Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bump bastion_linux::modernisation-platform-terraform-bastion-linux from 4.2.1 to 4.3.0 in /terraform/environments/dacp #8190

Closed
wants to merge 1 commit into from
Closed

Bump bastion_linux::modernisation-platform-terraform-bastion-linux from 4.2.1 to 4.3.0 in /terraform/environments/dacp #8190

wants to merge 1 commit into from

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Oct 14, 2024

Bumps bastion_linux::modernisation-platform-terraform-bastion-linux from 4.2.1 to 4.3.0.

Release notes

Sourced from bastion_linux::modernisation-platform-terraform-bastion-linux's releases.

v4.3.0

What's New

Launch templates will now resolve the SSM Parameter for amzn2-ami-hvm-x86_64-gp2 and resolve the latest version when creating instances. You can read the AWS documentation on using parameter resolution in templates here.

What's Changed

New Contributors

Full Changelog: ministryofjustice/modernisation-platform-terraform-bastion-linux@v4.2.1...v4.3.0

Commits
  • 440a828 Merge pull request #563 from ministryofjustice/feature/1385-resolve-parameter...
  • 9b1804b terraform-docs: automated action
  • 7acb479 updated template to use dynamic resolution of SSM parameter store value
  • 72b6469 Merge pull request #562 from ministryofjustice/dependabot/github_actions/mini...
  • 2cab62f Bump ministryofjustice/github-actions from 18.2.0 to 18.2.1
  • de00773 Merge pull request #561 from ministryofjustice/dependabot/github_actions/acti...
  • 226a136 Bump actions/upload-artifact from 4.4.2 to 4.4.3
  • 69ed718 Merge pull request #560 from ministryofjustice/dependabot/github_actions/aqua...
  • 32650dd Merge pull request #558 from ministryofjustice/dependabot/github_actions/acti...
  • 55feca3 Merge pull request #559 from ministryofjustice/dependabot/github_actions/acti...
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
Bump bastion_linux::modernisation-platform-terraform-bastion-linux
f8d1c2e 
Bumps [bastion_linux::modernisation-platform-terraform-bastion-linux](https://github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux) from 4.2.1 to 4.3.0.
- [Release notes](https://github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux/releases)
- [Commits](ministryofjustice/modernisation-platform-terraform-bastion-linux@v4.2.1...v4.3.0)

---
updated-dependencies:
- dependency-name: bastion_linux::github::ministryofjustice/modernisation-platform-terraform-bastion-linux::v4.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot requested review from a team as code owners October 14, 2024 00:21
@dependabot dependabot bot added dependencies Pull requests that update a dependency file terraform Pull requests that update Terraform code labels Oct 14, 2024
@github-actions github-actions bot added the environments-repository Used to exclude PRs from this repo in our Slack PR update label Oct 14, 2024
@github-actions GitHub Actions
Copy link
Contributor

Trivy Scan Failed

Show Output ```hcl

Trivy will check the following folders:
terraform/environments/dacp

Running Trivy in terraform/environments/dacp
2024-10-14T00:22:14Z INFO [vulndb] Need to update DB
2024-10-14T00:22:14Z INFO [vulndb] Downloading vulnerability DB...
2024-10-14T00:22:14Z INFO [vulndb] Downloading artifact... repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-14T00:22:16Z INFO [vulndb] Artifact successfully downloaded repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-14T00:22:16Z INFO [vuln] Vulnerability scanning is enabled
2024-10-14T00:22:16Z INFO [misconfig] Misconfiguration scanning is enabled
2024-10-14T00:22:16Z INFO [misconfig] Need to update the built-in checks
2024-10-14T00:22:16Z INFO [misconfig] Downloading the built-in checks...
156.02 KiB / 156.02 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2024-10-14T00:22:16Z INFO [secret] Secret scanning is enabled
2024-10-14T00:22:16Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-14T00:22:16Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-10-14T00:22:18Z INFO [terraform scanner] Scanning root module file_path="."
2024-10-14T00:22:18Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="networking"
2024-10-14T00:22:18Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_route53_record.cert_validation" value="cty.NilVal"
2024-10-14T00:22:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.bastion_linux.aws_s3_object.user_public_keys" value="cty.NilVal"
2024-10-14T00:22:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.bastion_linux.data.aws_subnet.local_account" value="cty.NilVal"
2024-10-14T00:22:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.bastion_linux.dynamic.tag" value="cty.NilVal"
2024-10-14T00:22:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.bastion_linux.dynamic.tag" value="cty.NilVal"
2024-10-14T00:22:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.bastion_linux.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T00:22:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.bastion_linux.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T00:22:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.bastion_linux.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T00:22:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.bastion_linux.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T00:22:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.bastion_linux.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T00:22:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.bastion_linux.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T00:22:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.bastion_linux.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T00:22:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.bastion_linux.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T00:22:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.bastion_linux.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T00:22:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.bastion_linux.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T00:22:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.bastion_linux.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T00:22:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.bastion_linux.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T00:22:20Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.3.0/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=7b2b75c178f855d8c48d3bda4ac53df782288c02/main.tf:141-151"
2024-10-14T00:22:20Z INFO Number of language-specific files num=0
2024-10-14T00:22:20Z INFO Detected config files num=6

ecs.tf (terraform)

Tests: 5 (SUCCESSES: 0, FAILURES: 3, EXCEPTIONS: 2)
Failures: 3 (HIGH: 3, CRITICAL: 0)

HIGH: Image scanning is not enabled
════════════════════════════════════════
Repository image scans should be enabled to ensure vulnerable software can be discovered and remediated as soon as possible.

See https://avd.aquasec.com/misconfig/avd-aws-0030
────────────────────────────────────────
ecs.tf:347-350
────────────────────────────────────────
347 ┌ resource "aws_ecr_repository" "dacp_ecr_repo" {
348 │ name = "dacp-ecr-repo"
349 │ force_delete = true
350 └ }
────────────────────────────────────────

HIGH: Topic does not have encryption enabled.
════════════════════════════════════════
Topics should be encrypted to protect their contents.

See https://avd.aquasec.com/misconfig/avd-aws-0095
────────────────────────────────────────
ecs.tf:451-454
────────────────────────────────────────
451 ┌ resource "aws_sns_topic" "dacp_utilisation_alarm" {
452 │ count = local.is-development ? 0 : 1
453 │ name = "dacp_utilisation_alarm"
454 └ }
────────────────────────────────────────

HIGH: Topic does not have encryption enabled.
════════════════════════════════════════
Topics should be encrypted to protect their contents.

See https://avd.aquasec.com/misconfig/avd-aws-0095
────────────────────────────────────────
ecs.tf:446-449
────────────────────────────────────────
446 ┌ resource "aws_sns_topic" "ddos_alarm" {
447 │ count = local.is-development ? 0 : 1
448 │ name = "dacp_ddos_alarm"
449 └ }
────────────────────────────────────────

load_balancer.tf (terraform)

Tests: 4 (SUCCESSES: 0, FAILURES: 2, EXCEPTIONS: 2)
Failures: 2 (HIGH: 2, CRITICAL: 0)

HIGH: Application load balancer is not set to drop invalid headers.
════════════════════════════════════════
Passing unknown or invalid headers through to the target poses a potential risk of compromise.
By setting drop_invalid_header_fields to true, anything that does not conform to well known, defined headers will be removed by the load balancer.

See https://avd.aquasec.com/misconfig/avd-aws-0052
────────────────────────────────────────
load_balancer.tf:233-241
────────────────────────────────────────
233 ┌ resource "aws_lb" "dacp_lb" {
234 │ name = "dacp-load-balancer"
235 │ load_balancer_type = "application"
236 │ security_groups = [aws_security_group.dacp_lb_sc.id, aws_security_group.lb_sc_pingdom.id, aws_security_group.lb_sc_pingdom_2.id]
237 │ subnets = data.aws_subnets.shared-public.ids
238 │ enable_deletion_protection = false
239 │ internal = false
240 │ depends_on = [aws_security_group.dacp_lb_sc, aws_security_group.lb_sc_pingdom, aws_security_group.lb_sc_pingdom_2]
241 └ }
────────────────────────────────────────

HIGH: Load balancer is exposed publicly.
════════════════════════════════════════
There are many scenarios in which you would want to expose a load balancer to the wider internet, but this check exists as a warning to prevent accidental exposure of internal assets. You should ensure that this resource should be exposed publicly.

See https://avd.aquasec.com/misconfig/avd-aws-0053
────────────────────────────────────────
load_balancer.tf:239
via load_balancer.tf:233-241 (aws_lb.dacp_lb)
────────────────────────────────────────
233 resource "aws_lb" "dacp_lb" {
234 name = "dacp-load-balancer"
235 load_balancer_type = "application"
236 security_groups = [aws_security_group.dacp_lb_sc.id, aws_security_group.lb_sc_pingdom.id, aws_security_group.lb_sc_pingdom_2.id]
237 subnets = data.aws_subnets.shared-public.ids
238 enable_deletion_protection = false
239 [ internal = false
240 depends_on = [aws_security_group.dacp_lb_sc, aws_security_group.lb_sc_pingdom, aws_security_group.lb_sc_pingdom_2]
241 }
────────────────────────────────────────

rds.tf (terraform)

Tests: 2 (SUCCESSES: 0, FAILURES: 1, EXCEPTIONS: 1)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Instance does not have storage encryption enabled.
════════════════════════════════════════
Encryption should be enabled for an RDS Database instances.
When enabling encryption by setting the kms_key_id.

See https://avd.aquasec.com/misconfig/avd-aws-0080
────────────────────────────────────────
rds.tf:1-19
────────────────────────────────────────
1 ┌ resource "aws_db_instance" "dacp_db" {
2 │ count = local.is-development ? 0 : 1
3 │ allocated_storage = local.application_data.accounts[local.environment].allocated_storage
4 │ db_name = local.application_data.accounts[local.environment].db_name
5 │ storage_type = local.application_data.accounts[local.environment].storage_type
6 │ engine = local.application_data.accounts[local.environment].engine
7 │ identifier = local.application_data.accounts[local.environment].identifier
8 │ engine_version = local.application_data.accounts[local.environment].engine_version
9 └ instance_class = local.application_data.accounts[local.environment].instance_class
..
────────────────────────────────────────

trivy_exitcode=1

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/dacp

*****************************

Running Checkov in terraform/environments/dacp
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2024-10-14 00:22:23,210 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-pagerduty-integration?ref=v2.0.0:None (for external modules, the --download-external-modules flag is required)
2024-10-14 00:22:23,210 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.3.0:None (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 94, Failed checks: 55, Skipped checks: 0

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: bastion_linux
	File: /ec2_bastion_linux.tf:2-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		2  | module "bastion_linux" {
		3  |   source = "github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.3.0"
		4  | 
		5  |   providers = {
		6  |     aws.share-host   = aws.core-vpc # core-vpc-(environment) holds the networking for all accounts
		7  |     aws.share-tenant = aws          # The default provider (unaliased, `aws`) is the tenant
		8  |   }
		9  |   # s3 - used for logs and user ssh public keys
		10 |   bucket_name = "bastion-example"
		11 |   # bucket_versioning    = true
		12 |   # bucket_force_destroy = true
		13 |   # public keys
		14 |   public_key_data = local.public_key_data.keys[local.environment]
		15 |   # logs
		16 |   log_auto_clean       = "Enabled"
		17 |   log_standard_ia_days = 30  # days before moving to IA storage
		18 |   log_glacier_days     = 60  # days before moving to Glacier
		19 |   log_expiry_days      = 180 # days before log expiration
		20 |   # bastion
		21 |   allow_ssh_commands = false
		22 |   app_name           = var.networking[0].application
		23 |   business_unit      = local.vpc_name
		24 |   subnet_set         = local.subnet_set
		25 |   environment        = local.environment
		26 |   region             = "eu-west-2"
		27 | 
		28 |   # Tags
		29 |   tags_common = local.tags
		30 |   tags_prefix = terraform.workspace
		31 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: pagerduty_core_alerts_non_prod
	File: /ecs.tf:474-482
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		474 | module "pagerduty_core_alerts_non_prod" {
		475 |   count = local.is-preproduction ? 1 : 0
		476 |   depends_on = [
		477 |     aws_sns_topic.dacp_utilisation_alarm
		478 |   ]
		479 |   source                    = "github.com/ministryofjustice/modernisation-platform-terraform-pagerduty-integration?ref=v2.0.0"
		480 |   sns_topics                = [aws_sns_topic.dacp_utilisation_alarm[0].name]
		481 |   pagerduty_integration_key = local.pagerduty_integration_keys["dacp_non_prod_alarms"]
		482 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: pagerduty_core_alerts_prod
	File: /ecs.tf:485-493
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		485 | module "pagerduty_core_alerts_prod" {
		486 |   count = local.is-production ? 1 : 0
		487 |   depends_on = [
		488 |     aws_sns_topic.dacp_utilisation_alarm
		489 |   ]
		490 |   source                    = "github.com/ministryofjustice/modernisation-platform-terraform-pagerduty-integration?ref=v2.0.0"
		491 |   sns_topics                = [aws_sns_topic.dacp_utilisation_alarm[0].name]
		492 |   pagerduty_integration_key = local.pagerduty_integration_keys["dacp_prod_alarms"]
		493 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.deployment_logs
	File: /ecs.tf:9-12
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		9  | resource "aws_cloudwatch_log_group" "deployment_logs" {
		10 |   name              = "/aws/events/deploymentLogs"
		11 |   retention_in_days = "7"
		12 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.ecs_logs
	File: /ecs.tf:14-17
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		14 | resource "aws_cloudwatch_log_group" "ecs_logs" {
		15 |   name              = "dacp-ecs"
		16 |   retention_in_days = "7"
		17 | }

Check: CKV_AWS_290: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_role_policy.app_execution
	File: /ecs.tf:255-275
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-290

		255 | resource "aws_iam_role_policy" "app_execution" {
		256 |   name = "execution-${var.networking[0].application}"
		257 |   role = aws_iam_role.app_execution.id
		258 | 
		259 |   policy = <<-EOF
		260 |   {
		261 |     "Version": "2012-10-17",
		262 |     "Statement": [
		263 |       {
		264 |            "Action": [
		265 |               "ecr:*",
		266 |               "logs:*",
		267 |               "secretsmanager:GetSecretValue"
		268 |            ],
		269 |            "Resource": "*",
		270 |            "Effect": "Allow"
		271 |       }
		272 |     ]
		273 |   }
		274 |   EOF
		275 | }

Check: CKV_AWS_355: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_role_policy.app_execution
	File: /ecs.tf:255-275
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-355

		255 | resource "aws_iam_role_policy" "app_execution" {
		256 |   name = "execution-${var.networking[0].application}"
		257 |   role = aws_iam_role.app_execution.id
		258 | 
		259 |   policy = <<-EOF
		260 |   {
		261 |     "Version": "2012-10-17",
		262 |     "Statement": [
		263 |       {
		264 |            "Action": [
		265 |               "ecr:*",
		266 |               "logs:*",
		267 |               "secretsmanager:GetSecretValue"
		268 |            ],
		269 |            "Resource": "*",
		270 |            "Effect": "Allow"
		271 |       }
		272 |     ]
		273 |   }
		274 |   EOF
		275 | }

Check: CKV_AWS_288: "Ensure IAM policies does not allow data exfiltration"
	FAILED for resource: aws_iam_role_policy.app_execution
	File: /ecs.tf:255-275
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-288

		255 | resource "aws_iam_role_policy" "app_execution" {
		256 |   name = "execution-${var.networking[0].application}"
		257 |   role = aws_iam_role.app_execution.id
		258 | 
		259 |   policy = <<-EOF
		260 |   {
		261 |     "Version": "2012-10-17",
		262 |     "Statement": [
		263 |       {
		264 |            "Action": [
		265 |               "ecr:*",
		266 |               "logs:*",
		267 |               "secretsmanager:GetSecretValue"
		268 |            ],
		269 |            "Resource": "*",
		270 |            "Effect": "Allow"
		271 |       }
		272 |     ]
		273 |   }
		274 |   EOF
		275 | }

Check: CKV_AWS_289: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: aws_iam_role_policy.app_execution
	File: /ecs.tf:255-275
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-289

		255 | resource "aws_iam_role_policy" "app_execution" {
		256 |   name = "execution-${var.networking[0].application}"
		257 |   role = aws_iam_role.app_execution.id
		258 | 
		259 |   policy = <<-EOF
		260 |   {
		261 |     "Version": "2012-10-17",
		262 |     "Statement": [
		263 |       {
		264 |            "Action": [
		265 |               "ecr:*",
		266 |               "logs:*",
		267 |               "secretsmanager:GetSecretValue"
		268 |            ],
		269 |            "Resource": "*",
		270 |            "Effect": "Allow"
		271 |       }
		272 |     ]
		273 |   }
		274 |   EOF
		275 | }

Check: CKV_AWS_290: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_role_policy.app_task
	File: /ecs.tf:304-325
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-290

		304 | resource "aws_iam_role_policy" "app_task" {
		305 |   name = "task-${var.networking[0].application}"
		306 |   role = aws_iam_role.app_task.id
		307 | 
		308 |   policy = <<-EOF
		309 |   {
		310 |    "Version": "2012-10-17",
		311 |    "Statement": [
		312 |      {
		313 |        "Effect": "Allow",
		314 |         "Action": [
		315 |           "logs:*",
		316 |           "ecr:*",
		317 |           "iam:*",
		318 |           "ec2:*"
		319 |         ],
		320 |        "Resource": "*"
		321 |      }
		322 |    ]
		323 |   }
		324 |   EOF
		325 | }

Check: CKV_AWS_355: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_role_policy.app_task
	File: /ecs.tf:304-325
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-355

		304 | resource "aws_iam_role_policy" "app_task" {
		305 |   name = "task-${var.networking[0].application}"
		306 |   role = aws_iam_role.app_task.id
		307 | 
		308 |   policy = <<-EOF
		309 |   {
		310 |    "Version": "2012-10-17",
		311 |    "Statement": [
		312 |      {
		313 |        "Effect": "Allow",
		314 |         "Action": [
		315 |           "logs:*",
		316 |           "ecr:*",
		317 |           "iam:*",
		318 |           "ec2:*"
		319 |         ],
		320 |        "Resource": "*"
		321 |      }
		322 |    ]
		323 |   }
		324 |   EOF
		325 | }

Check: CKV_AWS_286: "Ensure IAM policies does not allow privilege escalation"
	FAILED for resource: aws_iam_role_policy.app_task
	File: /ecs.tf:304-325
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-286

		304 | resource "aws_iam_role_policy" "app_task" {
		305 |   name = "task-${var.networking[0].application}"
		306 |   role = aws_iam_role.app_task.id
		307 | 
		308 |   policy = <<-EOF
		309 |   {
		310 |    "Version": "2012-10-17",
		311 |    "Statement": [
		312 |      {
		313 |        "Effect": "Allow",
		314 |         "Action": [
		315 |           "logs:*",
		316 |           "ecr:*",
		317 |           "iam:*",
		318 |           "ec2:*"
		319 |         ],
		320 |        "Resource": "*"
		321 |      }
		322 |    ]
		323 |   }
		324 |   EOF
		325 | }

Check: CKV_AWS_289: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: aws_iam_role_policy.app_task
	File: /ecs.tf:304-325
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-289

		304 | resource "aws_iam_role_policy" "app_task" {
		305 |   name = "task-${var.networking[0].application}"
		306 |   role = aws_iam_role.app_task.id
		307 | 
		308 |   policy = <<-EOF
		309 |   {
		310 |    "Version": "2012-10-17",
		311 |    "Statement": [
		312 |      {
		313 |        "Effect": "Allow",
		314 |         "Action": [
		315 |           "logs:*",
		316 |           "ecr:*",
		317 |           "iam:*",
		318 |           "ec2:*"
		319 |         ],
		320 |        "Resource": "*"
		321 |      }
		322 |    ]
		323 |   }
		324 |   EOF
		325 | }

Check: CKV_AWS_287: "Ensure IAM policies does not allow credentials exposure"
	FAILED for resource: aws_iam_role_policy.app_task
	File: /ecs.tf:304-325
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-287

		304 | resource "aws_iam_role_policy" "app_task" {
		305 |   name = "task-${var.networking[0].application}"
		306 |   role = aws_iam_role.app_task.id
		307 | 
		308 |   policy = <<-EOF
		309 |   {
		310 |    "Version": "2012-10-17",
		311 |    "Statement": [
		312 |      {
		313 |        "Effect": "Allow",
		314 |         "Action": [
		315 |           "logs:*",
		316 |           "ecr:*",
		317 |           "iam:*",
		318 |           "ec2:*"
		319 |         ],
		320 |        "Resource": "*"
		321 |      }
		322 |    ]
		323 |   }
		324 |   EOF
		325 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: aws_security_group.ecs_service
	File: /ecs.tf:327-345
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		327 | resource "aws_security_group" "ecs_service" {
		328 |   name_prefix = "ecs-service-sg-"
		329 |   vpc_id      = data.aws_vpc.shared.id
		330 | 
		331 |   ingress {
		332 |     from_port       = 80
		333 |     to_port         = 80
		334 |     protocol        = "tcp"
		335 |     description     = "Allow traffic on port 80 from load balancer"
		336 |     security_groups = [aws_security_group.dacp_lb_sc.id]
		337 |   }
		338 | 
		339 |   egress {
		340 |     from_port   = 0
		341 |     to_port     = 0
		342 |     protocol    = "-1"
		343 |     cidr_blocks = ["0.0.0.0/0"]
		344 |   }
		345 | }

Check: CKV_AWS_136: "Ensure that ECR repositories are encrypted using KMS"
	FAILED for resource: aws_ecr_repository.dacp_ecr_repo
	File: /ecs.tf:347-350
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-ecr-repositories-are-encrypted

		347 | resource "aws_ecr_repository" "dacp_ecr_repo" {
		348 |   name         = "dacp-ecr-repo"
		349 |   force_delete = true
		350 | }

Check: CKV_AWS_163: "Ensure ECR image scanning on push is enabled"
	FAILED for resource: aws_ecr_repository.dacp_ecr_repo
	File: /ecs.tf:347-350
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-8

		347 | resource "aws_ecr_repository" "dacp_ecr_repo" {
		348 |   name         = "dacp-ecr-repo"
		349 |   force_delete = true
		350 | }

Check: CKV_AWS_51: "Ensure ECR Image Tags are immutable"
	FAILED for resource: aws_ecr_repository.dacp_ecr_repo
	File: /ecs.tf:347-350
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-general-24

		347 | resource "aws_ecr_repository" "dacp_ecr_repo" {
		348 |   name         = "dacp-ecr-repo"
		349 |   force_delete = true
		350 | }

Check: CKV_AWS_26: "Ensure all data stored in the SNS topic is encrypted"
	FAILED for resource: aws_sns_topic.ddos_alarm
	File: /ecs.tf:446-449
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-15

		446 | resource "aws_sns_topic" "ddos_alarm" {
		447 |   count = local.is-development ? 0 : 1
		448 |   name  = "dacp_ddos_alarm"
		449 | }

Check: CKV_AWS_26: "Ensure all data stored in the SNS topic is encrypted"
	FAILED for resource: aws_sns_topic.dacp_utilisation_alarm
	File: /ecs.tf:451-454
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-15

		451 | resource "aws_sns_topic" "dacp_utilisation_alarm" {
		452 |   count = local.is-development ? 0 : 1
		453 |   name  = "dacp_utilisation_alarm"
		454 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: aws_security_group.dacp_lb_sc
	File: /load_balancer.tf:1-85
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: aws_security_group.lb_sc_pingdom
	File: /load_balancer.tf:87-158
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: aws_security_group.lb_sc_pingdom_2
	File: /load_balancer.tf:160-231
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_91: "Ensure the ELBv2 (Application/Network) has access logging enabled"
	FAILED for resource: aws_lb.dacp_lb
	File: /load_balancer.tf:233-241
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-logging-22

		233 | resource "aws_lb" "dacp_lb" {
		234 |   name                       = "dacp-load-balancer"
		235 |   load_balancer_type         = "application"
		236 |   security_groups            = [aws_security_group.dacp_lb_sc.id, aws_security_group.lb_sc_pingdom.id, aws_security_group.lb_sc_pingdom_2.id]
		237 |   subnets                    = data.aws_subnets.shared-public.ids
		238 |   enable_deletion_protection = false
		239 |   internal                   = false
		240 |   depends_on                 = [aws_security_group.dacp_lb_sc, aws_security_group.lb_sc_pingdom, aws_security_group.lb_sc_pingdom_2]
		241 | }

Check: CKV_AWS_131: "Ensure that ALB drops HTTP headers"
	FAILED for resource: aws_lb.dacp_lb
	File: /load_balancer.tf:233-241
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-alb-drops-http-headers

		233 | resource "aws_lb" "dacp_lb" {
		234 |   name                       = "dacp-load-balancer"
		235 |   load_balancer_type         = "application"
		236 |   security_groups            = [aws_security_group.dacp_lb_sc.id, aws_security_group.lb_sc_pingdom.id, aws_security_group.lb_sc_pingdom_2.id]
		237 |   subnets                    = data.aws_subnets.shared-public.ids
		238 |   enable_deletion_protection = false
		239 |   internal                   = false
		240 |   depends_on                 = [aws_security_group.dacp_lb_sc, aws_security_group.lb_sc_pingdom, aws_security_group.lb_sc_pingdom_2]
		241 | }

Check: CKV_AWS_150: "Ensure that Load Balancer has deletion protection enabled"
	FAILED for resource: aws_lb.dacp_lb
	File: /load_balancer.tf:233-241
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-150

		233 | resource "aws_lb" "dacp_lb" {
		234 |   name                       = "dacp-load-balancer"
		235 |   load_balancer_type         = "application"
		236 |   security_groups            = [aws_security_group.dacp_lb_sc.id, aws_security_group.lb_sc_pingdom.id, aws_security_group.lb_sc_pingdom_2.id]
		237 |   subnets                    = data.aws_subnets.shared-public.ids
		238 |   enable_deletion_protection = false
		239 |   internal                   = false
		240 |   depends_on                 = [aws_security_group.dacp_lb_sc, aws_security_group.lb_sc_pingdom, aws_security_group.lb_sc_pingdom_2]
		241 | }

Check: CKV_AWS_378: "Ensure AWS Load Balancer doesn't use HTTP protocol"
	FAILED for resource: aws_lb_target_group.dacp_target_group
	File: /load_balancer.tf:243-265

		243 | resource "aws_lb_target_group" "dacp_target_group" {
		244 |   name                 = "dacp-target-group"
		245 |   port                 = 80
		246 |   protocol             = "HTTP"
		247 |   vpc_id               = data.aws_vpc.shared.id
		248 |   target_type          = "ip"
		249 |   deregistration_delay = 30
		250 | 
		251 |   stickiness {
		252 |     type = "lb_cookie"
		253 |   }
		254 | 
		255 |   health_check {
		256 |     healthy_threshold   = "3"
		257 |     interval            = "30"
		258 |     protocol            = "HTTP"
		259 |     port                = "80"
		260 |     unhealthy_threshold = "5"
		261 |     matcher             = "200-302"
		262 |     timeout             = "10"
		263 |   }
		264 | 
		265 | }

Check: CKV_AWS_261: "Ensure HTTP HTTPS Target group defines Healthcheck"
	FAILED for resource: aws_lb_target_group.dacp_target_group
	File: /load_balancer.tf:243-265
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-kendra-index-server-side-encryption-uses-customer-managed-keys-cmks

		243 | resource "aws_lb_target_group" "dacp_target_group" {
		244 |   name                 = "dacp-target-group"
		245 |   port                 = 80
		246 |   protocol             = "HTTP"
		247 |   vpc_id               = data.aws_vpc.shared.id
		248 |   target_type          = "ip"
		249 |   deregistration_delay = 30
		250 | 
		251 |   stickiness {
		252 |     type = "lb_cookie"
		253 |   }
		254 | 
		255 |   health_check {
		256 |     healthy_threshold   = "3"
		257 |     interval            = "30"
		258 |     protocol            = "HTTP"
		259 |     port                = "80"
		260 |     unhealthy_threshold = "5"
		261 |     matcher             = "200-302"
		262 |     timeout             = "10"
		263 |   }
		264 | 
		265 | }

Check: CKV_AWS_2: "Ensure ALB protocol is HTTPS"
	FAILED for resource: aws_lb_listener.dacp_lb
	File: /load_balancer.tf:267-281
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-29

		267 | resource "aws_lb_listener" "dacp_lb" {
		268 |   depends_on = [
		269 |     aws_acm_certificate.external
		270 |   ]
		271 |   certificate_arn   = local.is-production ? aws_acm_certificate.external.arn : aws_acm_certificate.external.arn
		272 |   load_balancer_arn = aws_lb.dacp_lb.arn
		273 |   port              = local.application_data.accounts[local.environment].server_port_2
		274 |   protocol          = local.application_data.accounts[local.environment].lb_listener_protocol_2
		275 |   ssl_policy        = local.application_data.accounts[local.environment].lb_listener_protocol_2 == "HTTP" ? "" : "ELBSecurityPolicy-TLS13-1-2-2021-06"
		276 | 
		277 |   default_action {
		278 |     type             = "forward"
		279 |     target_group_arn = aws_lb_target_group.dacp_target_group.arn
		280 |   }
		281 | }

Check: CKV_AWS_157: "Ensure that RDS instances have Multi-AZ enabled"
	FAILED for resource: aws_db_instance.dacp_db
	File: /rds.tf:1-19
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-73

		1  | resource "aws_db_instance" "dacp_db" {
		2  |   count                       = local.is-development ? 0 : 1
		3  |   allocated_storage           = local.application_data.accounts[local.environment].allocated_storage
		4  |   db_name                     = local.application_data.accounts[local.environment].db_name
		5  |   storage_type                = local.application_data.accounts[local.environment].storage_type
		6  |   engine                      = local.application_data.accounts[local.environment].engine
		7  |   identifier                  = local.application_data.accounts[local.environment].identifier
		8  |   engine_version              = local.application_data.accounts[local.environment].engine_version
		9  |   instance_class              = local.application_data.accounts[local.environment].instance_class
		10 |   username                    = local.application_data.accounts[local.environment].db_username
		11 |   password                    = random_password.password.result
		12 |   skip_final_snapshot         = true
		13 |   publicly_accessible         = false
		14 |   vpc_security_group_ids      = [aws_security_group.postgresql_db_sc[0].id]
		15 |   db_subnet_group_name        = aws_db_subnet_group.dbsubnetgroup.name
		16 |   allow_major_version_upgrade = true
		17 |   ca_cert_identifier          = "rds-ca-rsa2048-g1"
		18 |   apply_immediately           = true
		19 | }

Check: CKV_AWS_118: "Ensure that enhanced monitoring is enabled for Amazon RDS instances"
	FAILED for resource: aws_db_instance.dacp_db
	File: /rds.tf:1-19
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/ensure-that-enhanced-monitoring-is-enabled-for-amazon-rds-instances

		1  | resource "aws_db_instance" "dacp_db" {
		2  |   count                       = local.is-development ? 0 : 1
		3  |   allocated_storage           = local.application_data.accounts[local.environment].allocated_storage
		4  |   db_name                     = local.application_data.accounts[local.environment].db_name
		5  |   storage_type                = local.application_data.accounts[local.environment].storage_type
		6  |   engine                      = local.application_data.accounts[local.environment].engine
		7  |   identifier                  = local.application_data.accounts[local.environment].identifier
		8  |   engine_version              = local.application_data.accounts[local.environment].engine_version
		9  |   instance_class              = local.application_data.accounts[local.environment].instance_class
		10 |   username                    = local.application_data.accounts[local.environment].db_username
		11 |   password                    = random_password.password.result
		12 |   skip_final_snapshot         = true
		13 |   publicly_accessible         = false
		14 |   vpc_security_group_ids      = [aws_security_group.postgresql_db_sc[0].id]
		15 |   db_subnet_group_name        = aws_db_subnet_group.dbsubnetgroup.name
		16 |   allow_major_version_upgrade = true
		17 |   ca_cert_identifier          = "rds-ca-rsa2048-g1"
		18 |   apply_immediately           = true
		19 | }

Check: CKV_AWS_16: "Ensure all data stored in the RDS is securely encrypted at rest"
	FAILED for resource: aws_db_instance.dacp_db
	File: /rds.tf:1-19
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-4

		1  | resource "aws_db_instance" "dacp_db" {
		2  |   count                       = local.is-development ? 0 : 1
		3  |   allocated_storage           = local.application_data.accounts[local.environment].allocated_storage
		4  |   db_name                     = local.application_data.accounts[local.environment].db_name
		5  |   storage_type                = local.application_data.accounts[local.environment].storage_type
		6  |   engine                      = local.application_data.accounts[local.environment].engine
		7  |   identifier                  = local.application_data.accounts[local.environment].identifier
		8  |   engine_version              = local.application_data.accounts[local.environment].engine_version
		9  |   instance_class              = local.application_data.accounts[local.environment].instance_class
		10 |   username                    = local.application_data.accounts[local.environment].db_username
		11 |   password                    = random_password.password.result
		12 |   skip_final_snapshot         = true
		13 |   publicly_accessible         = false
		14 |   vpc_security_group_ids      = [aws_security_group.postgresql_db_sc[0].id]
		15 |   db_subnet_group_name        = aws_db_subnet_group.dbsubnetgroup.name
		16 |   allow_major_version_upgrade = true
		17 |   ca_cert_identifier          = "rds-ca-rsa2048-g1"
		18 |   apply_immediately           = true
		19 | }

Check: CKV_AWS_129: "Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled"
	FAILED for resource: aws_db_instance.dacp_db
	File: /rds.tf:1-19
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-that-respective-logs-of-amazon-relational-database-service-amazon-rds-are-enabled

		1  | resource "aws_db_instance" "dacp_db" {
		2  |   count                       = local.is-development ? 0 : 1
		3  |   allocated_storage           = local.application_data.accounts[local.environment].allocated_storage
		4  |   db_name                     = local.application_data.accounts[local.environment].db_name
		5  |   storage_type                = local.application_data.accounts[local.environment].storage_type
		6  |   engine                      = local.application_data.accounts[local.environment].engine
		7  |   identifier                  = local.application_data.accounts[local.environment].identifier
		8  |   engine_version              = local.application_data.accounts[local.environment].engine_version
		9  |   instance_class              = local.application_data.accounts[local.environment].instance_class
		10 |   username                    = local.application_data.accounts[local.environment].db_username
		11 |   password                    = random_password.password.result
		12 |   skip_final_snapshot         = true
		13 |   publicly_accessible         = false
		14 |   vpc_security_group_ids      = [aws_security_group.postgresql_db_sc[0].id]
		15 |   db_subnet_group_name        = aws_db_subnet_group.dbsubnetgroup.name
		16 |   allow_major_version_upgrade = true
		17 |   ca_cert_identifier          = "rds-ca-rsa2048-g1"
		18 |   apply_immediately           = true
		19 | }

Check: CKV_AWS_226: "Ensure DB instance gets all minor upgrades automatically"
	FAILED for resource: aws_db_instance.dacp_db
	File: /rds.tf:1-19
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-db-instance-gets-all-minor-upgrades-automatically

		1  | resource "aws_db_instance" "dacp_db" {
		2  |   count                       = local.is-development ? 0 : 1
		3  |   allocated_storage           = local.application_data.accounts[local.environment].allocated_storage
		4  |   db_name                     = local.application_data.accounts[local.environment].db_name
		5  |   storage_type                = local.application_data.accounts[local.environment].storage_type
		6  |   engine                      = local.application_data.accounts[local.environment].engine
		7  |   identifier                  = local.application_data.accounts[local.environment].identifier
		8  |   engine_version              = local.application_data.accounts[local.environment].engine_version
		9  |   instance_class              = local.application_data.accounts[local.environment].instance_class
		10 |   username                    = local.application_data.accounts[local.environment].db_username
		11 |   password                    = random_password.password.result
		12 |   skip_final_snapshot         = true
		13 |   publicly_accessible         = false
		14 |   vpc_security_group_ids      = [aws_security_group.postgresql_db_sc[0].id]
		15 |   db_subnet_group_name        = aws_db_subnet_group.dbsubnetgroup.name
		16 |   allow_major_version_upgrade = true
		17 |   ca_cert_identifier          = "rds-ca-rsa2048-g1"
		18 |   apply_immediately           = true
		19 | }

Check: CKV_AWS_354: "Ensure RDS Performance Insights are encrypted using KMS CMKs"
	FAILED for resource: aws_db_instance.dacp_db
	File: /rds.tf:1-19
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-354

		1  | resource "aws_db_instance" "dacp_db" {
		2  |   count                       = local.is-development ? 0 : 1
		3  |   allocated_storage           = local.application_data.accounts[local.environment].allocated_storage
		4  |   db_name                     = local.application_data.accounts[local.environment].db_name
		5  |   storage_type                = local.application_data.accounts[local.environment].storage_type
		6  |   engine                      = local.application_data.accounts[local.environment].engine
		7  |   identifier                  = local.application_data.accounts[local.environment].identifier
		8  |   engine_version              = local.application_data.accounts[local.environment].engine_version
		9  |   instance_class              = local.application_data.accounts[local.environment].instance_class
		10 |   username                    = local.application_data.accounts[local.environment].db_username
		11 |   password                    = random_password.password.result
		12 |   skip_final_snapshot         = true
		13 |   publicly_accessible         = false
		14 |   vpc_security_group_ids      = [aws_security_group.postgresql_db_sc[0].id]
		15 |   db_subnet_group_name        = aws_db_subnet_group.dbsubnetgroup.name
		16 |   allow_major_version_upgrade = true
		17 |   ca_cert_identifier          = "rds-ca-rsa2048-g1"
		18 |   apply_immediately           = true
		19 | }

Check: CKV_AWS_353: "Ensure that RDS instances have performance insights enabled"
	FAILED for resource: aws_db_instance.dacp_db
	File: /rds.tf:1-19
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-353

		1  | resource "aws_db_instance" "dacp_db" {
		2  |   count                       = local.is-development ? 0 : 1
		3  |   allocated_storage           = local.application_data.accounts[local.environment].allocated_storage
		4  |   db_name                     = local.application_data.accounts[local.environment].db_name
		5  |   storage_type                = local.application_data.accounts[local.environment].storage_type
		6  |   engine                      = local.application_data.accounts[local.environment].engine
		7  |   identifier                  = local.application_data.accounts[local.environment].identifier
		8  |   engine_version              = local.application_data.accounts[local.environment].engine_version
		9  |   instance_class              = local.application_data.accounts[local.environment].instance_class
		10 |   username                    = local.application_data.accounts[local.environment].db_username
		11 |   password                    = random_password.password.result
		12 |   skip_final_snapshot         = true
		13 |   publicly_accessible         = false
		14 |   vpc_security_group_ids      = [aws_security_group.postgresql_db_sc[0].id]
		15 |   db_subnet_group_name        = aws_db_subnet_group.dbsubnetgroup.name
		16 |   allow_major_version_upgrade = true
		17 |   ca_cert_identifier          = "rds-ca-rsa2048-g1"
		18 |   apply_immediately           = true
		19 | }

Check: CKV_AWS_293: "Ensure that AWS database instances have deletion protection enabled"
	FAILED for resource: aws_db_instance.dacp_db
	File: /rds.tf:1-19
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-293

		1  | resource "aws_db_instance" "dacp_db" {
		2  |   count                       = local.is-development ? 0 : 1
		3  |   allocated_storage           = local.application_data.accounts[local.environment].allocated_storage
		4  |   db_name                     = local.application_data.accounts[local.environment].db_name
		5  |   storage_type                = local.application_data.accounts[local.environment].storage_type
		6  |   engine                      = local.application_data.accounts[local.environment].engine
		7  |   identifier                  = local.application_data.accounts[local.environment].identifier
		8  |   engine_version              = local.application_data.accounts[local.environment].engine_version
		9  |   instance_class              = local.application_data.accounts[local.environment].instance_class
		10 |   username                    = local.application_data.accounts[local.environment].db_username
		11 |   password                    = random_password.password.result
		12 |   skip_final_snapshot         = true
		13 |   publicly_accessible         = false
		14 |   vpc_security_group_ids      = [aws_security_group.postgresql_db_sc[0].id]
		15 |   db_subnet_group_name        = aws_db_subnet_group.dbsubnetgroup.name
		16 |   allow_major_version_upgrade = true
		17 |   ca_cert_identifier          = "rds-ca-rsa2048-g1"
		18 |   apply_immediately           = true
		19 | }

Check: CKV_AWS_157: "Ensure that RDS instances have Multi-AZ enabled"
	FAILED for resource: aws_db_instance.dacp_db_dev
	File: /rds.tf:60-76
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-73

		60 | resource "aws_db_instance" "dacp_db_dev" {
		61 |   count                       = local.is-development ? 1 : 0
		62 |   allocated_storage           = local.application_data.accounts[local.environment].allocated_storage
		63 |   db_name                     = local.application_data.accounts[local.environment].db_name
		64 |   storage_type                = local.application_data.accounts[local.environment].storage_type
		65 |   engine                      = local.application_data.accounts[local.environment].engine
		66 |   identifier                  = local.application_data.accounts[local.environment].identifier
		67 |   engine_version              = local.application_data.accounts[local.environment].engine_version
		68 |   instance_class              = local.application_data.accounts[local.environment].instance_class
		69 |   username                    = local.application_data.accounts[local.environment].db_username
		70 |   password                    = random_password.password.result
		71 |   skip_final_snapshot         = true
		72 |   publicly_accessible         = true
		73 |   vpc_security_group_ids      = [aws_security_group.postgresql_db_sc_dev[0].id]
		74 |   db_subnet_group_name        = aws_db_subnet_group.dbsubnetgroup.name
		75 |   allow_major_version_upgrade = true
		76 | }

Check: CKV_AWS_118: "Ensure that enhanced monitoring is enabled for Amazon RDS instances"
	FAILED for resource: aws_db_instance.dacp_db_dev
	File: /rds.tf:60-76
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/ensure-that-enhanced-monitoring-is-enabled-for-amazon-rds-instances

		60 | resource "aws_db_instance" "dacp_db_dev" {
		61 |   count                       = local.is-development ? 1 : 0
		62 |   allocated_storage           = local.application_data.accounts[local.environment].allocated_storage
		63 |   db_name                     = local.application_data.accounts[local.environment].db_name
		64 |   storage_type                = local.application_data.accounts[local.environment].storage_type
		65 |   engine                      = local.application_data.accounts[local.environment].engine
		66 |   identifier                  = local.application_data.accounts[local.environment].identifier
		67 |   engine_version              = local.application_data.accounts[local.environment].engine_version
		68 |   instance_class              = local.application_data.accounts[local.environment].instance_class
		69 |   username                    = local.application_data.accounts[local.environment].db_username
		70 |   password                    = random_password.password.result
		71 |   skip_final_snapshot         = true
		72 |   publicly_accessible         = true
		73 |   vpc_security_group_ids      = [aws_security_group.postgresql_db_sc_dev[0].id]
		74 |   db_subnet_group_name        = aws_db_subnet_group.dbsubnetgroup.name
		75 |   allow_major_version_upgrade = true
		76 | }

Check: CKV_AWS_17: "Ensure all data stored in RDS is not publicly accessible"
	FAILED for resource: aws_db_instance.dacp_db_dev
	File: /rds.tf:60-76
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/public-policies/public-2

		60 | resource "aws_db_instance" "dacp_db_dev" {
		61 |   count                       = local.is-development ? 1 : 0
		62 |   allocated_storage           = local.application_data.accounts[local.environment].allocated_storage
		63 |   db_name                     = local.application_data.accounts[local.environment].db_name
		64 |   storage_type                = local.application_data.accounts[local.environment].storage_type
		65 |   engine                      = local.application_data.accounts[local.environment].engine
		66 |   identifier                  = local.application_data.accounts[local.environment].identifier
		67 |   engine_version              = local.application_data.accounts[local.environment].engine_version
		68 |   instance_class              = local.application_data.accounts[local.environment].instance_class
		69 |   username                    = local.application_data.accounts[local.environment].db_username
		70 |   password                    = random_password.password.result
		71 |   skip_final_snapshot         = true
		72 |   publicly_accessible         = true
		73 |   vpc_security_group_ids      = [aws_security_group.postgresql_db_sc_dev[0].id]
		74 |   db_subnet_group_name        = aws_db_subnet_group.dbsubnetgroup.name
		75 |   allow_major_version_upgrade = true
		76 | }

Check: CKV_AWS_16: "Ensure all data stored in the RDS is securely encrypted at rest"
	FAILED for resource: aws_db_instance.dacp_db_dev
	File: /rds.tf:60-76
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-4

		60 | resource "aws_db_instance" "dacp_db_dev" {
		61 |   count                       = local.is-development ? 1 : 0
		62 |   allocated_storage           = local.application_data.accounts[local.environment].allocated_storage
		63 |   db_name                     = local.application_data.accounts[local.environment].db_name
		64 |   storage_type                = local.application_data.accounts[local.environment].storage_type
		65 |   engine                      = local.application_data.accounts[local.environment].engine
		66 |   identifier                  = local.application_data.accounts[local.environment].identifier
		67 |   engine_version              = local.application_data.accounts[local.environment].engine_version
		68 |   instance_class              = local.application_data.accounts[local.environment].instance_class
		69 |   username                    = local.application_data.accounts[local.environment].db_username
		70 |   password                    = random_password.password.result
		71 |   skip_final_snapshot         = true
		72 |   publicly_accessible         = true
		73 |   vpc_security_group_ids      = [aws_security_group.postgresql_db_sc_dev[0].id]
		74 |   db_subnet_group_name        = aws_db_subnet_group.dbsubnetgroup.name
		75 |   allow_major_version_upgrade = true
		76 | }

Check: CKV_AWS_129: "Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled"
	FAILED for resource: aws_db_instance.dacp_db_dev
	File: /rds.tf:60-76
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-that-respective-logs-of-amazon-relational-database-service-amazon-rds-are-enabled

		60 | resource "aws_db_instance" "dacp_db_dev" {
		61 |   count                       = local.is-development ? 1 : 0
		62 |   allocated_storage           = local.application_data.accounts[local.environment].allocated_storage
		63 |   db_name                     = local.application_data.accounts[local.environment].db_name
		64 |   storage_type                = local.application_data.accounts[local.environment].storage_type
		65 |   engine                      = local.application_data.accounts[local.environment].engine
		66 |   identifier                  = local.application_data.accounts[local.environment].identifier
		67 |   engine_version              = local.application_data.accounts[local.environment].engine_version
		68 |   instance_class              = local.application_data.accounts[local.environment].instance_class
		69 |   username                    = local.application_data.accounts[local.environment].db_username
		70 |   password                    = random_password.password.result
		71 |   skip_final_snapshot         = true
		72 |   publicly_accessible         = true
		73 |   vpc_security_group_ids      = [aws_security_group.postgresql_db_sc_dev[0].id]
		74 |   db_subnet_group_name        = aws_db_subnet_group.dbsubnetgroup.name
		75 |   allow_major_version_upgrade = true
		76 | }

Check: CKV_AWS_226: "Ensure DB instance gets all minor upgrades automatically"
	FAILED for resource: aws_db_instance.dacp_db_dev
	File: /rds.tf:60-76
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-db-instance-gets-all-minor-upgrades-automatically

		60 | resource "aws_db_instance" "dacp_db_dev" {
		61 |   count                       = local.is-development ? 1 : 0
		62 |   allocated_storage           = local.application_data.accounts[local.environment].allocated_storage
		63 |   db_name                     = local.application_data.accounts[local.environment].db_name
		64 |   storage_type                = local.application_data.accounts[local.environment].storage_type
		65 |   engine                      = local.application_data.accounts[local.environment].engine
		66 |   identifier                  = local.application_data.accounts[local.environment].identifier
		67 |   engine_version              = local.application_data.accounts[local.environment].engine_version
		68 |   instance_class              = local.application_data.accounts[local.environment].instance_class
		69 |   username                    = local.application_data.accounts[local.environment].db_username
		70 |   password                    = random_password.password.result
		71 |   skip_final_snapshot         = true
		72 |   publicly_accessible         = true
		73 |   vpc_security_group_ids      = [aws_security_group.postgresql_db_sc_dev[0].id]
		74 |   db_subnet_group_name        = aws_db_subnet_group.dbsubnetgroup.name
		75 |   allow_major_version_upgrade = true
		76 | }

Check: CKV_AWS_354: "Ensure RDS Performance Insights are encrypted using KMS CMKs"
	FAILED for resource: aws_db_instance.dacp_db_dev
	File: /rds.tf:60-76
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-354

		60 | resource "aws_db_instance" "dacp_db_dev" {
		61 |   count                       = local.is-development ? 1 : 0
		62 |   allocated_storage           = local.application_data.accounts[local.environment].allocated_storage
		63 |   db_name                     = local.application_data.accounts[local.environment].db_name
		64 |   storage_type                = local.application_data.accounts[local.environment].storage_type
		65 |   engine                      = local.application_data.accounts[local.environment].engine
		66 |   identifier                  = local.application_data.accounts[local.environment].identifier
		67 |   engine_version              = local.application_data.accounts[local.environment].engine_version
		68 |   instance_class              = local.application_data.accounts[local.environment].instance_class
		69 |   username                    = local.application_data.accounts[local.environment].db_username
		70 |   password                    = random_password.password.result
		71 |   skip_final_snapshot         = true
		72 |   publicly_accessible         = true
		73 |   vpc_security_group_ids      = [aws_security_group.postgresql_db_sc_dev[0].id]
		74 |   db_subnet_group_name        = aws_db_subnet_group.dbsubnetgroup.name
		75 |   allow_major_version_upgrade = true
		76 | }

Check: CKV_AWS_353: "Ensure that RDS instances have performance insights enabled"
	FAILED for resource: aws_db_instance.dacp_db_dev
	File: /rds.tf:60-76
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-353

		60 | resource "aws_db_instance" "dacp_db_dev" {
		61 |   count                       = local.is-development ? 1 : 0
		62 |   allocated_storage           = local.application_data.accounts[local.environment].allocated_storage
		63 |   db_name                     = local.application_data.accounts[local.environment].db_name
		64 |   storage_type                = local.application_data.accounts[local.environment].storage_type
		65 |   engine                      = local.application_data.accounts[local.environment].engine
		66 |   identifier                  = local.application_data.accounts[local.environment].identifier
		67 |   engine_version              = local.application_data.accounts[local.environment].engine_version
		68 |   instance_class              = local.application_data.accounts[local.environment].instance_class
		69 |   username                    = local.application_data.accounts[local.environment].db_username
		70 |   password                    = random_password.password.result
		71 |   skip_final_snapshot         = true
		72 |   publicly_accessible         = true
		73 |   vpc_security_group_ids      = [aws_security_group.postgresql_db_sc_dev[0].id]
		74 |   db_subnet_group_name        = aws_db_subnet_group.dbsubnetgroup.name
		75 |   allow_major_version_upgrade = true
		76 | }

Check: CKV_AWS_293: "Ensure that AWS database instances have deletion protection enabled"
	FAILED for resource: aws_db_instance.dacp_db_dev
	File: /rds.tf:60-76
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-293

		60 | resource "aws_db_instance" "dacp_db_dev" {
		61 |   count                       = local.is-development ? 1 : 0
		62 |   allocated_storage           = local.application_data.accounts[local.environment].allocated_storage
		63 |   db_name                     = local.application_data.accounts[local.environment].db_name
		64 |   storage_type                = local.application_data.accounts[local.environment].storage_type
		65 |   engine                      = local.application_data.accounts[local.environment].engine
		66 |   identifier                  = local.application_data.accounts[local.environment].identifier
		67 |   engine_version              = local.application_data.accounts[local.environment].engine_version
		68 |   instance_class              = local.application_data.accounts[local.environment].instance_class
		69 |   username                    = local.application_data.accounts[local.environment].db_username
		70 |   password                    = random_password.password.result
		71 |   skip_final_snapshot         = true
		72 |   publicly_accessible         = true
		73 |   vpc_security_group_ids      = [aws_security_group.postgresql_db_sc_dev[0].id]
		74 |   db_subnet_group_name        = aws_db_subnet_group.dbsubnetgroup.name
		75 |   allow_major_version_upgrade = true
		76 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.rds_logs
	File: /rds.tf:142-145
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		142 | resource "aws_cloudwatch_log_group" "rds_logs" {
		143 |   name              = "/aws/events/rdsLogs"
		144 |   retention_in_days = "7"
		145 | }

Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.rds_db_credentials
	File: /secrets.tf:11-14
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		11 | resource "aws_secretsmanager_secret" "rds_db_credentials" {
		12 |   name                    = "rds-password"
		13 |   recovery_window_in_days = 0
		14 | }

Check: CKV_AWS_192: "Ensure WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell"
	FAILED for resource: aws_wafv2_web_acl.dacp_web_acl
	File: /waf.tf:1-42
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-waf-prevents-message-lookup-in-log4j2

		1  | resource "aws_wafv2_web_acl" "dacp_web_acl" {
		2  |   name  = "dacp-web-acl"
		3  |   scope = "REGIONAL"
		4  | 
		5  |   default_action {
		6  |     allow {}
		7  |   }
		8  | 
		9  |   rule {
		10 |     name     = "common-rule-set"
		11 |     priority = 1
		12 | 
		13 |     override_action {
		14 |       none {}
		15 |     }
		16 | 
		17 |     statement {
		18 |       managed_rule_group_statement {
		19 |         name        = "AWSManagedRulesCommonRuleSet"
		20 |         vendor_name = "AWS"
		21 |         rule_action_override {
		22 |           action_to_use {
		23 |             allow {}
		24 |           }
		25 |           name = "SizeRestrictions_Cookie_HEADER"
		26 |         }
		27 |       }
		28 |     }
		29 | 
		30 |     visibility_config {
		31 |       cloudwatch_metrics_enabled = true
		32 |       metric_name                = "AWSManagedRulesCommonRuleSetMetrics"
		33 |       sampled_requests_enabled   = true
		34 |     }
		35 |   }
		36 | 
		37 |   visibility_config {
		38 |     cloudwatch_metrics_enabled = true
		39 |     metric_name                = "dacp-web-acl"
		40 |     sampled_requests_enabled   = true
		41 |   }
		42 | }

Check: CKV2_AWS_31: "Ensure WAF2 has a Logging Configuration"
	FAILED for resource: aws_wafv2_web_acl.dacp_web_acl
	File: /waf.tf:1-42
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-logging-33

		1  | resource "aws_wafv2_web_acl" "dacp_web_acl" {
		2  |   name  = "dacp-web-acl"
		3  |   scope = "REGIONAL"
		4  | 
		5  |   default_action {
		6  |     allow {}
		7  |   }
		8  | 
		9  |   rule {
		10 |     name     = "common-rule-set"
		11 |     priority = 1
		12 | 
		13 |     override_action {
		14 |       none {}
		15 |     }
		16 | 
		17 |     statement {
		18 |       managed_rule_group_statement {
		19 |         name        = "AWSManagedRulesCommonRuleSet"
		20 |         vendor_name = "AWS"
		21 |         rule_action_override {
		22 |           action_to_use {
		23 |             allow {}
		24 |           }
		25 |           name = "SizeRestrictions_Cookie_HEADER"
		26 |         }
		27 |       }
		28 |     }
		29 | 
		30 |     visibility_config {
		31 |       cloudwatch_metrics_enabled = true
		32 |       metric_name                = "AWSManagedRulesCommonRuleSetMetrics"
		33 |       sampled_requests_enabled   = true
		34 |     }
		35 |   }
		36 | 
		37 |   visibility_config {
		38 |     cloudwatch_metrics_enabled = true
		39 |     metric_name                = "dacp-web-acl"
		40 |     sampled_requests_enabled   = true
		41 |   }
		42 | }

Check: CKV2_AWS_60: "Ensure RDS instance with copy tags to snapshots is enabled"
	FAILED for resource: aws_db_instance.dacp_db
	File: /rds.tf:1-19
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-60

		1  | resource "aws_db_instance" "dacp_db" {
		2  |   count                       = local.is-development ? 0 : 1
		3  |   allocated_storage           = local.application_data.accounts[local.environment].allocated_storage
		4  |   db_name                     = local.application_data.accounts[local.environment].db_name
		5  |   storage_type                = local.application_data.accounts[local.environment].storage_type
		6  |   engine                      = local.application_data.accounts[local.environment].engine
		7  |   identifier                  = local.application_data.accounts[local.environment].identifier
		8  |   engine_version              = local.application_data.accounts[local.environment].engine_version
		9  |   instance_class              = local.application_data.accounts[local.environment].instance_class
		10 |   username                    = local.application_data.accounts[local.environment].db_username
		11 |   password                    = random_password.password.result
		12 |   skip_final_snapshot         = true
		13 |   publicly_accessible         = false
		14 |   vpc_security_group_ids      = [aws_security_group.postgresql_db_sc[0].id]
		15 |   db_subnet_group_name        = aws_db_subnet_group.dbsubnetgroup.name
		16 |   allow_major_version_upgrade = true
		17 |   ca_cert_identifier          = "rds-ca-rsa2048-g1"
		18 |   apply_immediately           = true
		19 | }

Check: CKV2_AWS_60: "Ensure RDS instance with copy tags to snapshots is enabled"
	FAILED for resource: aws_db_instance.dacp_db_dev
	File: /rds.tf:60-76
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-60

		60 | resource "aws_db_instance" "dacp_db_dev" {
		61 |   count                       = local.is-development ? 1 : 0
		62 |   allocated_storage           = local.application_data.accounts[local.environment].allocated_storage
		63 |   db_name                     = local.application_data.accounts[local.environment].db_name
		64 |   storage_type                = local.application_data.accounts[local.environment].storage_type
		65 |   engine                      = local.application_data.accounts[local.environment].engine
		66 |   identifier                  = local.application_data.accounts[local.environment].identifier
		67 |   engine_version              = local.application_data.accounts[local.environment].engine_version
		68 |   instance_class              = local.application_data.accounts[local.environment].instance_class
		69 |   username                    = local.application_data.accounts[local.environment].db_username
		70 |   password                    = random_password.password.result
		71 |   skip_final_snapshot         = true
		72 |   publicly_accessible         = true
		73 |   vpc_security_group_ids      = [aws_security_group.postgresql_db_sc_dev[0].id]
		74 |   db_subnet_group_name        = aws_db_subnet_group.dbsubnetgroup.name
		75 |   allow_major_version_upgrade = true
		76 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.rds_db_credentials
	File: /secrets.tf:11-14
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		11 | resource "aws_secretsmanager_secret" "rds_db_credentials" {
		12 |   name                    = "rds-password"
		13 |   recovery_window_in_days = 0
		14 | }

Check: CKV_AWS_103: "Ensure that load balancer is using at least TLS 1.2"
	FAILED for resource: aws_lb_listener.dacp_lb
	File: /load_balancer.tf:267-281
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-general-43

		267 | resource "aws_lb_listener" "dacp_lb" {
		268 |   depends_on = [
		269 |     aws_acm_certificate.external
		270 |   ]
		271 |   certificate_arn   = local.is-production ? aws_acm_certificate.external.arn : aws_acm_certificate.external.arn
		272 |   load_balancer_arn = aws_lb.dacp_lb.arn
		273 |   port              = local.application_data.accounts[local.environment].server_port_2
		274 |   protocol          = local.application_data.accounts[local.environment].lb_listener_protocol_2
		275 |   ssl_policy        = local.application_data.accounts[local.environment].lb_listener_protocol_2 == "HTTP" ? "" : "ELBSecurityPolicy-TLS13-1-2-2021-06"
		276 | 
		277 |   default_action {
		278 |     type             = "forward"
		279 |     target_group_arn = aws_lb_target_group.dacp_target_group.arn
		280 |   }
		281 | }

Check: CKV2_AWS_40: "Ensure AWS IAM policy does not allow full IAM privileges"
	FAILED for resource: aws_iam_role_policy.app_task
	File: /ecs.tf:304-325
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-2-40

		304 | resource "aws_iam_role_policy" "app_task" {
		305 |   name = "task-${var.networking[0].application}"
		306 |   role = aws_iam_role.app_task.id
		307 | 
		308 |   policy = <<-EOF
		309 |   {
		310 |    "Version": "2012-10-17",
		311 |    "Statement": [
		312 |      {
		313 |        "Effect": "Allow",
		314 |         "Action": [
		315 |           "logs:*",
		316 |           "ecr:*",
		317 |           "iam:*",
		318 |           "ec2:*"
		319 |         ],
		320 |        "Resource": "*"
		321 |      }
		322 |    ]
		323 |   }
		324 |   EOF
		325 | }


checkov_exitcode=1

CTFLint Scan Failed

Show Output 
*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
terraform/environments/dacp

*****************************

Running tflint in terraform/environments/dacp
Excluding the following checks: terraform_unused_declarations
20 issue(s) found:

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/dacp/ecs.tf line 54:
  54:           value = "${aws_db_instance.dacp_db[0].address}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/dacp/ecs.tf line 58:
  58:           value = "${local.application_data.accounts[local.environment].rds_port}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/dacp/ecs.tf line 62:
  62:           value = "${aws_db_instance.dacp_db[0].username}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/dacp/ecs.tf line 66:
  66:           value = "${aws_db_instance.dacp_db[0].password}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/dacp/ecs.tf line 70:
  70:           value = "${aws_db_instance.dacp_db[0].db_name}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/dacp/ecs.tf line 74:
  74:           value = "${local.application_data.accounts[local.environment].support_email}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/dacp/ecs.tf line 78:
  78:           value = "${local.application_data.accounts[local.environment].support_team}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/dacp/ecs.tf line 82:
  82:           value = "${local.application_data.accounts[local.environment].client_id}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/dacp/ecs.tf line 129:
 129:           value = "${aws_db_instance.dacp_db_dev[0].address}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/dacp/ecs.tf line 133:
 133:           value = "${local.application_data.accounts[local.environment].rds_port}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/dacp/ecs.tf line 137:
 137:           value = "${aws_db_instance.dacp_db_dev[0].username}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/dacp/ecs.tf line 141:
 141:           value = "${aws_db_instance.dacp_db_dev[0].password}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/dacp/ecs.tf line 145:
 145:           value = "${aws_db_instance.dacp_db_dev[0].db_name}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/dacp/ecs.tf line 149:
 149:           value = "${local.application_data.accounts[local.environment].support_email}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/dacp/ecs.tf line 153:
 153:           value = "${local.application_data.accounts[local.environment].support_team}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/dacp/ecs.tf line 157:
 157:           value = "${local.application_data.accounts[local.environment].client_id}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: Missing version constraint for provider "null" in `required_providers` (terraform_required_providers)

  on terraform/environments/dacp/rds.tf line 121:
 121: resource "null_resource" "setup_db" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/dacp/rds.tf line 138:
 138:     always_run = "${timestamp()}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: Missing version constraint for provider "random" in `required_providers` (terraform_required_providers)

  on terraform/environments/dacp/secrets.tf line 2:
   2: resource "random_password" "password" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/dacp/secrets.tf line 18:
  18:   secret_string = jsonencode({ "DACP_DB_PASSWORD" : "${random_password.password.result}" })

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

tflint_exitcode=2

Trivy Scan Failed

Show Output 
*****************************

Trivy will check the following folders:
terraform/environments/dacp

*****************************

Running Trivy in terraform/environments/dacp
2024-10-14T00:22:14Z	INFO	[vulndb] Need to update DB
2024-10-14T00:22:14Z	INFO	[vulndb] Downloading vulnerability DB...
2024-10-14T00:22:14Z	INFO	[vulndb] Downloading artifact...	repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-14T00:22:16Z	INFO	[vulndb] Artifact successfully downloaded	repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-14T00:22:16Z	INFO	[vuln] Vulnerability scanning is enabled
2024-10-14T00:22:16Z	INFO	[misconfig] Misconfiguration scanning is enabled
2024-10-14T00:22:16Z	INFO	[misconfig] Need to update the built-in checks
2024-10-14T00:22:16Z	INFO	[misconfig] Downloading the built-in checks...
156.02 KiB / 156.02 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2024-10-14T00:22:16Z	INFO	[secret] Secret scanning is enabled
2024-10-14T00:22:16Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-14T00:22:16Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-10-14T00:22:18Z	INFO	[terraform scanner] Scanning root module	file_path="."
2024-10-14T00:22:18Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="networking"
2024-10-14T00:22:18Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_route53_record.cert_validation" value="cty.NilVal"
2024-10-14T00:22:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.bastion_linux.aws_s3_object.user_public_keys" value="cty.NilVal"
2024-10-14T00:22:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.bastion_linux.data.aws_subnet.local_account" value="cty.NilVal"
2024-10-14T00:22:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.bastion_linux.dynamic.tag" value="cty.NilVal"
2024-10-14T00:22:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.bastion_linux.dynamic.tag" value="cty.NilVal"
2024-10-14T00:22:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.bastion_linux.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T00:22:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.bastion_linux.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T00:22:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.bastion_linux.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T00:22:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.bastion_linux.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T00:22:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.bastion_linux.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T00:22:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.bastion_linux.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T00:22:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.bastion_linux.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T00:22:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.bastion_linux.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T00:22:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.bastion_linux.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T00:22:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.bastion_linux.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T00:22:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.bastion_linux.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T00:22:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.bastion_linux.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T00:22:20Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.3.0/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=7b2b75c178f855d8c48d3bda4ac53df782288c02/main.tf:141-151"
2024-10-14T00:22:20Z	INFO	Number of language-specific files	num=0
2024-10-14T00:22:20Z	INFO	Detected config files	num=6

ecs.tf (terraform)
==================
Tests: 5 (SUCCESSES: 0, FAILURES: 3, EXCEPTIONS: 2)
Failures: 3 (HIGH: 3, CRITICAL: 0)

HIGH: Image scanning is not enabled
════════════════════════════════════════
Repository image scans should be enabled to ensure vulnerable software can be discovered and remediated as soon as possible.


See https://avd.aquasec.com/misconfig/avd-aws-0030
────────────────────────────────────────
 ecs.tf:347-350
────────────────────────────────────────
 347 ┌ resource "aws_ecr_repository" "dacp_ecr_repo" {
 348 │   name         = "dacp-ecr-repo"
 349 │   force_delete = true
 350 └ }
────────────────────────────────────────


HIGH: Topic does not have encryption enabled.
════════════════════════════════════════
Topics should be encrypted to protect their contents.


See https://avd.aquasec.com/misconfig/avd-aws-0095
────────────────────────────────────────
 ecs.tf:451-454
────────────────────────────────────────
 451 ┌ resource "aws_sns_topic" "dacp_utilisation_alarm" {
 452 │   count = local.is-development ? 0 : 1
 453 │   name  = "dacp_utilisation_alarm"
 454 └ }
────────────────────────────────────────


HIGH: Topic does not have encryption enabled.
════════════════════════════════════════
Topics should be encrypted to protect their contents.


See https://avd.aquasec.com/misconfig/avd-aws-0095
────────────────────────────────────────
 ecs.tf:446-449
────────────────────────────────────────
 446 ┌ resource "aws_sns_topic" "ddos_alarm" {
 447 │   count = local.is-development ? 0 : 1
 448 │   name  = "dacp_ddos_alarm"
 449 └ }
────────────────────────────────────────



load_balancer.tf (terraform)
============================
Tests: 4 (SUCCESSES: 0, FAILURES: 2, EXCEPTIONS: 2)
Failures: 2 (HIGH: 2, CRITICAL: 0)

HIGH: Application load balancer is not set to drop invalid headers.
════════════════════════════════════════
Passing unknown or invalid headers through to the target poses a potential risk of compromise.
By setting drop_invalid_header_fields to true, anything that does not conform to well known, defined headers will be removed by the load balancer.


See https://avd.aquasec.com/misconfig/avd-aws-0052
────────────────────────────────────────
 load_balancer.tf:233-241
────────────────────────────────────────
 233 ┌ resource "aws_lb" "dacp_lb" {
 234 │   name                       = "dacp-load-balancer"
 235 │   load_balancer_type         = "application"
 236 │   security_groups            = [aws_security_group.dacp_lb_sc.id, aws_security_group.lb_sc_pingdom.id, aws_security_group.lb_sc_pingdom_2.id]
 237 │   subnets                    = data.aws_subnets.shared-public.ids
 238 │   enable_deletion_protection = false
 239 │   internal                   = false
 240 │   depends_on                 = [aws_security_group.dacp_lb_sc, aws_security_group.lb_sc_pingdom, aws_security_group.lb_sc_pingdom_2]
 241 └ }
────────────────────────────────────────


HIGH: Load balancer is exposed publicly.
════════════════════════════════════════
There are many scenarios in which you would want to expose a load balancer to the wider internet, but this check exists as a warning to prevent accidental exposure of internal assets. You should ensure that this resource should be exposed publicly.


See https://avd.aquasec.com/misconfig/avd-aws-0053
────────────────────────────────────────
 load_balancer.tf:239
   via load_balancer.tf:233-241 (aws_lb.dacp_lb)
────────────────────────────────────────
 233   resource "aws_lb" "dacp_lb" {
 234     name                       = "dacp-load-balancer"
 235     load_balancer_type         = "application"
 236     security_groups            = [aws_security_group.dacp_lb_sc.id, aws_security_group.lb_sc_pingdom.id, aws_security_group.lb_sc_pingdom_2.id]
 237     subnets                    = data.aws_subnets.shared-public.ids
 238     enable_deletion_protection = false
 239 [   internal                   = false
 240     depends_on                 = [aws_security_group.dacp_lb_sc, aws_security_group.lb_sc_pingdom, aws_security_group.lb_sc_pingdom_2]
 241   }
────────────────────────────────────────



rds.tf (terraform)
==================
Tests: 2 (SUCCESSES: 0, FAILURES: 1, EXCEPTIONS: 1)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Instance does not have storage encryption enabled.
════════════════════════════════════════
Encryption should be enabled for an RDS Database instances.
When enabling encryption by setting the kms_key_id.


See https://avd.aquasec.com/misconfig/avd-aws-0080
────────────────────────────────────────
 rds.tf:1-19
────────────────────────────────────────
   1 ┌ resource "aws_db_instance" "dacp_db" {
   2 │   count                       = local.is-development ? 0 : 1
   3 │   allocated_storage           = local.application_data.accounts[local.environment].allocated_storage
   4 │   db_name                     = local.application_data.accounts[local.environment].db_name
   5 │   storage_type                = local.application_data.accounts[local.environment].storage_type
   6 │   engine                      = local.application_data.accounts[local.environment].engine
   7 │   identifier                  = local.application_data.accounts[local.environment].identifier
   8 │   engine_version              = local.application_data.accounts[local.environment].engine_version
   9 └   instance_class              = local.application_data.accounts[local.environment].instance_class
  ..   
────────────────────────────────────────


trivy_exitcode=1

@dependabot Dependabot
Copy link
Contributor Author

dependabot bot commented on behalf of github Oct 15, 2024

Superseded by #8251.

@dependabot dependabot bot closed this Oct 15, 2024
@dependabot dependabot bot deleted the dependabot/terraform/terraform/environments/dacp/bastion_linux--github--ministryofjustice/modernisation-platform-terraform-bastion-linux--v4.2.1-4.3.0 branch October 15, 2024 01:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file environments-repository Used to exclude PRs from this repo in our Slack PR update terraform Pull requests that update Terraform code
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants