</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/performance-hub

*****************************

Running Checkov in terraform/environments/performance-hub
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2024-10-23 00:07:36,134 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-pagerduty-integration?ref=v2.0.0:None (for external modules, the --download-external-modules flag is required)
2024-10-23 00:07:36,134 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.4.1:None (for external modules, the --download-external-modules flag is required)
2024-10-23 00:07:36,134 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.1.0:None (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 252, Failed checks: 42, Skipped checks: 32

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: bastion_linux
	File: /bastion_linux.tf:6-35
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		6  | module "bastion_linux" {
		7  |   source = "github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.4.1"
		8  | 
		9  |   providers = {
		10 |     aws.share-host   = aws.core-vpc # core-vpc-(environment) holds the networking for all accounts
		11 |     aws.share-tenant = aws          # The default provider (unaliased, `aws`) is the tenant
		12 |   }
		13 | 
		14 |   # s3 - used for logs and user ssh public keys
		15 |   bucket_name = "bastion"
		16 |   # public keys
		17 |   public_key_data = local.public_key_data.keys[local.environment]
		18 |   # logs
		19 |   log_auto_clean       = "Enabled"
		20 |   log_standard_ia_days = 30  # days before moving to IA storage
		21 |   log_glacier_days     = 60  # days before moving to Glacier
		22 |   log_expiry_days      = 180 # days before log expiration
		23 |   # bastion
		24 |   allow_ssh_commands = false
		25 | 
		26 |   app_name      = var.networking[0].application
		27 |   business_unit = local.vpc_name
		28 |   subnet_set    = local.subnet_set
		29 |   environment   = local.environment
		30 |   region        = "eu-west-2"
		31 | 
		32 |   # Tags
		33 |   tags_common = local.tags
		34 |   tags_prefix = terraform.workspace
		35 | }

Check: CKV_AWS_354: "Ensure RDS Performance Insights are encrypted using KMS CMKs"
	FAILED for resource: aws_db_instance.database
	File: /database.tf:5-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-354

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_353: "Ensure that RDS instances have performance insights enabled"
	FAILED for resource: aws_db_instance.database
	File: /database.tf:5-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-353

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_226: "Ensure DB instance gets all minor upgrades automatically"
	FAILED for resource: aws_db_instance.database
	File: /database.tf:5-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-db-instance-gets-all-minor-upgrades-automatically

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_293: "Ensure that AWS database instances have deletion protection enabled"
	FAILED for resource: aws_db_instance.database
	File: /database.tf:5-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-293

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_300: "Ensure S3 lifecycle configuration sets period for aborting failed uploads"
	FAILED for resource: aws_s3_bucket_lifecycle_configuration.database_backup_files
	File: /database.tf:194-209
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-300

		194 | resource "aws_s3_bucket_lifecycle_configuration" "database_backup_files" {
		195 |   bucket = aws_s3_bucket.database_backup_files.id
		196 |   rule {
		197 |     id     = "tf-s3-lifecycle"
		198 |     status = "Enabled"
		199 |     noncurrent_version_transition {
		200 |       noncurrent_days = 30
		201 |       storage_class   = "STANDARD_IA"
		202 |     }
		203 | 
		204 |     transition {
		205 |       days          = 60
		206 |       storage_class = "STANDARD_IA"
		207 |     }
		208 |   }
		209 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.rds-kms
	File: /database.tf:311-324
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		311 | data "aws_iam_policy_document" "rds-kms" {
		312 |   #checkov:skip=CKV_AWS_111
		313 |   #checkov:skip=CKV_AWS_109
		314 |   statement {
		315 |     effect    = "Allow"
		316 |     actions   = ["kms:*"]
		317 |     resources = ["*"]
		318 | 
		319 |     principals {
		320 |       type        = "AWS"
		321 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		322 |     }
		323 |   }
		324 | }

Check: CKV_AWS_289: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: aws_iam_policy.db_mgmt_policy
	File: /db_manager.tf:95-125
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-289

		95  | resource "aws_iam_policy" "db_mgmt_policy" {
		96  |   name        = "${local.application_name}-db_mgmt-ec2-policy"
		97  |   description = "${local.application_name} ec2-policy"
		98  | 
		99  |   policy = <<EOF
		100 | {
		101 |     "Version": "2012-10-17",
		102 |     "Statement": [
		103 |       {
		104 |         "Effect": "Allow",
		105 |         "Action": "s3:*",
		106 |         "Resource": "*"
		107 |       },
		108 |       {
		109 |         "Effect": "Allow",
		110 |         "Action": [
		111 |           "s3:GetEncryptionConfiguration"
		112 |         ],
		113 |         "Resource": "*"
		114 |       },
		115 |       {
		116 |         "Effect": "Allow",
		117 |         "Action": [
		118 |           "kms:Decrypt"
		119 |         ],
		120 |         "Resource": "arn:aws:kms:eu-west-2:${local.environment_management.account_ids["performance-hub-preproduction"]}:key/c1b9e987-29e2-458f-b5bd-2e9c2b57f049"
		121 |       }
		122 |     ]
		123 | }
		124 | EOF
		125 | }

Check: CKV_AWS_355: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy.db_mgmt_policy
	File: /db_manager.tf:95-125
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-355

		95  | resource "aws_iam_policy" "db_mgmt_policy" {
		96  |   name        = "${local.application_name}-db_mgmt-ec2-policy"
		97  |   description = "${local.application_name} ec2-policy"
		98  | 
		99  |   policy = <<EOF
		100 | {
		101 |     "Version": "2012-10-17",
		102 |     "Statement": [
		103 |       {
		104 |         "Effect": "Allow",
		105 |         "Action": "s3:*",
		106 |         "Resource": "*"
		107 |       },
		108 |       {
		109 |         "Effect": "Allow",
		110 |         "Action": [
		111 |           "s3:GetEncryptionConfiguration"
		112 |         ],
		113 |         "Resource": "*"
		114 |       },
		115 |       {
		116 |         "Effect": "Allow",
		117 |         "Action": [
		118 |           "kms:Decrypt"
		119 |         ],
		120 |         "Resource": "arn:aws:kms:eu-west-2:${local.environment_management.account_ids["performance-hub-preproduction"]}:key/c1b9e987-29e2-458f-b5bd-2e9c2b57f049"
		121 |       }
		122 |     ]
		123 | }
		124 | EOF
		125 | }

Check: CKV_AWS_290: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy.db_mgmt_policy
	File: /db_manager.tf:95-125
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-290

		95  | resource "aws_iam_policy" "db_mgmt_policy" {
		96  |   name        = "${local.application_name}-db_mgmt-ec2-policy"
		97  |   description = "${local.application_name} ec2-policy"
		98  | 
		99  |   policy = <<EOF
		100 | {
		101 |     "Version": "2012-10-17",
		102 |     "Statement": [
		103 |       {
		104 |         "Effect": "Allow",
		105 |         "Action": "s3:*",
		106 |         "Resource": "*"
		107 |       },
		108 |       {
		109 |         "Effect": "Allow",
		110 |         "Action": [
		111 |           "s3:GetEncryptionConfiguration"
		112 |         ],
		113 |         "Resource": "*"
		114 |       },
		115 |       {
		116 |         "Effect": "Allow",
		117 |         "Action": [
		118 |           "kms:Decrypt"
		119 |         ],
		120 |         "Resource": "arn:aws:kms:eu-west-2:${local.environment_management.account_ids["performance-hub-preproduction"]}:key/c1b9e987-29e2-458f-b5bd-2e9c2b57f049"
		121 |       }
		122 |     ]
		123 | }
		124 | EOF
		125 | }

Check: CKV_AWS_288: "Ensure IAM policies does not allow data exfiltration"
	FAILED for resource: aws_iam_policy.db_mgmt_policy
	File: /db_manager.tf:95-125
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-288

		95  | resource "aws_iam_policy" "db_mgmt_policy" {
		96  |   name        = "${local.application_name}-db_mgmt-ec2-policy"
		97  |   description = "${local.application_name} ec2-policy"
		98  | 
		99  |   policy = <<EOF
		100 | {
		101 |     "Version": "2012-10-17",
		102 |     "Statement": [
		103 |       {
		104 |         "Effect": "Allow",
		105 |         "Action": "s3:*",
		106 |         "Resource": "*"
		107 |       },
		108 |       {
		109 |         "Effect": "Allow",
		110 |         "Action": [
		111 |           "s3:GetEncryptionConfiguration"
		112 |         ],
		113 |         "Resource": "*"
		114 |       },
		115 |       {
		116 |         "Effect": "Allow",
		117 |         "Action": [
		118 |           "kms:Decrypt"
		119 |         ],
		120 |         "Resource": "arn:aws:kms:eu-west-2:${local.environment_management.account_ids["performance-hub-preproduction"]}:key/c1b9e987-29e2-458f-b5bd-2e9c2b57f049"
		121 |       }
		122 |     ]
		123 | }
		124 | EOF
		125 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.ebs-kms
	File: /db_manager.tf:182-205
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		182 | data "aws_iam_policy_document" "ebs-kms" {
		183 |   #checkov:skip=CKV_AWS_111
		184 |   #checkov:skip=CKV_AWS_109
		185 |   statement {
		186 |     effect    = "Allow"
		187 |     actions   = ["kms:*"]
		188 |     resources = ["*"]
		189 | 
		190 |     principals {
		191 |       type        = "Service"
		192 |       identifiers = ["ec2.amazonaws.com"]
		193 |     }
		194 |   }
		195 |   statement {
		196 |     effect    = "Allow"
		197 |     actions   = ["kms:*"]
		198 |     resources = ["*"]
		199 | 
		200 |     principals {
		201 |       type        = "AWS"
		202 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		203 |     }
		204 |   }
		205 | }

Check: CKV_AWS_378: "Ensure AWS Load Balancer doesn't use HTTP protocol"
	FAILED for resource: aws_lb_target_group.target_group
	File: /loadbalancer.tf:27-55

		27 | resource "aws_lb_target_group" "target_group" {
		28 |   name                 = "${local.application_name}-tg-${local.environment}"
		29 |   port                 = local.app_data.accounts[local.environment].server_port
		30 |   protocol             = "HTTP"
		31 |   vpc_id               = data.aws_vpc.shared.id
		32 |   target_type          = "instance"
		33 |   deregistration_delay = 30
		34 | 
		35 |   stickiness {
		36 |     type = "lb_cookie"
		37 |   }
		38 | 
		39 |   health_check {
		40 |     # path                = "/"
		41 |     healthy_threshold   = "5"
		42 |     interval            = "120"
		43 |     protocol            = "HTTP"
		44 |     unhealthy_threshold = "2"
		45 |     matcher             = "200-499"
		46 |     timeout             = "5"
		47 |   }
		48 | 
		49 |   tags = merge(
		50 |     local.tags,
		51 |     {
		52 |       Name = "${local.application_name}-tg-${local.environment}"
		53 |     }
		54 |   )
		55 | }

Check: CKV_AWS_261: "Ensure HTTP HTTPS Target group defines Healthcheck"
	FAILED for resource: aws_lb_target_group.target_group
	File: /loadbalancer.tf:27-55
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-kendra-index-server-side-encryption-uses-customer-managed-keys-cmks

		27 | resource "aws_lb_target_group" "target_group" {
		28 |   name                 = "${local.application_name}-tg-${local.environment}"
		29 |   port                 = local.app_data.accounts[local.environment].server_port
		30 |   protocol             = "HTTP"
		31 |   vpc_id               = data.aws_vpc.shared.id
		32 |   target_type          = "instance"
		33 |   deregistration_delay = 30
		34 | 
		35 |   stickiness {
		36 |     type = "lb_cookie"
		37 |   }
		38 | 
		39 |   health_check {
		40 |     # path                = "/"
		41 |     healthy_threshold   = "5"
		42 |     interval            = "120"
		43 |     protocol            = "HTTP"
		44 |     unhealthy_threshold = "2"
		45 |     matcher             = "200-499"
		46 |     timeout             = "5"
		47 |   }
		48 | 
		49 |   tags = merge(
		50 |     local.tags,
		51 |     {
		52 |       Name = "${local.application_name}-tg-${local.environment}"
		53 |     }
		54 |   )
		55 | }

Check: CKV_AWS_289: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: module.windows-new-ecs.aws_iam_policy.ec2_instance_policy
	File: /module/ecs/main.tf:190-229
	Calling File: /ecs.tf:5-33
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-289

		190 | resource "aws_iam_policy" "ec2_instance_policy" { #tfsec:ignore:aws-iam-no-policy-wildcards
		191 |   name = "${var.app_name}-ec2-instance-policy"
		192 | 
		193 |   policy = <<EOF
		194 | {
		195 |     "Version": "2012-10-17",
		196 |     "Statement": [
		197 |         {
		198 |             "Effect": "Allow",
		199 |             "Action": [
		200 |                 "ec2:DescribeTags",
		201 |                 "ecs:CreateCluster",
		202 |                 "ecs:DeregisterContainerInstance",
		203 |                 "ecs:DiscoverPollEndpoint",
		204 |                 "ecs:Poll",
		205 |                 "ecs:RegisterContainerInstance",
		206 |                 "ecs:StartTelemetrySession",
		207 |                 "ecs:UpdateContainerInstancesState",
		208 |                 "ecs:Submit*",
		209 |                 "ecr:GetAuthorizationToken",
		210 |                 "ecr:BatchCheckLayerAvailability",
		211 |                 "ecr:GetDownloadUrlForLayer",
		212 |                 "ecr:BatchGetImage",
		213 |                 "logs:CreateLogStream",
		214 |                 "logs:PutLogEvents",
		215 |                 "s3:ListBucket",
		216 |                 "s3:*Object*",
		217 |                 "kms:Decrypt",
		218 |                 "kms:Encrypt",
		219 |                 "kms:GenerateDataKey",
		220 |                 "kms:ReEncrypt",
		221 |                 "kms:GenerateDataKey",
		222 |                 "kms:DescribeKey"
		223 |             ],
		224 |             "Resource": "*"
		225 |         }
		226 |     ]
		227 | }
		228 | EOF
		229 | }

Check: CKV_AWS_355: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.windows-new-ecs.aws_iam_policy.ec2_instance_policy
	File: /module/ecs/main.tf:190-229
	Calling File: /ecs.tf:5-33
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-355

		190 | resource "aws_iam_policy" "ec2_instance_policy" { #tfsec:ignore:aws-iam-no-policy-wildcards
		191 |   name = "${var.app_name}-ec2-instance-policy"
		192 | 
		193 |   policy = <<EOF
		194 | {
		195 |     "Version": "2012-10-17",
		196 |     "Statement": [
		197 |         {
		198 |             "Effect": "Allow",
		199 |             "Action": [
		200 |                 "ec2:DescribeTags",
		201 |                 "ecs:CreateCluster",
		202 |                 "ecs:DeregisterContainerInstance",
		203 |                 "ecs:DiscoverPollEndpoint",
		204 |                 "ecs:Poll",
		205 |                 "ecs:RegisterContainerInstance",
		206 |                 "ecs:StartTelemetrySession",
		207 |                 "ecs:UpdateContainerInstancesState",
		208 |                 "ecs:Submit*",
		209 |                 "ecr:GetAuthorizationToken",
		210 |                 "ecr:BatchCheckLayerAvailability",
		211 |                 "ecr:GetDownloadUrlForLayer",
		212 |                 "ecr:BatchGetImage",
		213 |                 "logs:CreateLogStream",
		214 |                 "logs:PutLogEvents",
		215 |                 "s3:ListBucket",
		216 |                 "s3:*Object*",
		217 |                 "kms:Decrypt",
		218 |                 "kms:Encrypt",
		219 |                 "kms:GenerateDataKey",
		220 |                 "kms:ReEncrypt",
		221 |                 "kms:GenerateDataKey",
		222 |                 "kms:DescribeKey"
		223 |             ],
		224 |             "Resource": "*"
		225 |         }
		226 |     ]
		227 | }
		228 | EOF
		229 | }

Check: CKV_AWS_290: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.windows-new-ecs.aws_iam_policy.ec2_instance_policy
	File: /module/ecs/main.tf:190-229
	Calling File: /ecs.tf:5-33
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-290

		190 | resource "aws_iam_policy" "ec2_instance_policy" { #tfsec:ignore:aws-iam-no-policy-wildcards
		191 |   name = "${var.app_name}-ec2-instance-policy"
		192 | 
		193 |   policy = <<EOF
		194 | {
		195 |     "Version": "2012-10-17",
		196 |     "Statement": [
		197 |         {
		198 |             "Effect": "Allow",
		199 |             "Action": [
		200 |                 "ec2:DescribeTags",
		201 |                 "ecs:CreateCluster",
		202 |                 "ecs:DeregisterContainerInstance",
		203 |                 "ecs:DiscoverPollEndpoint",
		204 |                 "ecs:Poll",
		205 |                 "ecs:RegisterContainerInstance",
		206 |                 "ecs:StartTelemetrySession",
		207 |                 "ecs:UpdateContainerInstancesState",
		208 |                 "ecs:Submit*",
		209 |                 "ecr:GetAuthorizationToken",
		210 |                 "ecr:BatchCheckLayerAvailability",
		211 |                 "ecr:GetDownloadUrlForLayer",
		212 |                 "ecr:BatchGetImage",
		213 |                 "logs:CreateLogStream",
		214 |                 "logs:PutLogEvents",
		215 |                 "s3:ListBucket",
		216 |                 "s3:*Object*",
		217 |                 "kms:Decrypt",
		218 |                 "kms:Encrypt",
		219 |                 "kms:GenerateDataKey",
		220 |                 "kms:ReEncrypt",
		221 |                 "kms:GenerateDataKey",
		222 |                 "kms:DescribeKey"
		223 |             ],
		224 |             "Resource": "*"
		225 |         }
		226 |     ]
		227 | }
		228 | EOF
		229 | }

Check: CKV_AWS_288: "Ensure IAM policies does not allow data exfiltration"
	FAILED for resource: module.windows-new-ecs.aws_iam_policy.ec2_instance_policy
	File: /module/ecs/main.tf:190-229
	Calling File: /ecs.tf:5-33
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-288

		190 | resource "aws_iam_policy" "ec2_instance_policy" { #tfsec:ignore:aws-iam-no-policy-wildcards
		191 |   name = "${var.app_name}-ec2-instance-policy"
		192 | 
		193 |   policy = <<EOF
		194 | {
		195 |     "Version": "2012-10-17",
		196 |     "Statement": [
		197 |         {
		198 |             "Effect": "Allow",
		199 |             "Action": [
		200 |                 "ec2:DescribeTags",
		201 |                 "ecs:CreateCluster",
		202 |                 "ecs:DeregisterContainerInstance",
		203 |                 "ecs:DiscoverPollEndpoint",
		204 |                 "ecs:Poll",
		205 |                 "ecs:RegisterContainerInstance",
		206 |                 "ecs:StartTelemetrySession",
		207 |                 "ecs:UpdateContainerInstancesState",
		208 |                 "ecs:Submit*",
		209 |                 "ecr:GetAuthorizationToken",
		210 |                 "ecr:BatchCheckLayerAvailability",
		211 |                 "ecr:GetDownloadUrlForLayer",
		212 |                 "ecr:BatchGetImage",
		213 |                 "logs:CreateLogStream",
		214 |                 "logs:PutLogEvents",
		215 |                 "s3:ListBucket",
		216 |                 "s3:*Object*",
		217 |                 "kms:Decrypt",
		218 |                 "kms:Encrypt",
		219 |                 "kms:GenerateDataKey",
		220 |                 "kms:ReEncrypt",
		221 |                 "kms:GenerateDataKey",
		222 |                 "kms:DescribeKey"
		223 |             ],
		224 |             "Resource": "*"
		225 |         }
		226 |     ]
		227 | }
		228 | EOF
		229 | }

Check: CKV_AWS_289: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: module.windows-new-ecs.aws_iam_policy.ecs_task_execution_s3_policy
	File: /module/ecs/main.tf:370-393
	Calling File: /ecs.tf:5-33
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-289

		370 | resource "aws_iam_policy" "ecs_task_execution_s3_policy" { #tfsec:ignore:aws-iam-no-policy-wildcards
		371 |   name   = "${var.app_name}-ecs-task-execution-s3-policy"
		372 |   policy = <<EOF
		373 | {
		374 |   "Version": "2012-10-17",
		375 |   "Statement": [
		376 |     {
		377 |       "Effect": "Allow",
		378 |       "Action": [
		379 |         "s3:ListBucket",
		380 |         "s3:*Object*",
		381 |         "kms:Decrypt",
		382 |         "kms:Encrypt",
		383 |         "kms:GenerateDataKey",
		384 |         "kms:ReEncrypt",
		385 |         "kms:GenerateDataKey",
		386 |         "kms:DescribeKey"
		387 |       ],
		388 |       "Resource": ["*"]
		389 |     }
		390 |   ]
		391 | }
		392 | EOF
		393 | }

Check: CKV_AWS_355: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.windows-new-ecs.aws_iam_policy.ecs_task_execution_s3_policy
	File: /module/ecs/main.tf:370-393
	Calling File: /ecs.tf:5-33
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-355

		370 | resource "aws_iam_policy" "ecs_task_execution_s3_policy" { #tfsec:ignore:aws-iam-no-policy-wildcards
		371 |   name   = "${var.app_name}-ecs-task-execution-s3-policy"
		372 |   policy = <<EOF
		373 | {
		374 |   "Version": "2012-10-17",
		375 |   "Statement": [
		376 |     {
		377 |       "Effect": "Allow",
		378 |       "Action": [
		379 |         "s3:ListBucket",
		380 |         "s3:*Object*",
		381 |         "kms:Decrypt",
		382 |         "kms:Encrypt",
		383 |         "kms:GenerateDataKey",
		384 |         "kms:ReEncrypt",
		385 |         "kms:GenerateDataKey",
		386 |         "kms:DescribeKey"
		387 |       ],
		388 |       "Resource": ["*"]
		389 |     }
		390 |   ]
		391 | }
		392 | EOF
		393 | }

Check: CKV_AWS_290: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.windows-new-ecs.aws_iam_policy.ecs_task_execution_s3_policy
	File: /module/ecs/main.tf:370-393
	Calling File: /ecs.tf:5-33
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-290

		370 | resource "aws_iam_policy" "ecs_task_execution_s3_policy" { #tfsec:ignore:aws-iam-no-policy-wildcards
		371 |   name   = "${var.app_name}-ecs-task-execution-s3-policy"
		372 |   policy = <<EOF
		373 | {
		374 |   "Version": "2012-10-17",
		375 |   "Statement": [
		376 |     {
		377 |       "Effect": "Allow",
		378 |       "Action": [
		379 |         "s3:ListBucket",
		380 |         "s3:*Object*",
		381 |         "kms:Decrypt",
		382 |         "kms:Encrypt",
		383 |         "kms:GenerateDataKey",
		384 |         "kms:ReEncrypt",
		385 |         "kms:GenerateDataKey",
		386 |         "kms:DescribeKey"
		387 |       ],
		388 |       "Resource": ["*"]
		389 |     }
		390 |   ]
		391 | }
		392 | EOF
		393 | }

Check: CKV_AWS_288: "Ensure IAM policies does not allow data exfiltration"
	FAILED for resource: module.windows-new-ecs.aws_iam_policy.ecs_task_execution_s3_policy
	File: /module/ecs/main.tf:370-393
	Calling File: /ecs.tf:5-33
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-288

		370 | resource "aws_iam_policy" "ecs_task_execution_s3_policy" { #tfsec:ignore:aws-iam-no-policy-wildcards
		371 |   name   = "${var.app_name}-ecs-task-execution-s3-policy"
		372 |   policy = <<EOF
		373 | {
		374 |   "Version": "2012-10-17",
		375 |   "Statement": [
		376 |     {
		377 |       "Effect": "Allow",
		378 |       "Action": [
		379 |         "s3:ListBucket",
		380 |         "s3:*Object*",
		381 |         "kms:Decrypt",
		382 |         "kms:Encrypt",
		383 |         "kms:GenerateDataKey",
		384 |         "kms:ReEncrypt",
		385 |         "kms:GenerateDataKey",
		386 |         "kms:DescribeKey"
		387 |       ],
		388 |       "Resource": ["*"]
		389 |     }
		390 |   ]
		391 | }
		392 | EOF
		393 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: module.windows-new-ecs.aws_cloudwatch_log_group.cloudwatch_group
	File: /module/ecs/main.tf:479-489
	Calling File: /ecs.tf:5-33
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		479 | resource "aws_cloudwatch_log_group" "cloudwatch_group" {
		480 |   #checkov:skip=CKV_AWS_158:Temporarily skip KMS encryption check while logging solution is being updated
		481 |   name              = "${var.app_name}-ecs"
		482 |   retention_in_days = 30
		483 |   tags = merge(
		484 |     var.tags_common,
		485 |     {
		486 |       Name = "${var.app_name}-ecs-cloudwatch-group"
		487 |     }
		488 |   )
		489 | }

Check: CKV_AWS_26: "Ensure all data stored in the SNS topic is encrypted"
	FAILED for resource: aws_sns_topic.ddos_alarm
	File: /monitoring.tf:21-23
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-15

		21 | resource "aws_sns_topic" "ddos_alarm" {
		22 |   name = "ddos_alarm"
		23 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: pagerduty_ddos_alarm
	File: /monitoring.tf:43-50
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		43 | module "pagerduty_ddos_alarm" {
		44 |   depends_on = [
		45 |     aws_sns_topic.ddos_alarm
		46 |   ]
		47 |   source                    = "github.com/ministryofjustice/modernisation-platform-terraform-pagerduty-integration?ref=v2.0.0"
		48 |   sns_topics                = [aws_sns_topic.ddos_alarm.name]
		49 |   pagerduty_integration_key = local.pagerduty_integration_keys["ddos_cloudwatch"]
		50 | }

Check: CKV_AWS_300: "Ensure S3 lifecycle configuration sets period for aborting failed uploads"
	FAILED for resource: aws_s3_bucket_lifecycle_configuration.upload_files
	File: /s3.tf:30-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-300

		30 | resource "aws_s3_bucket_lifecycle_configuration" "upload_files" {
		31 |   bucket = aws_s3_bucket.upload_files.id
		32 |   rule {
		33 |     id     = "tf-s3-lifecycle"
		34 |     status = "Enabled"
		35 |     noncurrent_version_transition {
		36 |       noncurrent_days = 30
		37 |       storage_class   = "STANDARD_IA"
		38 |     }
		39 | 
		40 |     transition {
		41 |       days          = 60
		42 |       storage_class = "STANDARD_IA"
		43 |     }
		44 |   }
		45 | }

Check: CKV_AWS_355: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy.s3-uploads-policy
	File: /s3.tf:112-153
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-355

		112 | resource "aws_iam_policy" "s3-uploads-policy" {
		113 |   name   = "${local.application_name}-s3-uploads-policy"
		114 |   policy = <<EOF
		115 | {
		116 |   "Version": "2012-10-17",
		117 |   "Statement": [
		118 |     {
		119 |       "Effect": "Allow",
		120 |       "Action": [
		121 |           "s3:*"
		122 |       ],
		123 |       "Resource": [
		124 |           "${aws_s3_bucket.upload_files.arn}"
		125 |       ]
		126 |     },
		127 |     {
		128 |       "Effect": "Allow",
		129 |       "Action": [
		130 |           "s3:*"
		131 |       ],
		132 |       "Resource": [
		133 |         "${aws_s3_bucket.upload_files.arn}/*"
		134 |       ]
		135 |     },
		136 |     {
		137 |       "Effect": "Allow",
		138 |       "Action": [
		139 |         "s3:GetEncryptionConfiguration"
		140 |       ],
		141 |       "Resource": "*"
		142 |     },
		143 |     {
		144 |       "Effect": "Allow",
		145 |       "Action": [
		146 |       "kms:Decrypt"
		147 |       ],
		148 |       "Resource": "*"
		149 |     }
		150 |   ]
		151 | }
		152 | EOF
		153 | }

Check: CKV_AWS_290: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy.s3-uploads-policy
	File: /s3.tf:112-153
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-290

		112 | resource "aws_iam_policy" "s3-uploads-policy" {
		113 |   name   = "${local.application_name}-s3-uploads-policy"
		114 |   policy = <<EOF
		115 | {
		116 |   "Version": "2012-10-17",
		117 |   "Statement": [
		118 |     {
		119 |       "Effect": "Allow",
		120 |       "Action": [
		121 |           "s3:*"
		122 |       ],
		123 |       "Resource": [
		124 |           "${aws_s3_bucket.upload_files.arn}"
		125 |       ]
		126 |     },
		127 |     {
		128 |       "Effect": "Allow",
		129 |       "Action": [
		130 |           "s3:*"
		131 |       ],
		132 |       "Resource": [
		133 |         "${aws_s3_bucket.upload_files.arn}/*"
		134 |       ]
		135 |     },
		136 |     {
		137 |       "Effect": "Allow",
		138 |       "Action": [
		139 |         "s3:GetEncryptionConfiguration"
		140 |       ],
		141 |       "Resource": "*"
		142 |     },
		143 |     {
		144 |       "Effect": "Allow",
		145 |       "Action": [
		146 |       "kms:Decrypt"
		147 |       ],
		148 |       "Resource": "*"
		149 |     }
		150 |   ]
		151 | }
		152 | EOF
		153 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: ap_landing_bucket
	File: /s3.tf:166-201
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		166 | module "ap_landing_bucket" {
		167 |   source = "github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.1.0"
		168 | 
		169 |   bucket_name        = "${local.application_name}-land-${local.environment}"
		170 |   ownership_controls = "BucketOwnerEnforced"
		171 | 
		172 |   versioning_enabled  = false
		173 |   replication_enabled = false
		174 | 
		175 |   bucket_policy = [data.aws_iam_policy_document.allow_ap_write_to_landing.json]
		176 | 
		177 |   providers = {
		178 |     # Leave this provider block in even if you are not using replication
		179 |     aws.bucket-replication = aws
		180 |   }
		181 | 
		182 |   custom_kms_key = aws_kms_key.s3.arn
		183 | 
		184 |   lifecycle_rule = [
		185 |     {
		186 |       id      = "tf-s3-lifecycle-landing"
		187 |       enabled = "Enabled"
		188 | 
		189 |       expiration = {
		190 |         days = 30
		191 |       }
		192 |     }
		193 |   ]
		194 | 
		195 |   tags = merge(
		196 |     local.tags,
		197 |     {
		198 |       Name = "${local.application_name}-ap-landing-bucket"
		199 |     }
		200 |   )
		201 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.s3-kms
	File: /s3.tf:264-277
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		264 | data "aws_iam_policy_document" "s3-kms" {
		265 |   #checkov:skip=CKV_AWS_111
		266 |   #checkov:skip=CKV_AWS_109
		267 |   statement {
		268 |     effect    = "Allow"
		269 |     actions   = ["kms:*"]
		270 |     resources = ["*"]
		271 | 
		272 |     principals {
		273 |       type        = "AWS"
		274 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		275 |     }
		276 |   }
		277 | }
Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.mojhub_cnnstr
	File: /secrets.tf:12-21
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		12 | resource "aws_secretsmanager_secret" "mojhub_cnnstr" {
		13 |   #checkov:skip=CKV_AWS_149
		14 |   name = "mojhub_cnnstr"
		15 |   tags = merge(
		16 |     local.tags,
		17 |     {
		18 |       Name = "mojhub_cnnstr"
		19 |     },
		20 |   )
		21 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.mojhub_membership
	File: /secrets.tf:28-37
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		28 | resource "aws_secretsmanager_secret" "mojhub_membership" {
		29 |   #checkov:skip=CKV_AWS_149
		30 |   name = "mojhub_membership"
		31 |   tags = merge(
		32 |     local.tags,
		33 |     {
		34 |       Name = "mojhub_membership"
		35 |     },
		36 |   )
		37 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.govuk_notify_api_key
	File: /secrets.tf:44-53
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		44 | resource "aws_secretsmanager_secret" "govuk_notify_api_key" {
		45 |   #checkov:skip=CKV_AWS_149
		46 |   name = "govuk_notify_api_key"
		47 |   tags = merge(
		48 |     local.tags,
		49 |     {
		50 |       Name = "govuk_notify_api_key"
		51 |     },
		52 |   )
		53 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.os_vts_api_key
	File: /secrets.tf:60-69
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		60 | resource "aws_secretsmanager_secret" "os_vts_api_key" {
		61 |   #checkov:skip=CKV_AWS_149
		62 |   name = "os_vts_api_key"
		63 |   tags = merge(
		64 |     local.tags,
		65 |     {
		66 |       Name = "os_vts_api_key"
		67 |     },
		68 |   )
		69 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.ap_import_access_key_id
	File: /secrets.tf:76-86
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		76 | resource "aws_secretsmanager_secret" "ap_import_access_key_id" {
		77 |   #checkov:skip=CKV_AWS_149
		78 |   name                    = "ap_import_access_key_id"
		79 |   recovery_window_in_days = 0
		80 |   tags = merge(
		81 |     local.tags,
		82 |     {
		83 |       Name = "ap_import_access_key_id"
		84 |     },
		85 |   )
		86 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.ap_import_secret_access_key
	File: /secrets.tf:93-103
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		93  | resource "aws_secretsmanager_secret" "ap_import_secret_access_key" {
		94  |   #checkov:skip=CKV_AWS_149
		95  |   name                    = "ap_import_secret_access_key"
		96  |   recovery_window_in_days = 0
		97  |   tags = merge(
		98  |     local.tags,
		99  |     {
		100 |       Name = "ap_import_secret_access_key"
		101 |     },
		102 |   )
		103 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.ap_export_access_key_id
	File: /secrets.tf:110-120
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		110 | resource "aws_secretsmanager_secret" "ap_export_access_key_id" {
		111 |   #checkov:skip=CKV_AWS_149
		112 |   name                    = "ap_export_access_key_id"
		113 |   recovery_window_in_days = 0
		114 |   tags = merge(
		115 |     local.tags,
		116 |     {
		117 |       Name = "ap_export_access_key_id"
		118 |     },
		119 |   )
		120 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.ap_export_secret_access_key
	File: /secrets.tf:127-137
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		127 | resource "aws_secretsmanager_secret" "ap_export_secret_access_key" {
		128 |   #checkov:skip=CKV_AWS_149
		129 |   name                    = "ap_export_secret_access_key"
		130 |   recovery_window_in_days = 0
		131 |   tags = merge(
		132 |     local.tags,
		133 |     {
		134 |       Name = "ap_export_secret_access_key"
		135 |     },
		136 |   )
		137 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.db_password
	File: /secrets.tf:144-155
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		144 | resource "aws_secretsmanager_secret" "db_password" {
		145 |   #checkov:skip=CKV_AWS_149
		146 | 
		147 |   name = "${var.networking[0].application}-database-password"
		148 | 
		149 |   tags = merge(
		150 |     local.tags,
		151 |     {
		152 |       Name = "${var.networking[0].application}-db-password"
		153 |     },
		154 |   )
		155 | }

Check: CKV2_AWS_62: "Ensure S3 buckets should have event notifications enabled"
	FAILED for resource: aws_s3_bucket.database_backup_files
	File: /database.tf:171-187
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-2-62

		171 | resource "aws_s3_bucket" "database_backup_files" {
		172 |   #checkov:skip=CKV_AWS_18
		173 |   #checkov:skip=CKV_AWS_144
		174 |   #checkov:skip=CKV2_AWS_6
		175 |   bucket = "${local.application_name}-db-backups-${local.environment}"
		176 | 
		177 |   lifecycle {
		178 |     prevent_destroy = true
		179 |   }
		180 | 
		181 |   tags = merge(
		182 |     local.tags,
		183 |     {
		184 |       Name = "${local.application_name}-db-backups-s3"
		185 |     }
		186 |   )
		187 | }

Check: CKV2_AWS_62: "Ensure S3 buckets should have event notifications enabled"
	FAILED for resource: aws_s3_bucket.upload_files
	File: /s3.tf:7-23
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-2-62

		7  | resource "aws_s3_bucket" "upload_files" {
		8  |   #checkov:skip=CKV_AWS_18
		9  |   #checkov:skip=CKV_AWS_144
		10 |   #checkov:skip=CKV2_AWS_6
		11 |   bucket = "${local.application_name}-uploads-${local.environment}"
		12 | 
		13 |   lifecycle {
		14 |     prevent_destroy = true
		15 |   }
		16 | 
		17 |   tags = merge(
		18 |     local.tags,
		19 |     {
		20 |       Name = "${local.application_name}-uploads"
		21 |     }
		22 |   )
		23 | }

Check: CKV2_AWS_60: "Ensure RDS instance with copy tags to snapshots is enabled"
	FAILED for resource: aws_db_instance.database
	File: /database.tf:5-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-60

		Code lines for this resource are too many. Please use IDE of your choice to review the file.

checkov_exitcode=1