Performance Hub - SSM AMI param #8405

jemnery · 2024-10-23T06:37:23Z

No description provided.

…ameter fetched on TF apply

github-actions · 2024-10-23T06:39:44Z

`Trivy Scan` Success

Show Output

```hcl

Trivy will check the following folders:
terraform/environments/performance-hub/module/ecs

Running Trivy in terraform/environments/performance-hub/module/ecs
2024-10-23T06:39:36Z INFO [vulndb] Need to update DB
2024-10-23T06:39:36Z INFO [vulndb] Downloading vulnerability DB...
2024-10-23T06:39:36Z INFO [vulndb] Downloading artifact... repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-23T06:39:38Z INFO [vulndb] Artifact successfully downloaded repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-23T06:39:38Z INFO [vuln] Vulnerability scanning is enabled
2024-10-23T06:39:38Z INFO [misconfig] Misconfiguration scanning is enabled
2024-10-23T06:39:38Z INFO [misconfig] Need to update the built-in checks
2024-10-23T06:39:38Z INFO [misconfig] Downloading the built-in checks...
156.02 KiB / 156.02 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2024-10-23T06:39:38Z INFO [secret] Secret scanning is enabled
2024-10-23T06:39:38Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-23T06:39:38Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-10-23T06:39:39Z INFO [terraform scanner] Scanning root module file_path="."
2024-10-23T06:39:39Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="app_count, app_name, container_cpu, container_instance_type, container_memory, ec2_desired_capacity, ec2_egress_rules, ec2_ingress_rules, ec2_max_size, ec2_min_size, environment, instance_type, key_name, network_mode, server_port, subnet_set_name, tags_common, task_definition, task_definition_volume, user_data, vpc_all"
2024-10-23T06:39:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="dynamic.tag" value="cty.NilVal"
2024-10-23T06:39:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="dynamic.ingress" value="cty.NilVal"
2024-10-23T06:39:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="dynamic.egress" value="cty.NilVal"
2024-10-23T06:39:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="dynamic.tag" value="cty.NilVal"
2024-10-23T06:39:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="dynamic.ingress" value="cty.NilVal"
2024-10-23T06:39:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="dynamic.egress" value="cty.NilVal"
2024-10-23T06:39:39Z INFO Number of language-specific files num=0
2024-10-23T06:39:39Z INFO Detected config files num=2
trivy_exitcode=0

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/performance-hub/module/ecs

*****************************

Running Checkov in terraform/environments/performance-hub/module/ecs
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
terraform scan results:

Passed checks: 50, Failed checks: 9, Skipped checks: 2

Check: CKV_AWS_289: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: aws_iam_policy.ec2_instance_policy
	File: /main.tf:185-224
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-289

		185 | resource "aws_iam_policy" "ec2_instance_policy" { #tfsec:ignore:aws-iam-no-policy-wildcards
		186 |   name = "${var.app_name}-ec2-instance-policy"
		187 | 
		188 |   policy = <<EOF
		189 | {
		190 |     "Version": "2012-10-17",
		191 |     "Statement": [
		192 |         {
		193 |             "Effect": "Allow",
		194 |             "Action": [
		195 |                 "ec2:DescribeTags",
		196 |                 "ecs:CreateCluster",
		197 |                 "ecs:DeregisterContainerInstance",
		198 |                 "ecs:DiscoverPollEndpoint",
		199 |                 "ecs:Poll",
		200 |                 "ecs:RegisterContainerInstance",
		201 |                 "ecs:StartTelemetrySession",
		202 |                 "ecs:UpdateContainerInstancesState",
		203 |                 "ecs:Submit*",
		204 |                 "ecr:GetAuthorizationToken",
		205 |                 "ecr:BatchCheckLayerAvailability",
		206 |                 "ecr:GetDownloadUrlForLayer",
		207 |                 "ecr:BatchGetImage",
		208 |                 "logs:CreateLogStream",
		209 |                 "logs:PutLogEvents",
		210 |                 "s3:ListBucket",
		211 |                 "s3:*Object*",
		212 |                 "kms:Decrypt",
		213 |                 "kms:Encrypt",
		214 |                 "kms:GenerateDataKey",
		215 |                 "kms:ReEncrypt",
		216 |                 "kms:GenerateDataKey",
		217 |                 "kms:DescribeKey"
		218 |             ],
		219 |             "Resource": "*"
		220 |         }
		221 |     ]
		222 | }
		223 | EOF
		224 | }

Check: CKV_AWS_355: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy.ec2_instance_policy
	File: /main.tf:185-224
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-355

		185 | resource "aws_iam_policy" "ec2_instance_policy" { #tfsec:ignore:aws-iam-no-policy-wildcards
		186 |   name = "${var.app_name}-ec2-instance-policy"
		187 | 
		188 |   policy = <<EOF
		189 | {
		190 |     "Version": "2012-10-17",
		191 |     "Statement": [
		192 |         {
		193 |             "Effect": "Allow",
		194 |             "Action": [
		195 |                 "ec2:DescribeTags",
		196 |                 "ecs:CreateCluster",
		197 |                 "ecs:DeregisterContainerInstance",
		198 |                 "ecs:DiscoverPollEndpoint",
		199 |                 "ecs:Poll",
		200 |                 "ecs:RegisterContainerInstance",
		201 |                 "ecs:StartTelemetrySession",
		202 |                 "ecs:UpdateContainerInstancesState",
		203 |                 "ecs:Submit*",
		204 |                 "ecr:GetAuthorizationToken",
		205 |                 "ecr:BatchCheckLayerAvailability",
		206 |                 "ecr:GetDownloadUrlForLayer",
		207 |                 "ecr:BatchGetImage",
		208 |                 "logs:CreateLogStream",
		209 |                 "logs:PutLogEvents",
		210 |                 "s3:ListBucket",
		211 |                 "s3:*Object*",
		212 |                 "kms:Decrypt",
		213 |                 "kms:Encrypt",
		214 |                 "kms:GenerateDataKey",
		215 |                 "kms:ReEncrypt",
		216 |                 "kms:GenerateDataKey",
		217 |                 "kms:DescribeKey"
		218 |             ],
		219 |             "Resource": "*"
		220 |         }
		221 |     ]
		222 | }
		223 | EOF
		224 | }

Check: CKV_AWS_290: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy.ec2_instance_policy
	File: /main.tf:185-224
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-290

		185 | resource "aws_iam_policy" "ec2_instance_policy" { #tfsec:ignore:aws-iam-no-policy-wildcards
		186 |   name = "${var.app_name}-ec2-instance-policy"
		187 | 
		188 |   policy = <<EOF
		189 | {
		190 |     "Version": "2012-10-17",
		191 |     "Statement": [
		192 |         {
		193 |             "Effect": "Allow",
		194 |             "Action": [
		195 |                 "ec2:DescribeTags",
		196 |                 "ecs:CreateCluster",
		197 |                 "ecs:DeregisterContainerInstance",
		198 |                 "ecs:DiscoverPollEndpoint",
		199 |                 "ecs:Poll",
		200 |                 "ecs:RegisterContainerInstance",
		201 |                 "ecs:StartTelemetrySession",
		202 |                 "ecs:UpdateContainerInstancesState",
		203 |                 "ecs:Submit*",
		204 |                 "ecr:GetAuthorizationToken",
		205 |                 "ecr:BatchCheckLayerAvailability",
		206 |                 "ecr:GetDownloadUrlForLayer",
		207 |                 "ecr:BatchGetImage",
		208 |                 "logs:CreateLogStream",
		209 |                 "logs:PutLogEvents",
		210 |                 "s3:ListBucket",
		211 |                 "s3:*Object*",
		212 |                 "kms:Decrypt",
		213 |                 "kms:Encrypt",
		214 |                 "kms:GenerateDataKey",
		215 |                 "kms:ReEncrypt",
		216 |                 "kms:GenerateDataKey",
		217 |                 "kms:DescribeKey"
		218 |             ],
		219 |             "Resource": "*"
		220 |         }
		221 |     ]
		222 | }
		223 | EOF
		224 | }

Check: CKV_AWS_288: "Ensure IAM policies does not allow data exfiltration"
	FAILED for resource: aws_iam_policy.ec2_instance_policy
	File: /main.tf:185-224
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-288

		185 | resource "aws_iam_policy" "ec2_instance_policy" { #tfsec:ignore:aws-iam-no-policy-wildcards
		186 |   name = "${var.app_name}-ec2-instance-policy"
		187 | 
		188 |   policy = <<EOF
		189 | {
		190 |     "Version": "2012-10-17",
		191 |     "Statement": [
		192 |         {
		193 |             "Effect": "Allow",
		194 |             "Action": [
		195 |                 "ec2:DescribeTags",
		196 |                 "ecs:CreateCluster",
		197 |                 "ecs:DeregisterContainerInstance",
		198 |                 "ecs:DiscoverPollEndpoint",
		199 |                 "ecs:Poll",
		200 |                 "ecs:RegisterContainerInstance",
		201 |                 "ecs:StartTelemetrySession",
		202 |                 "ecs:UpdateContainerInstancesState",
		203 |                 "ecs:Submit*",
		204 |                 "ecr:GetAuthorizationToken",
		205 |                 "ecr:BatchCheckLayerAvailability",
		206 |                 "ecr:GetDownloadUrlForLayer",
		207 |                 "ecr:BatchGetImage",
		208 |                 "logs:CreateLogStream",
		209 |                 "logs:PutLogEvents",
		210 |                 "s3:ListBucket",
		211 |                 "s3:*Object*",
		212 |                 "kms:Decrypt",
		213 |                 "kms:Encrypt",
		214 |                 "kms:GenerateDataKey",
		215 |                 "kms:ReEncrypt",
		216 |                 "kms:GenerateDataKey",
		217 |                 "kms:DescribeKey"
		218 |             ],
		219 |             "Resource": "*"
		220 |         }
		221 |     ]
		222 | }
		223 | EOF
		224 | }

Check: CKV_AWS_289: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: aws_iam_policy.ecs_task_execution_s3_policy
	File: /main.tf:365-388
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-289

		365 | resource "aws_iam_policy" "ecs_task_execution_s3_policy" { #tfsec:ignore:aws-iam-no-policy-wildcards
		366 |   name   = "${var.app_name}-ecs-task-execution-s3-policy"
		367 |   policy = <<EOF
		368 | {
		369 |   "Version": "2012-10-17",
		370 |   "Statement": [
		371 |     {
		372 |       "Effect": "Allow",
		373 |       "Action": [
		374 |         "s3:ListBucket",
		375 |         "s3:*Object*",
		376 |         "kms:Decrypt",
		377 |         "kms:Encrypt",
		378 |         "kms:GenerateDataKey",
		379 |         "kms:ReEncrypt",
		380 |         "kms:GenerateDataKey",
		381 |         "kms:DescribeKey"
		382 |       ],
		383 |       "Resource": ["*"]
		384 |     }
		385 |   ]
		386 | }
		387 | EOF
		388 | }

Check: CKV_AWS_355: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy.ecs_task_execution_s3_policy
	File: /main.tf:365-388
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-355

		365 | resource "aws_iam_policy" "ecs_task_execution_s3_policy" { #tfsec:ignore:aws-iam-no-policy-wildcards
		366 |   name   = "${var.app_name}-ecs-task-execution-s3-policy"
		367 |   policy = <<EOF
		368 | {
		369 |   "Version": "2012-10-17",
		370 |   "Statement": [
		371 |     {
		372 |       "Effect": "Allow",
		373 |       "Action": [
		374 |         "s3:ListBucket",
		375 |         "s3:*Object*",
		376 |         "kms:Decrypt",
		377 |         "kms:Encrypt",
		378 |         "kms:GenerateDataKey",
		379 |         "kms:ReEncrypt",
		380 |         "kms:GenerateDataKey",
		381 |         "kms:DescribeKey"
		382 |       ],
		383 |       "Resource": ["*"]
		384 |     }
		385 |   ]
		386 | }
		387 | EOF
		388 | }

Check: CKV_AWS_290: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy.ecs_task_execution_s3_policy
	File: /main.tf:365-388
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-290

		365 | resource "aws_iam_policy" "ecs_task_execution_s3_policy" { #tfsec:ignore:aws-iam-no-policy-wildcards
		366 |   name   = "${var.app_name}-ecs-task-execution-s3-policy"
		367 |   policy = <<EOF
		368 | {
		369 |   "Version": "2012-10-17",
		370 |   "Statement": [
		371 |     {
		372 |       "Effect": "Allow",
		373 |       "Action": [
		374 |         "s3:ListBucket",
		375 |         "s3:*Object*",
		376 |         "kms:Decrypt",
		377 |         "kms:Encrypt",
		378 |         "kms:GenerateDataKey",
		379 |         "kms:ReEncrypt",
		380 |         "kms:GenerateDataKey",
		381 |         "kms:DescribeKey"
		382 |       ],
		383 |       "Resource": ["*"]
		384 |     }
		385 |   ]
		386 | }
		387 | EOF
		388 | }

Check: CKV_AWS_288: "Ensure IAM policies does not allow data exfiltration"
	FAILED for resource: aws_iam_policy.ecs_task_execution_s3_policy
	File: /main.tf:365-388
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-288

		365 | resource "aws_iam_policy" "ecs_task_execution_s3_policy" { #tfsec:ignore:aws-iam-no-policy-wildcards
		366 |   name   = "${var.app_name}-ecs-task-execution-s3-policy"
		367 |   policy = <<EOF
		368 | {
		369 |   "Version": "2012-10-17",
		370 |   "Statement": [
		371 |     {
		372 |       "Effect": "Allow",
		373 |       "Action": [
		374 |         "s3:ListBucket",
		375 |         "s3:*Object*",
		376 |         "kms:Decrypt",
		377 |         "kms:Encrypt",
		378 |         "kms:GenerateDataKey",
		379 |         "kms:ReEncrypt",
		380 |         "kms:GenerateDataKey",
		381 |         "kms:DescribeKey"
		382 |       ],
		383 |       "Resource": ["*"]
		384 |     }
		385 |   ]
		386 | }
		387 | EOF
		388 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.cloudwatch_group
	File: /main.tf:474-484
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		474 | resource "aws_cloudwatch_log_group" "cloudwatch_group" {
		475 |   #checkov:skip=CKV_AWS_158:Temporarily skip KMS encryption check while logging solution is being updated
		476 |   name              = "${var.app_name}-ecs"
		477 |   retention_in_days = 30
		478 |   tags = merge(
		479 |     var.tags_common,
		480 |     {
		481 |       Name = "${var.app_name}-ecs-cloudwatch-group"
		482 |     }
		483 |   )
		484 | }


checkov_exitcode=1

`CTFLint Scan` Success

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
terraform/environments/performance-hub/module/ecs

*****************************

Running tflint in terraform/environments/performance-hub/module/ecs
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=0

`Trivy Scan` Success

Show Output

*****************************

Trivy will check the following folders:
terraform/environments/performance-hub/module/ecs

*****************************

Running Trivy in terraform/environments/performance-hub/module/ecs
2024-10-23T06:39:36Z	INFO	[vulndb] Need to update DB
2024-10-23T06:39:36Z	INFO	[vulndb] Downloading vulnerability DB...
2024-10-23T06:39:36Z	INFO	[vulndb] Downloading artifact...	repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-23T06:39:38Z	INFO	[vulndb] Artifact successfully downloaded	repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-23T06:39:38Z	INFO	[vuln] Vulnerability scanning is enabled
2024-10-23T06:39:38Z	INFO	[misconfig] Misconfiguration scanning is enabled
2024-10-23T06:39:38Z	INFO	[misconfig] Need to update the built-in checks
2024-10-23T06:39:38Z	INFO	[misconfig] Downloading the built-in checks...
156.02 KiB / 156.02 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2024-10-23T06:39:38Z	INFO	[secret] Secret scanning is enabled
2024-10-23T06:39:38Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-23T06:39:38Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-10-23T06:39:39Z	INFO	[terraform scanner] Scanning root module	file_path="."
2024-10-23T06:39:39Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="app_count, app_name, container_cpu, container_instance_type, container_memory, ec2_desired_capacity, ec2_egress_rules, ec2_ingress_rules, ec2_max_size, ec2_min_size, environment, instance_type, key_name, network_mode, server_port, subnet_set_name, tags_common, task_definition, task_definition_volume, user_data, vpc_all"
2024-10-23T06:39:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="dynamic.tag" value="cty.NilVal"
2024-10-23T06:39:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="dynamic.ingress" value="cty.NilVal"
2024-10-23T06:39:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="dynamic.egress" value="cty.NilVal"
2024-10-23T06:39:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="dynamic.tag" value="cty.NilVal"
2024-10-23T06:39:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="dynamic.ingress" value="cty.NilVal"
2024-10-23T06:39:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="dynamic.egress" value="cty.NilVal"
2024-10-23T06:39:39Z	INFO	Number of language-specific files	num=0
2024-10-23T06:39:39Z	INFO	Detected config files	num=2
trivy_exitcode=0

github-actions · 2024-10-23T12:15:09Z

`Trivy Scan` Failed

Show Output

```hcl

Trivy will check the following folders:
terraform/environments/performance-hub/module/ecs

Running Trivy in terraform/environments/performance-hub/module/ecs
2024-10-23T12:15:04Z INFO [vulndb] Need to update DB
2024-10-23T12:15:04Z INFO [vulndb] Downloading vulnerability DB...
2024-10-23T12:15:04Z INFO [vulndb] Downloading artifact... repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-23T12:15:04Z ERROR [vulndb] Failed to download artifact repo="ghcr.io/aquasecurity/trivy-db:2" err="OCI repository error: 1 error occurred:\n\t* GET https://ghcr.io/v2/aquasecurity/trivy-db/manifests/2: TOOMANYREQUESTS: retry-after: 28.461µs, allowed: 44000/minute\n\n"
2024-10-23T12:15:04Z FATAL Fatal error init error: DB error: failed to download vulnerability DB: OCI artifact error: failed to download vulnerability DB: failed to download artifact from any source
trivy_exitcode=1

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/performance-hub/module/ecs

*****************************

Running Checkov in terraform/environments/performance-hub/module/ecs
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
terraform scan results:

Passed checks: 50, Failed checks: 9, Skipped checks: 2

Check: CKV_AWS_289: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: aws_iam_policy.ec2_instance_policy
	File: /main.tf:185-224
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-289

		185 | resource "aws_iam_policy" "ec2_instance_policy" { #tfsec:ignore:aws-iam-no-policy-wildcards
		186 |   name = "${var.app_name}-ec2-instance-policy"
		187 | 
		188 |   policy = <<EOF
		189 | {
		190 |     "Version": "2012-10-17",
		191 |     "Statement": [
		192 |         {
		193 |             "Effect": "Allow",
		194 |             "Action": [
		195 |                 "ec2:DescribeTags",
		196 |                 "ecs:CreateCluster",
		197 |                 "ecs:DeregisterContainerInstance",
		198 |                 "ecs:DiscoverPollEndpoint",
		199 |                 "ecs:Poll",
		200 |                 "ecs:RegisterContainerInstance",
		201 |                 "ecs:StartTelemetrySession",
		202 |                 "ecs:UpdateContainerInstancesState",
		203 |                 "ecs:Submit*",
		204 |                 "ecr:GetAuthorizationToken",
		205 |                 "ecr:BatchCheckLayerAvailability",
		206 |                 "ecr:GetDownloadUrlForLayer",
		207 |                 "ecr:BatchGetImage",
		208 |                 "logs:CreateLogStream",
		209 |                 "logs:PutLogEvents",
		210 |                 "s3:ListBucket",
		211 |                 "s3:*Object*",
		212 |                 "kms:Decrypt",
		213 |                 "kms:Encrypt",
		214 |                 "kms:GenerateDataKey",
		215 |                 "kms:ReEncrypt",
		216 |                 "kms:GenerateDataKey",
		217 |                 "kms:DescribeKey"
		218 |             ],
		219 |             "Resource": "*"
		220 |         }
		221 |     ]
		222 | }
		223 | EOF
		224 | }

Check: CKV_AWS_355: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy.ec2_instance_policy
	File: /main.tf:185-224
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-355

		185 | resource "aws_iam_policy" "ec2_instance_policy" { #tfsec:ignore:aws-iam-no-policy-wildcards
		186 |   name = "${var.app_name}-ec2-instance-policy"
		187 | 
		188 |   policy = <<EOF
		189 | {
		190 |     "Version": "2012-10-17",
		191 |     "Statement": [
		192 |         {
		193 |             "Effect": "Allow",
		194 |             "Action": [
		195 |                 "ec2:DescribeTags",
		196 |                 "ecs:CreateCluster",
		197 |                 "ecs:DeregisterContainerInstance",
		198 |                 "ecs:DiscoverPollEndpoint",
		199 |                 "ecs:Poll",
		200 |                 "ecs:RegisterContainerInstance",
		201 |                 "ecs:StartTelemetrySession",
		202 |                 "ecs:UpdateContainerInstancesState",
		203 |                 "ecs:Submit*",
		204 |                 "ecr:GetAuthorizationToken",
		205 |                 "ecr:BatchCheckLayerAvailability",
		206 |                 "ecr:GetDownloadUrlForLayer",
		207 |                 "ecr:BatchGetImage",
		208 |                 "logs:CreateLogStream",
		209 |                 "logs:PutLogEvents",
		210 |                 "s3:ListBucket",
		211 |                 "s3:*Object*",
		212 |                 "kms:Decrypt",
		213 |                 "kms:Encrypt",
		214 |                 "kms:GenerateDataKey",
		215 |                 "kms:ReEncrypt",
		216 |                 "kms:GenerateDataKey",
		217 |                 "kms:DescribeKey"
		218 |             ],
		219 |             "Resource": "*"
		220 |         }
		221 |     ]
		222 | }
		223 | EOF
		224 | }

Check: CKV_AWS_290: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy.ec2_instance_policy
	File: /main.tf:185-224
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-290

		185 | resource "aws_iam_policy" "ec2_instance_policy" { #tfsec:ignore:aws-iam-no-policy-wildcards
		186 |   name = "${var.app_name}-ec2-instance-policy"
		187 | 
		188 |   policy = <<EOF
		189 | {
		190 |     "Version": "2012-10-17",
		191 |     "Statement": [
		192 |         {
		193 |             "Effect": "Allow",
		194 |             "Action": [
		195 |                 "ec2:DescribeTags",
		196 |                 "ecs:CreateCluster",
		197 |                 "ecs:DeregisterContainerInstance",
		198 |                 "ecs:DiscoverPollEndpoint",
		199 |                 "ecs:Poll",
		200 |                 "ecs:RegisterContainerInstance",
		201 |                 "ecs:StartTelemetrySession",
		202 |                 "ecs:UpdateContainerInstancesState",
		203 |                 "ecs:Submit*",
		204 |                 "ecr:GetAuthorizationToken",
		205 |                 "ecr:BatchCheckLayerAvailability",
		206 |                 "ecr:GetDownloadUrlForLayer",
		207 |                 "ecr:BatchGetImage",
		208 |                 "logs:CreateLogStream",
		209 |                 "logs:PutLogEvents",
		210 |                 "s3:ListBucket",
		211 |                 "s3:*Object*",
		212 |                 "kms:Decrypt",
		213 |                 "kms:Encrypt",
		214 |                 "kms:GenerateDataKey",
		215 |                 "kms:ReEncrypt",
		216 |                 "kms:GenerateDataKey",
		217 |                 "kms:DescribeKey"
		218 |             ],
		219 |             "Resource": "*"
		220 |         }
		221 |     ]
		222 | }
		223 | EOF
		224 | }

Check: CKV_AWS_288: "Ensure IAM policies does not allow data exfiltration"
	FAILED for resource: aws_iam_policy.ec2_instance_policy
	File: /main.tf:185-224
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-288

		185 | resource "aws_iam_policy" "ec2_instance_policy" { #tfsec:ignore:aws-iam-no-policy-wildcards
		186 |   name = "${var.app_name}-ec2-instance-policy"
		187 | 
		188 |   policy = <<EOF
		189 | {
		190 |     "Version": "2012-10-17",
		191 |     "Statement": [
		192 |         {
		193 |             "Effect": "Allow",
		194 |             "Action": [
		195 |                 "ec2:DescribeTags",
		196 |                 "ecs:CreateCluster",
		197 |                 "ecs:DeregisterContainerInstance",
		198 |                 "ecs:DiscoverPollEndpoint",
		199 |                 "ecs:Poll",
		200 |                 "ecs:RegisterContainerInstance",
		201 |                 "ecs:StartTelemetrySession",
		202 |                 "ecs:UpdateContainerInstancesState",
		203 |                 "ecs:Submit*",
		204 |                 "ecr:GetAuthorizationToken",
		205 |                 "ecr:BatchCheckLayerAvailability",
		206 |                 "ecr:GetDownloadUrlForLayer",
		207 |                 "ecr:BatchGetImage",
		208 |                 "logs:CreateLogStream",
		209 |                 "logs:PutLogEvents",
		210 |                 "s3:ListBucket",
		211 |                 "s3:*Object*",
		212 |                 "kms:Decrypt",
		213 |                 "kms:Encrypt",
		214 |                 "kms:GenerateDataKey",
		215 |                 "kms:ReEncrypt",
		216 |                 "kms:GenerateDataKey",
		217 |                 "kms:DescribeKey"
		218 |             ],
		219 |             "Resource": "*"
		220 |         }
		221 |     ]
		222 | }
		223 | EOF
		224 | }

Check: CKV_AWS_289: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: aws_iam_policy.ecs_task_execution_s3_policy
	File: /main.tf:365-388
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-289

		365 | resource "aws_iam_policy" "ecs_task_execution_s3_policy" { #tfsec:ignore:aws-iam-no-policy-wildcards
		366 |   name   = "${var.app_name}-ecs-task-execution-s3-policy"
		367 |   policy = <<EOF
		368 | {
		369 |   "Version": "2012-10-17",
		370 |   "Statement": [
		371 |     {
		372 |       "Effect": "Allow",
		373 |       "Action": [
		374 |         "s3:ListBucket",
		375 |         "s3:*Object*",
		376 |         "kms:Decrypt",
		377 |         "kms:Encrypt",
		378 |         "kms:GenerateDataKey",
		379 |         "kms:ReEncrypt",
		380 |         "kms:GenerateDataKey",
		381 |         "kms:DescribeKey"
		382 |       ],
		383 |       "Resource": ["*"]
		384 |     }
		385 |   ]
		386 | }
		387 | EOF
		388 | }

Check: CKV_AWS_355: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy.ecs_task_execution_s3_policy
	File: /main.tf:365-388
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-355

		365 | resource "aws_iam_policy" "ecs_task_execution_s3_policy" { #tfsec:ignore:aws-iam-no-policy-wildcards
		366 |   name   = "${var.app_name}-ecs-task-execution-s3-policy"
		367 |   policy = <<EOF
		368 | {
		369 |   "Version": "2012-10-17",
		370 |   "Statement": [
		371 |     {
		372 |       "Effect": "Allow",
		373 |       "Action": [
		374 |         "s3:ListBucket",
		375 |         "s3:*Object*",
		376 |         "kms:Decrypt",
		377 |         "kms:Encrypt",
		378 |         "kms:GenerateDataKey",
		379 |         "kms:ReEncrypt",
		380 |         "kms:GenerateDataKey",
		381 |         "kms:DescribeKey"
		382 |       ],
		383 |       "Resource": ["*"]
		384 |     }
		385 |   ]
		386 | }
		387 | EOF
		388 | }

Check: CKV_AWS_290: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy.ecs_task_execution_s3_policy
	File: /main.tf:365-388
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-290

		365 | resource "aws_iam_policy" "ecs_task_execution_s3_policy" { #tfsec:ignore:aws-iam-no-policy-wildcards
		366 |   name   = "${var.app_name}-ecs-task-execution-s3-policy"
		367 |   policy = <<EOF
		368 | {
		369 |   "Version": "2012-10-17",
		370 |   "Statement": [
		371 |     {
		372 |       "Effect": "Allow",
		373 |       "Action": [
		374 |         "s3:ListBucket",
		375 |         "s3:*Object*",
		376 |         "kms:Decrypt",
		377 |         "kms:Encrypt",
		378 |         "kms:GenerateDataKey",
		379 |         "kms:ReEncrypt",
		380 |         "kms:GenerateDataKey",
		381 |         "kms:DescribeKey"
		382 |       ],
		383 |       "Resource": ["*"]
		384 |     }
		385 |   ]
		386 | }
		387 | EOF
		388 | }

Check: CKV_AWS_288: "Ensure IAM policies does not allow data exfiltration"
	FAILED for resource: aws_iam_policy.ecs_task_execution_s3_policy
	File: /main.tf:365-388
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-288

		365 | resource "aws_iam_policy" "ecs_task_execution_s3_policy" { #tfsec:ignore:aws-iam-no-policy-wildcards
		366 |   name   = "${var.app_name}-ecs-task-execution-s3-policy"
		367 |   policy = <<EOF
		368 | {
		369 |   "Version": "2012-10-17",
		370 |   "Statement": [
		371 |     {
		372 |       "Effect": "Allow",
		373 |       "Action": [
		374 |         "s3:ListBucket",
		375 |         "s3:*Object*",
		376 |         "kms:Decrypt",
		377 |         "kms:Encrypt",
		378 |         "kms:GenerateDataKey",
		379 |         "kms:ReEncrypt",
		380 |         "kms:GenerateDataKey",
		381 |         "kms:DescribeKey"
		382 |       ],
		383 |       "Resource": ["*"]
		384 |     }
		385 |   ]
		386 | }
		387 | EOF
		388 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.cloudwatch_group
	File: /main.tf:474-484
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		474 | resource "aws_cloudwatch_log_group" "cloudwatch_group" {
		475 |   #checkov:skip=CKV_AWS_158:Temporarily skip KMS encryption check while logging solution is being updated
		476 |   name              = "${var.app_name}-ecs"
		477 |   retention_in_days = 30
		478 |   tags = merge(
		479 |     var.tags_common,
		480 |     {
		481 |       Name = "${var.app_name}-ecs-cloudwatch-group"
		482 |     }
		483 |   )
		484 | }


checkov_exitcode=1

`CTFLint Scan` Success

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
terraform/environments/performance-hub/module/ecs

*****************************

Running tflint in terraform/environments/performance-hub/module/ecs
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=0

`Trivy Scan` Failed

Show Output

*****************************

Trivy will check the following folders:
terraform/environments/performance-hub/module/ecs

*****************************

Running Trivy in terraform/environments/performance-hub/module/ecs
2024-10-23T12:15:04Z	INFO	[vulndb] Need to update DB
2024-10-23T12:15:04Z	INFO	[vulndb] Downloading vulnerability DB...
2024-10-23T12:15:04Z	INFO	[vulndb] Downloading artifact...	repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-23T12:15:04Z	ERROR	[vulndb] Failed to download artifact	repo="ghcr.io/aquasecurity/trivy-db:2" err="OCI repository error: 1 error occurred:\n\t* GET https://ghcr.io/v2/aquasecurity/trivy-db/manifests/2: TOOMANYREQUESTS: retry-after: 28.461µs, allowed: 44000/minute\n\n"
2024-10-23T12:15:04Z	FATAL	Fatal error	init error: DB error: failed to download vulnerability DB: OCI artifact error: failed to download vulnerability DB: failed to download artifact from any source
trivy_exitcode=1

scripttease

This change seems ok but main needs static analysis check - failing on main I think

jemnery added 2 commits October 23, 2024 07:30

Use SSM to pull AMI ID dynamically in launch template, instead of par…

b0f8bbb

…ameter fetched on TF apply

Use SSM to pull AMI ID dynamically in launch template, instead of par…

feb4ebd

…ameter fetched on TF apply

jemnery requested review from a team as code owners October 23, 2024 06:37

github-actions bot added the environments-repository Used to exclude PRs from this repo in our Slack PR update label Oct 23, 2024

jemnery had a problem deploying to performance-hub-development October 23, 2024 06:38 — with GitHub Actions Failure

jemnery had a problem deploying to performance-hub-development October 23, 2024 09:21 — with GitHub Actions Failure

Merge branch 'main' into performance-hub/ssm-ami-param

8a347d8

jemnery temporarily deployed to performance-hub-development October 23, 2024 12:14 — with GitHub Actions Inactive

scripttease approved these changes Oct 23, 2024

View reviewed changes

jemnery merged commit 30817e6 into main Oct 23, 2024
13 of 14 checks passed

jemnery deleted the performance-hub/ssm-ami-param branch October 23, 2024 13:01

scripttease reviewed Oct 23, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Performance Hub - SSM AMI param #8405

Performance Hub - SSM AMI param #8405

jemnery commented Oct 23, 2024

github-actions bot commented Oct 23, 2024

github-actions bot commented Oct 23, 2024

scripttease left a comment

Performance Hub - SSM AMI param #8405

Performance Hub - SSM AMI param #8405

Conversation

jemnery commented Oct 23, 2024

github-actions bot commented Oct 23, 2024

Trivy Scan Success

CTFLint Scan Success

Trivy Scan Success

github-actions bot commented Oct 23, 2024

Trivy Scan Failed

CTFLint Scan Success

Trivy Scan Failed

scripttease left a comment

Choose a reason for hiding this comment

`Trivy Scan` Success

`CTFLint Scan` Success

`Trivy Scan` Success

`Trivy Scan` Failed

`CTFLint Scan` Success

`Trivy Scan` Failed