs.tf:5-33
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-290

		370 | resource "aws_iam_policy" "ecs_task_execution_s3_policy" { #tfsec:ignore:aws-iam-no-policy-wildcards
		371 |   name   = "${var.app_name}-ecs-task-execution-s3-policy"
		372 |   policy = <<EOF
		373 | {
		374 |   "Version": "2012-10-17",
		375 |   "Statement": [
		376 |     {
		377 |       "Effect": "Allow",
		378 |       "Action": [
		379 |         "s3:ListBucket",
		380 |         "s3:*Object*",
		381 |         "kms:Decrypt",
		382 |         "kms:Encrypt",
		383 |         "kms:GenerateDataKey",
		384 |         "kms:ReEncrypt",
		385 |         "kms:GenerateDataKey",
		386 |         "kms:DescribeKey"
		387 |       ],
		388 |       "Resource": ["*"]
		389 |     }
		390 |   ]
		391 | }
		392 | EOF
		393 | }

Check: CKV_AWS_289: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: module.windows-new-ecs.aws_iam_policy.ecs_task_execution_s3_policy
	File: /module/ecs/main.tf:370-393
	Calling File: /ecs.tf:5-33
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-289

		370 | resource "aws_iam_policy" "ecs_task_execution_s3_policy" { #tfsec:ignore:aws-iam-no-policy-wildcards
		371 |   name   = "${var.app_name}-ecs-task-execution-s3-policy"
		372 |   policy = <<EOF
		373 | {
		374 |   "Version": "2012-10-17",
		375 |   "Statement": [
		376 |     {
		377 |       "Effect": "Allow",
		378 |       "Action": [
		379 |         "s3:ListBucket",
		380 |         "s3:*Object*",
		381 |         "kms:Decrypt",
		382 |         "kms:Encrypt",
		383 |         "kms:GenerateDataKey",
		384 |         "kms:ReEncrypt",
		385 |         "kms:GenerateDataKey",
		386 |         "kms:DescribeKey"
		387 |       ],
		388 |       "Resource": ["*"]
		389 |     }
		390 |   ]
		391 | }
		392 | EOF
		393 | }

Check: CKV_AWS_288: "Ensure IAM policies does not allow data exfiltration"
	FAILED for resource: module.windows-new-ecs.aws_iam_policy.ecs_task_execution_s3_policy
	File: /module/ecs/main.tf:370-393
	Calling File: /ecs.tf:5-33
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-288

		370 | resource "aws_iam_policy" "ecs_task_execution_s3_policy" { #tfsec:ignore:aws-iam-no-policy-wildcards
		371 |   name   = "${var.app_name}-ecs-task-execution-s3-policy"
		372 |   policy = <<EOF
		373 | {
		374 |   "Version": "2012-10-17",
		375 |   "Statement": [
		376 |     {
		377 |       "Effect": "Allow",
		378 |       "Action": [
		379 |         "s3:ListBucket",
		380 |         "s3:*Object*",
		381 |         "kms:Decrypt",
		382 |         "kms:Encrypt",
		383 |         "kms:GenerateDataKey",
		384 |         "kms:ReEncrypt",
		385 |         "kms:GenerateDataKey",
		386 |         "kms:DescribeKey"
		387 |       ],
		388 |       "Resource": ["*"]
		389 |     }
		390 |   ]
		391 | }
		392 | EOF
		393 | }

Check: CKV_AWS_355: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.windows-new-ecs.aws_iam_policy.ecs_task_execution_s3_policy
	File: /module/ecs/main.tf:370-393
	Calling File: /ecs.tf:5-33
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-355

		370 | resource "aws_iam_policy" "ecs_task_execution_s3_policy" { #tfsec:ignore:aws-iam-no-policy-wildcards
		371 |   name   = "${var.app_name}-ecs-task-execution-s3-policy"
		372 |   policy = <<EOF
		373 | {
		374 |   "Version": "2012-10-17",
		375 |   "Statement": [
		376 |     {
		377 |       "Effect": "Allow",
		378 |       "Action": [
		379 |         "s3:ListBucket",
		380 |         "s3:*Object*",
		381 |         "kms:Decrypt",
		382 |         "kms:Encrypt",
		383 |         "kms:GenerateDataKey",
		384 |         "kms:ReEncrypt",
		385 |         "kms:GenerateDataKey",
		386 |         "kms:DescribeKey"
		387 |       ],
		388 |       "Resource": ["*"]
		389 |     }
		390 |   ]
		391 | }
		392 | EOF
		393 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: module.windows-new-ecs.aws_cloudwatch_log_group.cloudwatch_group
	File: /module/ecs/main.tf:479-489
	Calling File: /ecs.tf:5-33
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		479 | resource "aws_cloudwatch_log_group" "cloudwatch_group" {
		480 |   #checkov:skip=CKV_AWS_158:Temporarily skip KMS encryption check while logging solution is being updated
		481 |   name              = "${var.app_name}-ecs"
		482 |   retention_in_days = 30
		483 |   tags = merge(
		484 |     var.tags_common,
		485 |     {
		486 |       Name = "${var.app_name}-ecs-cloudwatch-group"
		487 |     }
		488 |   )
		489 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: pagerduty_ddos_alarm
	File: /monitoring.tf:43-50
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		43 | module "pagerduty_ddos_alarm" {
		44 |   depends_on = [
		45 |     aws_sns_topic.ddos_alarm
		46 |   ]
		47 |   source                    = "github.com/ministryofjustice/modernisation-platform-terraform-pagerduty-integration?ref=v2.0.0"
		48 |   sns_topics                = [aws_sns_topic.ddos_alarm.name]
		49 |   pagerduty_integration_key = local.pagerduty_integration_keys["ddos_cloudwatch"]
		50 | }

Check: CKV_AWS_26: "Ensure all data stored in the SNS topic is encrypted"
	FAILED for resource: aws_sns_topic.ddos_alarm
	File: /monitoring.tf:21-23
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-15

		21 | resource "aws_sns_topic" "ddos_alarm" {
		22 |   name = "ddos_alarm"
		23 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.s3-kms
	File: /s3.tf:264-277
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		264 | data "aws_iam_policy_document" "s3-kms" {
		265 |   #checkov:skip=CKV_AWS_111
		266 |   #checkov:skip=CKV_AWS_109
		267 |   statement {
		268 |     effect    = "Allow"
		269 |     actions   = ["kms:*"]
		270 |     resources = ["*"]
		271 | 
		272 |     principals {
		273 |       type        = "AWS"
		274 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		275 |     }
		276 |   }
		277 | }
Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: ap_landing_bucket
	File: /s3.tf:166-201
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		166 | module "ap_landing_bucket" {
		167 |   source = "github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v8.0.0"
		168 | 
		169 |   bucket_name        = "${local.application_name}-land-${local.environment}"
		170 |   ownership_controls = "BucketOwnerEnforced"
		171 | 
		172 |   versioning_enabled  = false
		173 |   replication_enabled = false
		174 | 
		175 |   bucket_policy = [data.aws_iam_policy_document.allow_ap_write_to_landing.json]
		176 | 
		177 |   providers = {
		178 |     # Leave this provider block in even if you are not using replication
		179 |     aws.bucket-replication = aws
		180 |   }
		181 | 
		182 |   custom_kms_key = aws_kms_key.s3.arn
		183 | 
		184 |   lifecycle_rule = [
		185 |     {
		186 |       id      = "tf-s3-lifecycle-landing"
		187 |       enabled = "Enabled"
		188 | 
		189 |       expiration = {
		190 |         days = 30
		191 |       }
		192 |     }
		193 |   ]
		194 | 
		195 |   tags = merge(
		196 |     local.tags,
		197 |     {
		198 |       Name = "${local.application_name}-ap-landing-bucket"
		199 |     }
		200 |   )
		201 | }

Check: CKV_AWS_300: "Ensure S3 lifecycle configuration sets period for aborting failed uploads"
	FAILED for resource: aws_s3_bucket_lifecycle_configuration.upload_files
	File: /s3.tf:30-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-300

		30 | resource "aws_s3_bucket_lifecycle_configuration" "upload_files" {
		31 |   bucket = aws_s3_bucket.upload_files.id
		32 |   rule {
		33 |     id     = "tf-s3-lifecycle"
		34 |     status = "Enabled"
		35 |     noncurrent_version_transition {
		36 |       noncurrent_days = 30
		37 |       storage_class   = "STANDARD_IA"
		38 |     }
		39 | 
		40 |     transition {
		41 |       days          = 60
		42 |       storage_class = "STANDARD_IA"
		43 |     }
		44 |   }
		45 | }

Check: CKV_AWS_290: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy.s3-uploads-policy
	File: /s3.tf:112-153
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-290

		112 | resource "aws_iam_policy" "s3-uploads-policy" {
		113 |   name   = "${local.application_name}-s3-uploads-policy"
		114 |   policy = <<EOF
		115 | {
		116 |   "Version": "2012-10-17",
		117 |   "Statement": [
		118 |     {
		119 |       "Effect": "Allow",
		120 |       "Action": [
		121 |           "s3:*"
		122 |       ],
		123 |       "Resource": [
		124 |           "${aws_s3_bucket.upload_files.arn}"
		125 |       ]
		126 |     },
		127 |     {
		128 |       "Effect": "Allow",
		129 |       "Action": [
		130 |           "s3:*"
		131 |       ],
		132 |       "Resource": [
		133 |         "${aws_s3_bucket.upload_files.arn}/*"
		134 |       ]
		135 |     },
		136 |     {
		137 |       "Effect": "Allow",
		138 |       "Action": [
		139 |         "s3:GetEncryptionConfiguration"
		140 |       ],
		141 |       "Resource": "*"
		142 |     },
		143 |     {
		144 |       "Effect": "Allow",
		145 |       "Action": [
		146 |       "kms:Decrypt"
		147 |       ],
		148 |       "Resource": "*"
		149 |     }
		150 |   ]
		151 | }
		152 | EOF
		153 | }

Check: CKV_AWS_355: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy.s3-uploads-policy
	File: /s3.tf:112-153
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-355

		112 | resource "aws_iam_policy" "s3-uploads-policy" {
		113 |   name   = "${local.application_name}-s3-uploads-policy"
		114 |   policy = <<EOF
		115 | {
		116 |   "Version": "2012-10-17",
		117 |   "Statement": [
		118 |     {
		119 |       "Effect": "Allow",
		120 |       "Action": [
		121 |           "s3:*"
		122 |       ],
		123 |       "Resource": [
		124 |           "${aws_s3_bucket.upload_files.arn}"
		125 |       ]
		126 |     },
		127 |     {
		128 |       "Effect": "Allow",
		129 |       "Action": [
		130 |           "s3:*"
		131 |       ],
		132 |       "Resource": [
		133 |         "${aws_s3_bucket.upload_files.arn}/*"
		134 |       ]
		135 |     },
		136 |     {
		137 |       "Effect": "Allow",
		138 |       "Action": [
		139 |         "s3:GetEncryptionConfiguration"
		140 |       ],
		141 |       "Resource": "*"
		142 |     },
		143 |     {
		144 |       "Effect": "Allow",
		145 |       "Action": [
		146 |       "kms:Decrypt"
		147 |       ],
		148 |       "Resource": "*"
		149 |     }
		150 |   ]
		151 | }
		152 | EOF
		153 | }

Check: CKV2_AWS_62: "Ensure S3 buckets should have event notifications enabled"
	FAILED for resource: aws_s3_bucket.database_backup_files
	File: /database.tf:166-182
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-2-62

		166 | resource "aws_s3_bucket" "database_backup_files" {
		167 |   #checkov:skip=CKV_AWS_18
		168 |   #checkov:skip=CKV_AWS_144
		169 |   #checkov:skip=CKV2_AWS_6
		170 |   bucket = "${local.application_name}-db-backups-${local.environment}"
		171 | 
		172 |   lifecycle {
		173 |     prevent_destroy = true
		174 |   }
		175 | 
		176 |   tags = merge(
		177 |     local.tags,
		178 |     {
		179 |       Name = "${local.application_name}-db-backups-s3"
		180 |     }
		181 |   )
		182 | }

Check: CKV2_AWS_62: "Ensure S3 buckets should have event notifications enabled"
	FAILED for resource: aws_s3_bucket.upload_files
	File: /s3.tf:7-23
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-2-62

		7  | resource "aws_s3_bucket" "upload_files" {
		8  |   #checkov:skip=CKV_AWS_18
		9  |   #checkov:skip=CKV_AWS_144
		10 |   #checkov:skip=CKV2_AWS_6
		11 |   bucket = "${local.application_name}-uploads-${local.environment}"
		12 | 
		13 |   lifecycle {
		14 |     prevent_destroy = true
		15 |   }
		16 | 
		17 |   tags = merge(
		18 |     local.tags,
		19 |     {
		20 |       Name = "${local.application_name}-uploads"
		21 |     }
		22 |   )
		23 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.mojhub_cnnstr
	File: /secrets.tf:12-21
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		12 | resource "aws_secretsmanager_secret" "mojhub_cnnstr" {
		13 |   #checkov:skip=CKV_AWS_149
		14 |   name = "mojhub_cnnstr"
		15 |   tags = merge(
		16 |     local.tags,
		17 |     {
		18 |       Name = "mojhub_cnnstr"
		19 |     },
		20 |   )
		21 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.mojhub_membership
	File: /secrets.tf:28-37
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		28 | resource "aws_secretsmanager_secret" "mojhub_membership" {
		29 |   #checkov:skip=CKV_AWS_149
		30 |   name = "mojhub_membership"
		31 |   tags = merge(
		32 |     local.tags,
		33 |     {
		34 |       Name = "mojhub_membership"
		35 |     },
		36 |   )
		37 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.govuk_notify_api_key
	File: /secrets.tf:44-53
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		44 | resource "aws_secretsmanager_secret" "govuk_notify_api_key" {
		45 |   #checkov:skip=CKV_AWS_149
		46 |   name = "govuk_notify_api_key"
		47 |   tags = merge(
		48 |     local.tags,
		49 |     {
		50 |       Name = "govuk_notify_api_key"
		51 |     },
		52 |   )
		53 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.os_vts_api_key
	File: /secrets.tf:60-69
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		60 | resource "aws_secretsmanager_secret" "os_vts_api_key" {
		61 |   #checkov:skip=CKV_AWS_149
		62 |   name = "os_vts_api_key"
		63 |   tags = merge(
		64 |     local.tags,
		65 |     {
		66 |       Name = "os_vts_api_key"
		67 |     },
		68 |   )
		69 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.ap_import_access_key_id
	File: /secrets.tf:76-86
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		76 | resource "aws_secretsmanager_secret" "ap_import_access_key_id" {
		77 |   #checkov:skip=CKV_AWS_149
		78 |   name                    = "ap_import_access_key_id"
		79 |   recovery_window_in_days = 0
		80 |   tags = merge(
		81 |     local.tags,
		82 |     {
		83 |       Name = "ap_import_access_key_id"
		84 |     },
		85 |   )
		86 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.ap_import_secret_access_key
	File: /secrets.tf:93-103
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		93  | resource "aws_secretsmanager_secret" "ap_import_secret_access_key" {
		94  |   #checkov:skip=CKV_AWS_149
		95  |   name                    = "ap_import_secret_access_key"
		96  |   recovery_window_in_days = 0
		97  |   tags = merge(
		98  |     local.tags,
		99  |     {
		100 |       Name = "ap_import_secret_access_key"
		101 |     },
		102 |   )
		103 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.ap_export_access_key_id
	File: /secrets.tf:110-120
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		110 | resource "aws_secretsmanager_secret" "ap_export_access_key_id" {
		111 |   #checkov:skip=CKV_AWS_149
		112 |   name                    = "ap_export_access_key_id"
		113 |   recovery_window_in_days = 0
		114 |   tags = merge(
		115 |     local.tags,
		116 |     {
		117 |       Name = "ap_export_access_key_id"
		118 |     },
		119 |   )
		120 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.ap_export_secret_access_key
	File: /secrets.tf:127-137
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		127 | resource "aws_secretsmanager_secret" "ap_export_secret_access_key" {
		128 |   #checkov:skip=CKV_AWS_149
		129 |   name                    = "ap_export_secret_access_key"
		130 |   recovery_window_in_days = 0
		131 |   tags = merge(
		132 |     local.tags,
		133 |     {
		134 |       Name = "ap_export_secret_access_key"
		135 |     },
		136 |   )
		137 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.db_password
	File: /secrets.tf:144-155
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		144 | resource "aws_secretsmanager_secret" "db_password" {
		145 |   #checkov:skip=CKV_AWS_149
		146 | 
		147 |   name = "${var.networking[0].application}-database-password"
		148 | 
		149 |   tags = merge(
		150 |     local.tags,
		151 |     {
		152 |       Name = "${var.networking[0].application}-db-password"
		153 |     },
		154 |   )
		155 | }

Check: CKV2_AWS_60: "Ensure RDS instance with copy tags to snapshots is enabled"
	FAILED for resource: aws_db_instance.database
	File: /database.tf:5-51
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-60

		5  | resource "aws_db_instance" "database" {
		6  |   #tfsec:ignore:AWS099
		7  |   #checkov:skip=CKV_AWS_118
		8  |   #checkov:skip=CKV_AWS_157
		9  |   count                               = local.app_data.accounts[local.environment].db_enabled ? 1 : 0
		10 |   identifier                          = local.application_name
		11 |   allocated_storage                   = local.app_data.accounts[local.environment].db_allocated_storage
		12 |   storage_type                        = "gp2"
		13 |   engine                              = "sqlserver-se"
		14 |   engine_version                      = "15.00.4073.23.v1"
		15 |   license_model                       = "license-included"
		16 |   instance_class                      = local.app_data.accounts[local.environment].db_instance_class
		17 |   multi_az                            = false
		18 |   username                            = local.app_data.accounts[local.environment].db_user
		19 |   password                            = aws_secretsmanager_secret_version.db_password.arn
		20 |   storage_encrypted                   = true
		21 |   iam_database_authentication_enabled = false
		22 |   vpc_security_group_ids              = [aws_security_group.db.id]
		23 |   snapshot_identifier                 = format("arn:aws:rds:eu-west-2:%s:snapshot:%s", data.aws_caller_identity.current.account_id, local.app_data.accounts[local.environment].db_snapshot_identifier)
		24 |   backup_retention_period             = 30
		25 |   maintenance_window                  = "Mon:00:00-Mon:03:00"
		26 |   backup_window                       = "03:00-06:00"
		27 |   final_snapshot_identifier           = "final-snapshot"
		28 |   kms_key_id                          = aws_kms_key.rds.arn
		29 |   deletion_protection                 = false
		30 |   option_group_name                   = aws_db_option_group.db_option_group.name
		31 |   db_subnet_group_name                = aws_db_subnet_group.db.id
		32 |   enabled_cloudwatch_logs_exports     = ["error"]
		33 | 
		34 |   # timeouts {
		35 |   #   create = "40m"
		36 |   #   delete = "40m"
		37 |   #   update = "80m"
		38 |   # }
		39 | 
		40 |   lifecycle {
		41 |     prevent_destroy = true
		42 |   }
		43 | 
		44 |   tags = merge(
		45 |     local.tags,
		46 |     {
		47 |       Name                = "${local.application_name}-database",
		48 |       instance-scheduling = "skip-scheduling"
		49 |     }
		50 |   )
		51 | }


checkov_exitcode=1

CTFLint Scan Failed

Show Output 
*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.5.0)
tflint will check the following folders:
terraform/environments/performance-hub

*****************************

Running tflint in terraform/environments/performance-hub
Excluding the following checks: terraform_unused_declarations
3 issue(s) found:

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/performance-hub/data.tf line 26:
  26:     storage_bucket              = "${aws_s3_bucket.upload_files.id}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_deprecated_interpolation.md

Warning: Missing version constraint for provider "template" in `required_providers` (terraform_required_providers)

  on terraform/environments/performance-hub/db_manager.tf line 51:
  51: data "template_cloudinit_config" "cloudinit-db-mgmt" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_required_providers.md

Warning: Missing version constraint for provider "random" in `required_providers` (terraform_required_providers)

  on terraform/environments/performance-hub/secrets.tf line 5:
   5: resource "random_password" "random_password" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_required_providers.md

tflint_exitcode=2

Trivy Scan Failed

Show Output 
*****************************

Trivy will check the following folders:
terraform/environments/performance-hub

*****************************

Running Trivy in terraform/environments/performance-hub
2024-07-05T00:57:53Z	INFO	Need to update DB
2024-07-05T00:57:53Z	INFO	Downloading DB...	repository="ghcr.io/aquasecurity/trivy-db:2"
2024-07-05T00:57:55Z	INFO	Vulnerability scanning is enabled
2024-07-05T00:57:55Z	INFO	Misconfiguration scanning is enabled
2024-07-05T00:57:55Z	INFO	Need to update the built-in policies
2024-07-05T00:57:55Z	INFO	Downloading the built-in policies...
74.86 KiB / 74.86 KiB [-----------------------------------------------------------] 100.00% ? p/s 0s2024-07-05T00:57:56Z	INFO	Secret scanning is enabled
2024-07-05T00:57:56Z	INFO	If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-07-05T00:57:56Z	INFO	Please see also https://aquasecurity.github.io/trivy/v0.53/docs/scanner/secret#recommendation for faster secret detection
2024-07-05T00:57:59Z	INFO	Number of language-specific files	num=0
2024-07-05T00:57:59Z	INFO	Detected config files	num=11

database.tf (terraform)
=======================
Tests: 16 (SUCCESSES: 11, FAILURES: 4, EXCEPTIONS: 1)
Failures: 4 (HIGH: 4, CRITICAL: 0)

HIGH: No public access block so not blocking public acls
════════════════════════════════════════

S3 buckets should block public ACLs on buckets and any objects they contain. By blocking, PUTs with fail if the object has any public ACL a.


See https://avd.aquasec.com/misconfig/avd-aws-0086
────────────────────────────────────────
 database.tf:166-182
────────────────────────────────────────
 166 ┌ resource "aws_s3_bucket" "database_backup_files" {
 167 │   #checkov:skip=CKV_AWS_18
 168 │   #checkov:skip=CKV_AWS_144
 169 │   #checkov:skip=CKV2_AWS_6
 170 │   bucket = "${local.application_name}-db-backups-${local.environment}"
 171 │ 
 172 │   lifecycle {
 173 │     prevent_destroy = true
 174 └   }
 ...   
────────────────────────────────────────


HIGH: No public access block so not blocking public policies
════════════════════════════════════════

S3 bucket policy should have block public policy to prevent users from putting a policy that enable public access.


See https://avd.aquasec.com/misconfig/avd-aws-0087
────────────────────────────────────────
 database.tf:166-182
────────────────────────────────────────
 166 ┌ resource "aws_s3_bucket" "database_backup_files" {
 167 │   #checkov:skip=CKV_AWS_18
 168 │   #checkov:skip=CKV_AWS_144
 169 │   #checkov:skip=CKV2_AWS_6
 170 │   bucket = "${local.application_name}-db-backups-${local.environment}"
 171 │ 
 172 │   lifecycle {
 173 │     prevent_destroy = true
 174 └   }
 ...   
────────────────────────────────────────


HIGH: No public access block so not ignoring public acls
════════════════════════════════════════

S3 buckets should ignore public ACLs on buckets and any objects they contain. By ignoring rather than blocking, PUT calls with public ACLs will still be applied but the ACL will be ignored.


See https://avd.aquasec.com/misconfig/avd-aws-0091
────────────────────────────────────────
 database.tf:166-182
────────────────────────────────────────
 166 ┌ resource "aws_s3_bucket" "database_backup_files" {
 167 │   #checkov:skip=CKV_AWS_18
 168 │   #checkov:skip=CKV_AWS_144
 169 │   #checkov:skip=CKV2_AWS_6
 170 │   bucket = "${local.application_name}-db-backups-${local.environment}"
 171 │ 
 172 │   lifecycle {
 173 │     prevent_destroy = true
 174 └   }
 ...   
────────────────────────────────────────


HIGH: No public access block so not restricting public buckets
════════════════════════════════════════
S3 buckets should restrict public policies for the bucket. By enabling, the restrict_public_buckets, only the bucket owner and AWS Services can access if it has a public policy.

See https://avd.aquasec.com/misconfig/avd-aws-0093
────────────────────────────────────────
 database.tf:166-182
────────────────────────────────────────
 166 ┌ resource "aws_s3_bucket" "database_backup_files" {
 167 │   #checkov:skip=CKV_AWS_18
 168 │   #checkov:skip=CKV_AWS_144
 169 │   #checkov:skip=CKV2_AWS_6
 170 │   bucket = "${local.application_name}-db-backups-${local.environment}"
 171 │ 
 172 │   lifecycle {
 173 │     prevent_destroy = true
 174 └   }
 ...   
────────────────────────────────────────



db_manager.tf (terraform)
=========================
Tests: 2 (SUCCESSES: 1, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 0, CRITICAL: 1)

CRITICAL: Security group rule allows egress to multiple public internet addresses.
════════════════════════════════════════
Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.

See https://avd.aquasec.com/misconfig/avd-aws-0104
────────────────────────────────────────
 db_manager.tf:147-149
   via db_manager.tf:141-150 (egress)
    via db_manager.tf:128-158 (aws_security_group.db_mgmt_server_security_group)
────────────────────────────────────────
 128   resource "aws_security_group" "db_mgmt_server_security_group" {
 ...   
 147 ┌     cidr_blocks = [
 148 │       "0.0.0.0/0",
 149 └     ]
 ...   
 158   }
────────────────────────────────────────



github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.2.1/main.tf (terraform)
==========================================================================================================
Tests: 16 (SUCCESSES: 5, FAILURES: 0, EXCEPTIONS: 11)
Failures: 0 (HIGH: 0, CRITICAL: 0)


loadbalancer.tf (terraform)
===========================
Tests: 9 (SUCCESSES: 3, FAILURES: 6, EXCEPTIONS: 0)
Failures: 6 (HIGH: 2, CRITICAL: 4)

HIGH: Application load balancer is not set to drop invalid headers.
════════════════════════════════════════
Passing unknown or invalid headers through to the target poses a potential risk of compromise. 

By setting drop_invalid_header_fields to true, anything that doe not conform to well known, defined headers will be removed by the load balancer.

See https://avd.aquasec.com/misconfig/avd-aws-0052
────────────────────────────────────────
 loadbalancer.tf:5-25
────────────────────────────────────────
   5 ┌ resource "aws_lb" "external" {
   6 │   #checkov:skip=CKV_AWS_91
   7 │   #checkov:skip=CKV_AWS_131
   8 │   #checkov:skip=CKV2_AWS_20
   9 │   #checkov:skip=CKV2_AWS_28
  10 │   name                       = "${local.application_name}-loadbalancer"
  11 │   load_balancer_type         = "application"
  12 │   subnets                    = data.aws_subnets.shared-public.ids
  13 └   enable_deletion_protection = true
  ..   
────────────────────────────────────────


HIGH: Load balancer is exposed publicly.
════════════════════════════════════════
There are many scenarios in which you would want to expose a load balancer to the wider internet, but this check exists as a warning to prevent accidental exposure of internal assets. You should ensure that this resource should be exposed publicly.

See https://avd.aquasec.com/misconfig/avd-aws-0053
────────────────────────────────────────
 loadbalancer.tf:5-25
────────────────────────────────────────
   5 ┌ resource "aws_lb" "external" {
   6 │   #checkov:skip=CKV_AWS_91
   7 │   #checkov:skip=CKV_AWS_131
   8 │   #checkov:skip=CKV2_AWS_20
   9 │   #checkov:skip=CKV2_AWS_28
  10 │   name                       = "${local.application_name}-loadbalancer"
  11 │   load_balancer_type         = "application"
  12 │   subnets                    = data.aws_subnets.shared-public.ids
  13 └   enable_deletion_protection = true
  ..   
────────────────────────────────────────


CRITICAL: Listener for application load balancer does not use HTTPS.
════════════════════════════════════════
Plain HTTP is unencrypted and human-readable. This means that if a malicious actor was to eavesdrop on your connection, they would be able to see all of your data flowing back and forth.

You should use HTTPS, which is HTTP over an encrypted (TLS) connection, meaning eavesdroppers cannot read your traffic.

See https://avd.aquasec.com/misconfig/avd-aws-0054
────────────────────────────────────────
 loadbalancer.tf:63
   via loadbalancer.tf:58-69 (aws_lb_listener.listener)
────────────────────────────────────────
  58   resource "aws_lb_listener" "listener" {
  ..   
  63 [   protocol          = "HTTP"
  ..   
  69   }
────────────────────────────────────────


CRITICAL: Security group rule allows egress to multiple public internet addresses.
════════════════════════════════════════
Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.

See https://avd.aquasec.com/misconfig/avd-aws-0104
────────────────────────────────────────
 loadbalancer.tf:116-118
   via loadbalancer.tf:110-119 (egress)
    via loadbalancer.tf:87-127 (aws_security_group.load_balancer_security_group)
────────────────────────────────────────
  87   resource "aws_security_group" "load_balancer_security_group" {
  ..   
 116 ┌     cidr_blocks = [
 117 │       "0.0.0.0/0",
 118 └     ]
 ...   
 127   }
────────────────────────────────────────


CRITICAL: Security group rule allows ingress from public internet.
════════════════════════════════════════
Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.

See https://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
 loadbalancer.tf:98
   via loadbalancer.tf:92-99 (ingress)
    via loadbalancer.tf:87-127 (aws_security_group.load_balancer_security_group)
────────────────────────────────────────
  87   resource "aws_security_group" "load_balancer_security_group" {
  ..   
  98 [     cidr_blocks = ["0.0.0.0/0", ]
 ...   
 127   }
────────────────────────────────────────


CRITICAL: Security group rule allows ingress from public internet.
════════════════════════════════════════
Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.

See https://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
 loadbalancer.tf:107
   via loadbalancer.tf:101-108 (ingress)
    via loadbalancer.tf:87-127 (aws_security_group.load_balancer_security_group)
────────────────────────────────────────
  87   resource "aws_security_group" "load_balancer_security_group" {
  ..   
 107 [     cidr_blocks = ["0.0.0.0/0", ]
 ...   
 127   }
────────────────────────────────────────



module/ecs/main.tf (terraform)
==============================
Tests: 64 (SUCCESSES: 6, FAILURES: 1, EXCEPTIONS: 57)
Failures: 1 (HIGH: 0, CRITICAL: 1)

CRITICAL: Security group rule allows egress to multiple public internet addresses.
════════════════════════════════════════
Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.

See https://avd.aquasec.com/misconfig/avd-aws-0104
────────────────────────────────────────
 module/ecs/main.tf:88
   via module/ecs/main.tf:83-90 (content)
    via module/ecs/main.tf:81-91 (dynamic.egress["cluster_ec2_lb_egress"])
     via module/ecs/main.tf:64-99 (aws_security_group.cluster_ec2)
      via ecs.tf:5-33 (module.windows-new-ecs)
────────────────────────────────────────
  64   resource "aws_security_group" "cluster_ec2" {
  ..   
  88 [       cidr_blocks     = lookup(egress.value, "cidr_blocks", null)
  ..   
  99   }
────────────────────────────────────────



monitoring.tf (terraform)
=========================
Tests: 2 (SUCCESSES: 1, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Topic does not have encryption enabled.
════════════════════════════════════════
Topics should be encrypted to protect their contents.

See https://avd.aquasec.com/misconfig/avd-aws-0095
────────────────────────────────────────
 monitoring.tf:21-23
────────────────────────────────────────
  21 ┌ resource "aws_sns_topic" "ddos_alarm" {
  22 │   name = "ddos_alarm"
  23 └ }
────────────────────────────────────────



s3.tf (terraform)
=================
Tests: 11 (SUCCESSES: 3, FAILURES: 4, EXCEPTIONS: 4)
Failures: 4 (HIGH: 4, CRITICAL: 0)

HIGH: No public access block so not blocking public acls
════════════════════════════════════════

S3 buckets should block public ACLs on buckets and any objects they contain. By blocking, PUTs with fail if the object has any public ACL a.


See https://avd.aquasec.com/misconfig/avd-aws-0086
────────────────────────────────────────
 s3.tf:7-23
────────────────────────────────────────
   7 ┌ resource "aws_s3_bucket" "upload_files" {
   8 │   #checkov:skip=CKV_AWS_18
   9 │   #checkov:skip=CKV_AWS_144
  10 │   #checkov:skip=CKV2_AWS_6
  11 │   bucket = "${local.application_name}-uploads-${local.environment}"
  12 │ 
  13 │   lifecycle {
  14 │     prevent_destroy = true
  15 └   }
  ..   
────────────────────────────────────────


HIGH: No public access block so not blocking public policies
════════════════════════════════════════

S3 bucket policy should have block public policy to prevent users from putting a policy that enable public access.


See https://avd.aquasec.com/misconfig/avd-aws-0087
────────────────────────────────────────
 s3.tf:7-23
────────────────────────────────────────
   7 ┌ resource "aws_s3_bucket" "upload_files" {
   8 │   #checkov:skip=CKV_AWS_18
   9 │   #checkov:skip=CKV_AWS_144
  10 │   #checkov:skip=CKV2_AWS_6
  11 │   bucket = "${local.application_name}-uploads-${local.environment}"
  12 │ 
  13 │   lifecycle {
  14 │     prevent_destroy = true
  15 └   }
  ..   
────────────────────────────────────────


HIGH: No public access block so not ignoring public acls
════════════════════════════════════════

S3 buckets should ignore public ACLs on buckets and any objects they contain. By ignoring rather than blocking, PUT calls with public ACLs will still be applied but the ACL will be ignored.


See https://avd.aquasec.com/misconfig/avd-aws-0091
────────────────────────────────────────
 s3.tf:7-23
────────────────────────────────────────
   7 ┌ resource "aws_s3_bucket" "upload_files" {
   8 │   #checkov:skip=CKV_AWS_18
   9 │   #checkov:skip=CKV_AWS_144
  10 │   #checkov:skip=CKV2_AWS_6
  11 │   bucket = "${local.application_name}-uploads-${local.environment}"
  12 │ 
  13 │   lifecycle {
  14 │     prevent_destroy = true
  15 └   }
  ..   
────────────────────────────────────────


HIGH: No public access block so not restricting public buckets
════════════════════════════════════════
S3 buckets should restrict public policies for the bucket. By enabling, the restrict_public_buckets, only the bucket owner and AWS Services can access if it has a public policy.

See https://avd.aquasec.com/misconfig/avd-aws-0093
────────────────────────────────────────
 s3.tf:7-23
────────────────────────────────────────
   7 ┌ resource "aws_s3_bucket" "upload_files" {
   8 │   #checkov:skip=CKV_AWS_18
   9 │   #checkov:skip=CKV_AWS_144
  10 │   #checkov:skip=CKV2_AWS_6
  11 │   bucket = "${local.application_name}-uploads-${local.environment}"
  12 │ 
  13 │   lifecycle {
  14 │     prevent_destroy = true
  15 └   }
  ..   
────────────────────────────────────────


trivy_exitcode=1

@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Aug 4, 2024

This PR is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 10 days.

@github-actions github-actions bot added the Stale label Aug 4, 2024
@dependabot Dependabot
Copy link
Contributor Author

dependabot bot commented on behalf of github Aug 16, 2024

Superseded by #7472.

@dependabot dependabot bot closed this Aug 16, 2024
@dependabot dependabot bot deleted the dependabot/terraform/terraform/environments/performance-hub/ap_landing_bucket--github--ministryofjustice/modernisation-platform-terraform-s3-bucket--v7.1.0-8.0.0 branch August 16, 2024 00:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file environments-repository Used to exclude PRs from this repo in our Slack PR update Stale terraform Pull requests that update Terraform code
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants