CC-2923: SSM command for executing 'yum update'. #8553

mmgovuk · 2024-11-04T13:22:29Z

CC-2923: SSM command for executing 'yum update'.

modernisation-platform-ci

Terraform plan evaluation detected changes to resources that require approval from @ministryofjustice/modernsation-platform - please contact #ask-modernisation-platform for assistance

modernisation-platform-ci · 2024-11-04T13:24:03Z

@mmgovuk Terraform plan evaluation detected changes to resources that require approval from a member of @ministryofjustice/modernisation-platform - please contact #ask-modernisation-platform for assistance

Guidance on approving these PRs is available at https://user-guide.modernisation-platform.service.justice.gov.uk/runbooks/reviewing-mp-environments-prs.html#process-for-approving-prs

modernisation-platform-ci

Terraform plan evaluation detected changes to resources that require approval from @ministryofjustice/modernsation-platform - please contact #ask-modernisation-platform for assistance

modernisation-platform-ci · 2024-11-04T13:24:04Z

@mmgovuk Terraform plan evaluation detected changes to resources that require approval from a member of @ministryofjustice/modernisation-platform - please contact #ask-modernisation-platform for assistance

Guidance on approving these PRs is available at https://user-guide.modernisation-platform.service.justice.gov.uk/runbooks/reviewing-mp-environments-prs.html#process-for-approving-prs

modernisation-platform-ci

Terraform plan evaluation detected changes to resources that require approval from @ministryofjustice/modernsation-platform - please contact #ask-modernisation-platform for assistance

modernisation-platform-ci · 2024-11-04T13:24:05Z

@mmgovuk Terraform plan evaluation detected changes to resources that require approval from a member of @ministryofjustice/modernisation-platform - please contact #ask-modernisation-platform for assistance

Guidance on approving these PRs is available at https://user-guide.modernisation-platform.service.justice.gov.uk/runbooks/reviewing-mp-environments-prs.html#process-for-approving-prs

modernisation-platform-ci

Terraform plan evaluation detected changes to resources that require approval from @ministryofjustice/modernsation-platform - please contact #ask-modernisation-platform for assistance

modernisation-platform-ci · 2024-11-04T13:24:08Z

@mmgovuk Terraform plan evaluation detected changes to resources that require approval from a member of @ministryofjustice/modernisation-platform - please contact #ask-modernisation-platform for assistance

Guidance on approving these PRs is available at https://user-guide.modernisation-platform.service.justice.gov.uk/runbooks/reviewing-mp-environments-prs.html#process-for-approving-prs

github-actions · 2024-11-04T13:25:11Z

`Trivy Scan` Failed

Show Output

```hcl

Trivy will check the following folders:
terraform/environments/ccms-ebs-upgrade
terraform/environments/ccms-ebs

Running Trivy in terraform/environments/ccms-ebs-upgrade
2024-11-04T13:24:41Z INFO [vulndb] Need to update DB
2024-11-04T13:24:41Z INFO [vulndb] Downloading vulnerability DB...
2024-11-04T13:24:41Z INFO [vulndb] Downloading artifact... repo="public.ecr.aws/aquasecurity/trivy-db:2"
2024-11-04T13:24:43Z INFO [vulndb] Artifact successfully downloaded repo="public.ecr.aws/aquasecurity/trivy-db:2"
2024-11-04T13:24:43Z INFO [vuln] Vulnerability scanning is enabled
2024-11-04T13:24:43Z INFO [misconfig] Misconfiguration scanning is enabled
2024-11-04T13:24:43Z INFO [misconfig] Need to update the built-in checks
2024-11-04T13:24:43Z INFO [misconfig] Downloading the built-in checks...
160.60 KiB / 160.60 KiB [---------------------------------------------------------] 100.00% ? p/s 0s2024-11-04T13:24:43Z INFO [secret] Secret scanning is enabled
2024-11-04T13:24:43Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-11-04T13:24:43Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2024-11-04T13:24:45Z INFO [terraform scanner] Scanning root module file_path="."
2024-11-04T13:24:45Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="networking"
2024-11-04T13:24:45Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_cloudwatch_log_group.groups" value="cty.NilVal"
2024-11-04T13:24:45Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_route53_record.external_validation" value="cty.NilVal"
2024-11-04T13:24:45Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_security_group_rule.all_internal_egress_traffic" value="cty.NilVal"
2024-11-04T13:24:45Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_security_group_rule.all_internal_ingress_traffic" value="cty.NilVal"
2024-11-04T13:24:47Z INFO [terraform scanner] Scanning root module file_path="modules"
2024-11-04T13:24:47Z INFO [terraform scanner] Scanning root module file_path="modules/cw-logs"
2024-11-04T13:24:50Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-versioning" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0/main.tf:167-172"
2024-11-04T13:24:50Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0/main.tf:157-165"
2024-11-04T13:24:50Z INFO Number of language-specific files num=0
2024-11-04T13:24:50Z INFO Detected config files num=21

ec2-oracle_accessgate.tf (terraform)

Tests: 1 (SUCCESSES: 0, FAILURES: 1)
Failures: 1 (HIGH: 1, CRITICAL: 0)

AVD-AWS-0028 (HIGH): Instance does not require IMDS access to require a token.
════════════════════════════════════════
IMDS v2 (Instance Metadata Service) introduced session authentication tokens which improve security when talking to IMDS.

By default aws_instance resource sets IMDS session auth tokens to be optional.

To fully protect IMDS you need to enable session tokens by using metadata_options block and its http_tokens variable set to required.

See https://avd.aquasec.com/misconfig/avd-aws-0028
────────────────────────────────────────
ec2-oracle_accessgate.tf:1-104
────────────────────────────────────────
1 ┌ resource "aws_instance" "ec2_accessgate" {
2 │ count = local.application_data.accounts[local.environment].accessgate_no_instances
3 │ instance_type = local.application_data.accounts[local.environment].ec2_oracle_instance_type_accessgate
4 │ ami = local.application_data.accounts[local.environment]["accessgate_ami_id-${count.index + 1}"]
5 │ key_name = local.application_data.accounts[local.environment].key_name
6 │ vpc_security_group_ids = [aws_security_group.ec2_sg_accessgate.id]
7 │ subnet_id = local.private_subnets[count.index]
8 │ #subnet_id = data.aws_subnet.data_subnets_a.id
9 └ monitoring = true
..
────────────────────────────────────────

ec2-oracle_ebs_apps-alb.tf (terraform)

Tests: 1 (SUCCESSES: 0, FAILURES: 1)
Failures: 1 (HIGH: 1, CRITICAL: 0)

AVD-AWS-0052 (HIGH): Application load balancer is not set to drop invalid headers.
════════════════════════════════════════
Passing unknown or invalid headers through to the target poses a potential risk of compromise.
By setting drop_invalid_header_fields to true, anything that does not conform to well known, defined headers will be removed by the load balancer.

See https://avd.aquasec.com/misconfig/avd-aws-0052
────────────────────────────────────────
ec2-oracle_ebs_apps-alb.tf:1-19
────────────────────────────────────────
1 ┌ resource "aws_lb" "ebsapps_lb" {
2 │ name = lower(format("lb-%s-ebsapp", local.application_name))
3 │ internal = true
4 │ load_balancer_type = "application"
5 │ security_groups = [aws_security_group.sg_ebsapps_lb.id]
6 │ subnets = data.aws_subnets.shared-private.ids
7 │
8 │ enable_deletion_protection = true
9 └
..
────────────────────────────────────────

ec2-oracle_ebs_apps.tf (terraform)

Tests: 1 (SUCCESSES: 0, FAILURES: 1)
Failures: 1 (HIGH: 1, CRITICAL: 0)

AVD-AWS-0028 (HIGH): Instance does not require IMDS access to require a token.
════════════════════════════════════════
IMDS v2 (Instance Metadata Service) introduced session authentication tokens which improve security when talking to IMDS.

By default aws_instance resource sets IMDS session auth tokens to be optional.

To fully protect IMDS you need to enable session tokens by using metadata_options block and its http_tokens variable set to required.

See https://avd.aquasec.com/misconfig/avd-aws-0028
────────────────────────────────────────
ec2-oracle_ebs_apps.tf:1-50
────────────────────────────────────────
1 ┌ resource "aws_instance" "ec2_ebsapps" {
2 │ count = local.application_data.accounts[local.environment].ebsapps_no_instances
3 │ instance_type = local.application_data.accounts[local.environment].ec2_oracle_instance_type_ebsapps
4 │ ami = local.application_data.accounts[local.environment]["ebsapps_ami_id-${count.index + 1}"]
5 │ key_name = local.application_data.accounts[local.environment].key_name
6 │ vpc_security_group_ids = [aws_security_group.ec2_sg_ebsapps.id]
7 │ subnet_id = local.private_subnets[count.index]
8 │ #subnet_id = data.aws_subnet.data_subnets_a.id
9 └ monitoring = true
..
────────────────────────────────────────

ec2-oracle_ebs_conc.tf (terraform)

Tests: 1 (SUCCESSES: 0, FAILURES: 1)
Failures: 1 (HIGH: 1, CRITICAL: 0)

AVD-AWS-0131 (HIGH): Root block device is not encrypted.
════════════════════════════════════════
Block devices should be encrypted to ensure sensitive data is held securely at rest.

See https://avd.aquasec.com/misconfig/avd-aws-0131
────────────────────────────────────────
ec2-oracle_ebs_conc.tf:1-48
────────────────────────────────────────
1 ┌ resource "aws_instance" "ec2_oracle_conc" {
2 │ count = local.application_data.accounts[local.environment].conc_no_instances
3 │ instance_type = local.application_data.accounts[local.environment].ec2_oracle_instance_type_ebsconc
4 │ ami = local.application_data.accounts[local.environment].ebsconc_ami_id
5 │ key_name = local.application_data.accounts[local.environment].key_name
6 │ vpc_security_group_ids = [aws_security_group.ec2_sg_ebsconc.id]
7 │ subnet_id = data.aws_subnet.data_subnets_a.id
8 │ monitoring = true
9 └ ebs_optimized = local.application_data.accounts[local.environment].ebs_optimized
..
────────────────────────────────────────

ec2-oracle_ebs_db.tf (terraform)

Tests: 1 (SUCCESSES: 0, FAILURES: 1)
Failures: 1 (HIGH: 1, CRITICAL: 0)

AVD-AWS-0131 (HIGH): Root block device is not encrypted.
════════════════════════════════════════
Block devices should be encrypted to ensure sensitive data is held securely at rest.

See https://avd.aquasec.com/misconfig/avd-aws-0131
────────────────────────────────────────
ec2-oracle_ebs_db.tf:1-48
────────────────────────────────────────
1 ┌ resource "aws_instance" "ec2_oracle_ebs" {
2 │ instance_type = local.application_data.accounts[local.environment].ec2_oracle_instance_type_ebsdb
3 │ #ami = data.aws_ami.oracle_db.id
4 │ ami = local.application_data.accounts[local.environment].ebsdb_ami_id
5 │ key_name = local.application_data.accounts[local.environment].key_name
6 │ vpc_security_group_ids = [aws_security_group.ec2_sg_ebsdb.id]
7 │ subnet_id = data.aws_subnet.data_subnets_a.id
8 │ monitoring = true
9 └ ebs_optimized = false
..
────────────────────────────────────────

ec2-oracle_webgate-alb.tf (terraform)

Tests: 1 (SUCCESSES: 0, FAILURES: 1)
Failures: 1 (HIGH: 1, CRITICAL: 0)

AVD-AWS-0052 (HIGH): Application load balancer is not set to drop invalid headers.
════════════════════════════════════════
Passing unknown or invalid headers through to the target poses a potential risk of compromise.
By setting drop_invalid_header_fields to true, anything that does not conform to well known, defined headers will be removed by the load balancer.

See https://avd.aquasec.com/misconfig/avd-aws-0052
────────────────────────────────────────
ec2-oracle_webgate-alb.tf:1-19
────────────────────────────────────────
1 ┌ resource "aws_lb" "webgate_lb" {
2 │ name = lower(format("lb-%s-webgate", local.application_name))
3 │ internal = true
4 │ load_balancer_type = "application"
5 │ security_groups = [aws_security_group.sg_webgate_lb.id]
6 │ subnets = data.aws_subnets.shared-private.ids
7 │
8 │ enable_deletion_protection = true
9 └
..
────────────────────────────────────────

ec2-oracle_webgate.tf (terraform)

Tests: 1 (SUCCESSES: 0, FAILURES: 1)
Failures: 1 (HIGH: 1, CRITICAL: 0)

AVD-AWS-0028 (HIGH): Instance does not require IMDS access to require a token.
════════════════════════════════════════
IMDS v2 (Instance Metadata Service) introduced session authentication tokens which improve security when talking to IMDS.

By default aws_instance resource sets IMDS session auth tokens to be optional.

To fully protect IMDS you need to enable session tokens by using metadata_options block and its http_tokens variable set to required.

See https://avd.aquasec.com/misconfig/avd-aws-0028
────────────────────────────────────────
ec2-oracle_webgate.tf:1-104
────────────────────────────────────────
1 ┌ resource "aws_instance" "ec2_webgate" {
2 │ count = local.application_data.accounts[local.environment].webgate_no_instances
3 │ instance_type = local.application_data.accounts[local.environment].ec2_oracle_instance_type_webgate
4 │ ami = local.application_data.accounts[local.environment]["webgate_ami_id-${count.index + 1}"]
5 │ key_name = local.application_data.accounts[local.environment].key_name
6 │ vpc_security_group_ids = [aws_security_group.ec2_sg_webgate.id]
7 │ subnet_id = local.private_subnets[count.index]
8 │ #subnet_id = data.aws_subnet.data_subnets_a.id
9 └ monitoring = true
..
────────────────────────────────────────

s3.tf (terraform)

Tests: 4 (SUCCESSES: 0, FAILURES: 4)
Failures: 4 (HIGH: 4, CRITICAL: 0)

AVD-AWS-0086 (HIGH): No public access block so not blocking public acls
════════════════════════════════════════
S3 buckets should block public ACLs on buckets and any objects they contain. By blocking, PUTs with fail if the object has any public ACL a.

See https://avd.aquasec.com/misconfig/avd-aws-0086
────────────────────────────────────────
s3.tf:280-282
────────────────────────────────────────
280 ┌ resource "aws_s3_bucket" "ccms_ebs_shared" {
281 │ bucket = "${local.application_name}-${local.environment}-shared"
282 └ }
────────────────────────────────────────

AVD-AWS-0087 (HIGH): No public access block so not blocking public policies
════════════════════════════════════════
S3 bucket policy should have block public policy to prevent users from putting a policy that enable public access.

See https://avd.aquasec.com/misconfig/avd-aws-0087
────────────────────────────────────────
s3.tf:280-282
────────────────────────────────────────
280 ┌ resource "aws_s3_bucket" "ccms_ebs_shared" {
281 │ bucket = "${local.application_name}-${local.environment}-shared"
282 └ }
────────────────────────────────────────

AVD-AWS-0091 (HIGH): No public access block so not blocking public acls
════════════════════════════════════════
S3 buckets should ignore public ACLs on buckets and any objects they contain. By ignoring rather than blocking, PUT calls with public ACLs will still be applied but the ACL will be ignored.

See https://avd.aquasec.com/misconfig/avd-aws-0091
────────────────────────────────────────
s3.tf:280-282
────────────────────────────────────────
280 ┌ resource "aws_s3_bucket" "ccms_ebs_shared" {
281 │ bucket = "${local.application_name}-${local.environment}-shared"
282 └ }
────────────────────────────────────────

AVD-AWS-0093 (HIGH): No public access block so not restricting public buckets
════════════════════════════════════════
S3 buckets should restrict public policies for the bucket. By enabling, the restrict_public_buckets, only the bucket owner and AWS Services can access if it has a public policy.

See https://avd.aquasec.com/misconfig/avd-aws-0093
────────────────────────────────────────
s3.tf:280-282
────────────────────────────────────────
280 ┌ resource "aws_s3_bucket" "ccms_ebs_shared" {
281 │ bucket = "${local.application_name}-${local.environment}-shared"
282 └ }
────────────────────────────────────────

trivy_exitcode=1

Running Trivy in terraform/environments/ccms-ebs
2024-11-04T13:24:51Z INFO [vuln] Vulnerability scanning is enabled
2024-11-04T13:24:51Z INFO [misconfig] Misconfiguration scanning is enabled
2024-11-04T13:24:51Z INFO [secret] Secret scanning is enabled
2024-11-04T13:24:51Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-11-04T13:24:51Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2024-11-04T13:24:52Z INFO [terraform scanner] Scanning root module file_path="."
2024-11-04T13:24:52Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="networking"
2024-11-04T13:24:52Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_cloudwatch_log_group.groups" value="cty.NilVal"
2024-11-04T13:24:52Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_security_group_rule.all_internal_egress_traffic" value="cty.NilVal"
2024-11-04T13:24:52Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_security_group_rule.all_internal_ingress_traffic" value="cty.NilVal"
2024-11-04T13:24:52Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.s3-bucket.aws_s3_bucket_lifecycle_configuration.default" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_lifecycle_configuration.default.dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-04T13:24:52Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.s3-bucket.aws_s3_bucket_lifecycle_configuration.default" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_lifecycle_configuration.default.dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-04T13:24:52Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.s3-bucket-dbbackup.aws_s3_bucket_lifecycle_configuration.default" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_lifecycle_configuration.default.dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-04T13:24:52Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.s3-bucket-dbbackup.aws_s3_bucket_lifecycle_configuration.default" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_lifecycle_configuration.default.dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-04T13:24:52Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.s3-bucket-logging.aws_s3_bucket_lifecycle_configuration.default" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_lifecycle_configuration.default.dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-04T13:24:52Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.s3-bucket-logging.aws_s3_bucket_lifecycle_configuration.default" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_lifecycle_configuration.default.dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-04T13:24:52Z INFO [terraform scanner] Scanning root module file_path="modules"
2024-11-04T13:24:52Z INFO [terraform scanner] Scanning root module file_path="modules/cw-logs"
2024-11-04T13:24:55Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.1.0/main.tf:171-179"
2024-11-04T13:24:55Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="ccms-iam.tf:283-289"
2024-11-04T13:24:56Z INFO Number of language-specific files num=0
2024-11-04T13:24:56Z INFO Detected config files num=27

ccms-ec2-oracle_accessgate.tf (terraform)

Tests: 1 (SUCCESSES: 0, FAILURES: 1)
Failures: 1 (HIGH: 1, CRITICAL: 0)

AVD-AWS-0028 (HIGH): Instance does not require IMDS access to require a token.
════════════════════════════════════════
IMDS v2 (Instance Metadata Service) introduced session authentication tokens which improve security when talking to IMDS.

By default aws_instance resource sets IMDS session auth tokens to be optional.

To fully protect IMDS you need to enable session tokens by using metadata_options block and its http_tokens variable set to required.

See https://avd.aquasec.com/misconfig/avd-aws-0028
────────────────────────────────────────
ccms-ec2-oracle_accessgate.tf:1-104
────────────────────────────────────────
1 ┌ resource "aws_instance" "ec2_accessgate" {
2 │ count = local.application_data.accounts[local.environment].accessgate_no_instances
3 │ instance_type = local.application_data.accounts[local.environment].ec2_oracle_instance_type_accessgate
4 │ ami = local.application_data.accounts[local.environment]["accessgate_ami_id-${count.index + 1}"]
5 │ key_name = local.application_data.accounts[local.environment].key_name
6 │ vpc_security_group_ids = [aws_security_group.ec2_sg_accessgate.id]
7 │ subnet_id = local.private_subnets[count.index]
8 │ #subnet_id = data.aws_subnet.data_subnets_a.id
9 └ monitoring = true
..
────────────────────────────────────────

ccms-ec2-oracle_ebs_apps-alb.tf (terraform)

Tests: 2 (SUCCESSES: 0, FAILURES: 2)
Failures: 2 (HIGH: 2, CRITICAL: 0)

AVD-AWS-0052 (HIGH): Application load balancer is not set to drop invalid headers.
════════════════════════════════════════
Passing unknown or invalid headers through to the target poses a potential risk of compromise.
By setting drop_invalid_header_fields to true, anything that does not conform to well known, defined headers will be removed by the load balancer.

See https://avd.aquasec.com/misconfig/avd-aws-0052
────────────────────────────────────────
ccms-ec2-oracle_ebs_apps-alb.tf:1-19
────────────────────────────────────────
1 ┌ resource "aws_lb" "ebsapps_lb" {
2 │ name = lower(format("lb-%s-%s-ebsapp", local.application_name, local.environment))
3 │ internal = false
4 │ load_balancer_type = "application"
5 │ security_groups = [aws_security_group.sg_ebsapps_lb.id]
6 │ subnets = data.aws_subnets.shared-public.ids
7 │
8 │ enable_deletion_protection = true
9 └
..
────────────────────────────────────────

AVD-AWS-0053 (HIGH): Load balancer is exposed publicly.
════════════════════════════════════════
There are many scenarios in which you would want to expose a load balancer to the wider internet, but this check exists as a warning to prevent accidental exposure of internal assets. You should ensure that this resource should be exposed publicly.

See https://avd.aquasec.com/misconfig/avd-aws-0053
────────────────────────────────────────
ccms-ec2-oracle_ebs_apps-alb.tf:1-19
────────────────────────────────────────
1 ┌ resource "aws_lb" "ebsapps_lb" {
2 │ name = lower(format("lb-%s-%s-ebsapp", local.application_name, local.environment))
3 │ internal = false
4 │ load_balancer_type = "application"
5 │ security_groups = [aws_security_group.sg_ebsapps_lb.id]
6 │ subnets = data.aws_subnets.shared-public.ids
7 │
8 │ enable_deletion_protection = true
9 └
..
────────────────────────────────────────

ccms-ec2-oracle_ebs_apps-nlb.tf (terraform)

Tests: 1 (SUCCESSES: 0, FAILURES: 1)
Failures: 1 (HIGH: 1, CRITICAL: 0)

AVD-AWS-0053 (HIGH): Load balancer is exposed publicly.
════════════════════════════════════════
There are many scenarios in which you would want to expose a load balancer to the wider internet, but this check exists as a warning to prevent accidental exposure of internal assets. You should ensure that this resource should be exposed publicly.

See https://avd.aquasec.com/misconfig/avd-aws-0053
────────────────────────────────────────
ccms-ec2-oracle_ebs_apps-nlb.tf:16-42
────────────────────────────────────────
16 ┌ resource "aws_lb" "ebsapps_nlb" {
17 │ name = lower(format("nlb-%s-%s-ebs", local.application_name, local.environment))
18 │ internal = false
19 │ load_balancer_type = "network"
20 │
21 │ enable_deletion_protection = true
22 │ enable_cross_zone_load_balancing = true
23 │
24 └ subnet_mapping {
..
────────────────────────────────────────

ccms-ec2-oracle_ebs_apps.tf (terraform)

Tests: 1 (SUCCESSES: 0, FAILURES: 1)
Failures: 1 (HIGH: 1, CRITICAL: 0)

AVD-AWS-0028 (HIGH): Instance does not require IMDS access to require a token.
════════════════════════════════════════
IMDS v2 (Instance Metadata Service) introduced session authentication tokens which improve security when talking to IMDS.

By default aws_instance resource sets IMDS session auth tokens to be optional.

To fully protect IMDS you need to enable session tokens by using metadata_options block and its http_tokens variable set to required.

See https://avd.aquasec.com/misconfig/avd-aws-0028
────────────────────────────────────────
ccms-ec2-oracle_ebs_apps.tf:1-127
────────────────────────────────────────
1 ┌ resource "aws_instance" "ec2_ebsapps" {
2 │ count = local.application_data.accounts[local.environment].ebsapps_no_instances
3 │ instance_type = local.application_data.accounts[local.environment].ec2_oracle_instance_type_ebsapps
4 │ ami = local.application_data.accounts[local.environment]["ebsapps_ami_id-${count.index + 1}"]
5 │ key_name = local.application_data.accounts[local.environment].key_name
6 │ vpc_security_group_ids = [aws_security_group.ec2_sg_ebsapps.id]
7 │ subnet_id = local.private_subnets[count.index]
8 │ #subnet_id = data.aws_subnet.data_subnets_a.id
9 └ monitoring = true
..
────────────────────────────────────────

ccms-ec2-oracle_ebs_db.tf (terraform)

Tests: 1 (SUCCESSES: 0, FAILURES: 1)
Failures: 1 (HIGH: 1, CRITICAL: 0)

AVD-AWS-0131 (HIGH): Root block device is not encrypted.
════════════════════════════════════════
Block devices should be encrypted to ensure sensitive data is held securely at rest.

See https://avd.aquasec.com/misconfig/avd-aws-0131
────────────────────────────────────────
ccms-ec2-oracle_ebs_db.tf:1-68
────────────────────────────────────────
1 ┌ resource "aws_instance" "ec2_oracle_ebs" {
2 │ instance_type = local.application_data.accounts[local.environment].ec2_oracle_instance_type_ebsdb
3 │ #ami = data.aws_ami.oracle_db.id
4 │ ami = local.application_data.accounts[local.environment].ebsdb_ami_id
5 │ key_name = local.application_data.accounts[local.environment].key_name
6 │ vpc_security_group_ids = [aws_security_group.ec2_sg_ebsdb.id]
7 │ subnet_id = data.aws_subnet.data_subnets_a.id
8 │ monitoring = true
9 └ ebs_optimized = false
..
────────────────────────────────────────

ccms-ec2-oracle_webgate-alb.tf (terraform)

Tests: 3 (SUCCESSES: 0, FAILURES: 3)
Failures: 3 (HIGH: 3, CRITICAL: 0)

AVD-AWS-0052 (HIGH): Application load balancer is not set to drop invalid headers.
════════════════════════════════════════
Passing unknown or invalid headers through to the target poses a potential risk of compromise.
By setting drop_invalid_header_fields to true, anything that does not conform to well known, defined headers will be removed by the load balancer.

See https://avd.aquasec.com/misconfig/avd-aws-0052
────────────────────────────────────────
ccms-ec2-oracle_webgate-alb.tf:1-20
────────────────────────────────────────
1 ┌ resource "aws_lb" "webgate_lb" {
2 │ count = local.is-production ? 1 : 1
3 │ name = lower(format("lb-%s-%s-wgate", local.application_name, local.environment))
4 │ internal = true
5 │ load_balancer_type = "application"
6 │ security_groups = [aws_security_group.sg_webgate_lb.id]
7 │ subnets = data.aws_subnets.shared-private.ids
8 │
9 └ enable_deletion_protection = true
..
────────────────────────────────────────

AVD-AWS-0052 (HIGH): Application load balancer is not set to drop invalid headers.
════════════════════════════════════════
Passing unknown or invalid headers through to the target poses a potential risk of compromise.
By setting drop_invalid_header_fields to true, anything that does not conform to well known, defined headers will be removed by the load balancer.

See https://avd.aquasec.com/misconfig/avd-aws-0052
────────────────────────────────────────
ccms-ec2-oracle_webgate-alb.tf:62-80
────────────────────────────────────────
62 ┌ resource "aws_lb" "webgate_public_lb" {
63 │ name = lower(format("public-alb-webgate"))
64 │ internal = false
65 │ load_balancer_type = "application"
66 │ security_groups = [aws_security_group.sg_webgate_lb.id]
67 │ subnets = data.aws_subnets.shared-public.ids
68 │
69 │ enable_deletion_protection = true
70 └
..
────────────────────────────────────────

AVD-AWS-0053 (HIGH): Load balancer is exposed publicly.
════════════════════════════════════════
There are many scenarios in which you would want to expose a load balancer to the wider internet, but this check exists as a warning to prevent accidental exposure of internal assets. You should ensure that this resource should be exposed publicly.

See https://avd.aquasec.com/misconfig/avd-aws-0053
────────────────────────────────────────
ccms-ec2-oracle_webgate-alb.tf:62-80
────────────────────────────────────────
62 ┌ resource "aws_lb" "webgate_public_lb" {
63 │ name = lower(format("public-alb-webgate"))
64 │ internal = false
65 │ load_balancer_type = "application"
66 │ security_groups = [aws_security_group.sg_webgate_lb.id]
67 │ subnets = data.aws_subnets.shared-public.ids
68 │
69 │ enable_deletion_protection = true
70 └
..
────────────────────────────────────────

ccms-ec2-oracle_webgate-nlb.tf (terraform)

Tests: 1 (SUCCESSES: 0, FAILURES: 1)
Failures: 1 (HIGH: 1, CRITICAL: 0)

AVD-AWS-0053 (HIGH): Load balancer is exposed publicly.
════════════════════════════════════════
There are many scenarios in which you would want to expose a load balancer to the wider internet, but this check exists as a warning to prevent accidental exposure of internal assets. You should ensure that this resource should be exposed publicly.

See https://avd.aquasec.com/misconfig/avd-aws-0053
────────────────────────────────────────
ccms-ec2-oracle_webgate-nlb.tf:16-42
────────────────────────────────────────
16 ┌ resource "aws_lb" "webgate_nlb" {
17 │ name = lower(format("public-nlb-webgate"))
18 │ internal = false
19 │ load_balancer_type = "network"
20 │
21 │ enable_deletion_protection = true
22 │ enable_cross_zone_load_balancing = true
23 │
24 └ subnet_mapping {
..
────────────────────────────────────────

ccms-ec2-oracle_webgate.tf (terraform)

Tests: 1 (SUCCESSES: 0, FAILURES: 1)
Failures: 1 (HIGH: 1, CRITICAL: 0)

AVD-AWS-0028 (HIGH): Instance does not require IMDS access to require a token.
════════════════════════════════════════
IMDS v2 (Instance Metadata Service) introduced session authentication tokens which improve security when talking to IMDS.

By default aws_instance resource sets IMDS session auth tokens to be optional.

To fully protect IMDS you need to enable session tokens by using metadata_options block and its http_tokens variable set to required.

See https://avd.aquasec.com/misconfig/avd-aws-0028
────────────────────────────────────────
ccms-ec2-oracle_webgate.tf:1-104
────────────────────────────────────────
1 ┌ resource "aws_instance" "ec2_webgate" {
2 │ count = local.application_data.accounts[local.environment].webgate_no_instances
3 │ instance_type = local.application_data.accounts[local.environment].ec2_oracle_instance_type_webgate
4 │ ami = local.application_data.accounts[local.environment]["webgate_ami_id-${count.index + 1}"]
5 │ key_name = local.application_data.accounts[local.environment].key_name
6 │ vpc_security_group_ids = [aws_security_group.ec2_sg_webgate.id]
7 │ subnet_id = local.private_subnets[count.index]
8 │ #subnet_id = data.aws_subnet.data_subnets_a.id
9 └ monitoring = true
..
────────────────────────────────────────

ccms-s3.tf (terraform)

Tests: 8 (SUCCESSES: 0, FAILURES: 8)
Failures: 8 (HIGH: 8, CRITICAL: 0)

AVD-AWS-0086 (HIGH): No public access block so not blocking public acls
════════════════════════════════════════
S3 buckets should block public ACLs on buckets and any objects they contain. By blocking, PUTs with fail if the object has any public ACL a.

See https://avd.aquasec.com/misconfig/avd-aws-0086
────────────────────────────────────────
ccms-s3.tf:286-288
────────────────────────────────────────
286 ┌ resource "aws_s3_bucket" "ccms_ebs_shared" {
287 │ bucket = "${local.application_name}-${local.environment}-shared"
288 └ }
────────────────────────────────────────

AVD-AWS-0086 (HIGH): No public access block so not blocking public acls
════════════════════════════════════════
S3 buckets should block public ACLs on buckets and any objects they contain. By blocking, PUTs with fail if the object has any public ACL a.

See https://avd.aquasec.com/misconfig/avd-aws-0086
────────────────────────────────────────
ccms-s3.tf:293-295
────────────────────────────────────────
293 ┌ resource "aws_s3_bucket" "lambda_payment_load" {
294 │ bucket = "${local.application_name}-${local.environment}-payment-load"
295 └ }
────────────────────────────────────────

AVD-AWS-0087 (HIGH): No public access block so not blocking public policies
════════════════════════════════════════
S3 bucket policy should have block public policy to prevent users from putting a policy that enable public access.

See https://avd.aquasec.com/misconfig/avd-aws-0087
────────────────────────────────────────
ccms-s3.tf:286-288
────────────────────────────────────────
286 ┌ resource "aws_s3_bucket" "ccms_ebs_shared" {
287 │ bucket = "${local.application_name}-${local.environment}-shared"
288 └ }
────────────────────────────────────────

AVD-AWS-0087 (HIGH): No public access block so not blocking public policies
════════════════════════════════════════
S3 bucket policy should have block public policy to prevent users from putting a policy that enable public access.

See https://avd.aquasec.com/misconfig/avd-aws-0087
────────────────────────────────────────
ccms-s3.tf:293-295
────────────────────────────────────────
293 ┌ resource "aws_s3_bucket" "lambda_payment_load" {
294 │ bucket = "${local.application_name}-${local.environment}-payment-load"
295 └ }
────────────────────────────────────────

AVD-AWS-0091 (HIGH): No public access block so not blocking public acls
════════════════════════════════════════
S3 buckets should ignore public ACLs on buckets and any objects they contain. By ignoring rather than blocking, PUT calls with public ACLs will still be applied but the ACL will be ignored.

See https://avd.aquasec.com/misconfig/avd-aws-0091
────────────────────────────────────────
ccms-s3.tf:286-288
────────────────────────────────────────
286 ┌ resource "aws_s3_bucket" "ccms_ebs_shared" {
287 │ bucket = "${local.application_name}-${local.environment}-shared"
288 └ }
────────────────────────────────────────

AVD-AWS-0091 (HIGH): No public access block so not blocking public acls
════════════════════════════════════════
S3 buckets should ignore public ACLs on buckets and any objects they contain. By ignoring rather than blocking, PUT calls with public ACLs will still be applied but the ACL will be ignored.

See https://avd.aquasec.com/misconfig/avd-aws-0091
────────────────────────────────────────
ccms-s3.tf:293-295
────────────────────────────────────────
293 ┌ resource "aws_s3_bucket" "lambda_payment_load" {
294 │ bucket = "${local.application_name}-${local.environment}-payment-load"
295 └ }
────────────────────────────────────────

AVD-AWS-0093 (HIGH): No public access block so not restricting public buckets
════════════════════════════════════════
S3 buckets should restrict public policies for the bucket. By enabling, the restrict_public_buckets, only the bucket owner and AWS Services can access if it has a public policy.

See https://avd.aquasec.com/misconfig/avd-aws-0093
────────────────────────────────────────
ccms-s3.tf:286-288
────────────────────────────────────────
286 ┌ resource "aws_s3_bucket" "ccms_ebs_shared" {
287 │ bucket = "${local.application_name}-${local.environment}-shared"
288 └ }
────────────────────────────────────────

AVD-AWS-0093 (HIGH): No public access block so not restricting public buckets
════════════════════════════════════════
S3 buckets should restrict public policies for the bucket. By enabling, the restrict_public_buckets, only the bucket owner and AWS Services can access if it has a public policy.

See https://avd.aquasec.com/misconfig/avd-aws-0093
────────────────────────────────────────
ccms-s3.tf:293-295
────────────────────────────────────────
293 ┌ resource "aws_s3_bucket" "lambda_payment_load" {
294 │ bucket = "${local.application_name}-${local.environment}-payment-load"
295 └ }
────────────────────────────────────────

trivy_exitcode=2

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/ccms-ebs-upgrade
terraform/environments/ccms-ebs

*****************************

Running Checkov in terraform/environments/ccms-ebs-upgrade
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2024-11-04 13:24:59,681 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0:None (for external modules, the --download-external-modules flag is required)
2024-11-04 13:24:59,681 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.1.0:None (for external modules, the --download-external-modules flag is required)
2024-11-04 13:24:59,711 [MainThread  ] [WARNI]  [ArmLocalGraph] created 0 vertices
2024-11-04 13:24:59,712 [MainThread  ] [WARNI]  [ArmLocalGraph] created 0 edges
terraform scan results:

Passed checks: 795, Failed checks: 42, Skipped checks: 0

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.cloudwatch_datasource
	File: /cloudwatch.tf:54-106
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.groups
	File: /cloudwatch.tf:15-26
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		15 | resource "aws_cloudwatch_log_group" "groups" {
		16 |   for_each          = local.application_data.cw_log_groups
		17 |   name              = each.key
		18 |   retention_in_days = each.value.retention_days
		19 | 
		20 |   tags = merge(
		21 |     local.tags,
		22 |     {
		23 |       Name = each.key
		24 |     },
		25 |   )
		26 | }

Check: CKV_AWS_355: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_role_policy.dlm_lifecycle
	File: /dlm.tf:24-53
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-355

		24 | resource "aws_iam_role_policy" "dlm_lifecycle" {
		25 |   count = local.is-production ? 0 : 1
		26 |   name  = "dlm-lifecycle-policy"
		27 |   role  = aws_iam_role.dlm_lifecycle_role[0].id
		28 | 
		29 |   policy = <<EOF
		30 | {
		31 |    "Version": "2012-10-17",
		32 |    "Statement": [
		33 |       {
		34 |          "Effect": "Allow",
		35 |          "Action": [
		36 |             "ec2:CreateSnapshot",
		37 |             "ec2:DeleteSnapshot",
		38 |             "ec2:DescribeVolumes",
		39 |             "ec2:DescribeSnapshots"
		40 |          ],
		41 |          "Resource": "*"
		42 |       },
		43 |       {
		44 |          "Effect": "Allow",
		45 |          "Action": [
		46 |             "ec2:CreateTags"
		47 |          ],
		48 |          "Resource": "arn:aws:ec2:*::snapshot/*"
		49 |       }
		50 |    ]
		51 | }
		52 | EOF
		53 | }

Check: CKV_AWS_290: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_role_policy.dlm_lifecycle
	File: /dlm.tf:24-53
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-290

		24 | resource "aws_iam_role_policy" "dlm_lifecycle" {
		25 |   count = local.is-production ? 0 : 1
		26 |   name  = "dlm-lifecycle-policy"
		27 |   role  = aws_iam_role.dlm_lifecycle_role[0].id
		28 | 
		29 |   policy = <<EOF
		30 | {
		31 |    "Version": "2012-10-17",
		32 |    "Statement": [
		33 |       {
		34 |          "Effect": "Allow",
		35 |          "Action": [
		36 |             "ec2:CreateSnapshot",
		37 |             "ec2:DeleteSnapshot",
		38 |             "ec2:DescribeVolumes",
		39 |             "ec2:DescribeSnapshots"
		40 |          ],
		41 |          "Resource": "*"
		42 |       },
		43 |       {
		44 |          "Effect": "Allow",
		45 |          "Action": [
		46 |             "ec2:CreateTags"
		47 |          ],
		48 |          "Resource": "arn:aws:ec2:*::snapshot/*"
		49 |       }
		50 |    ]
		51 | }
		52 | EOF
		53 | }

Check: CKV_AWS_79: "Ensure Instance Metadata Service Version 1 is not enabled"
	FAILED for resource: aws_instance.ec2_accessgate
	File: /ec2-oracle_accessgate.tf:1-104
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-general-31

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_135: "Ensure that EC2 is EBS optimized"
	FAILED for resource: aws_instance.ec2_accessgate
	File: /ec2-oracle_accessgate.tf:1-104
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-ec2-is-ebs-optimized

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_131: "Ensure that ALB drops HTTP headers"
	FAILED for resource: aws_lb.ebsapps_lb
	File: /ec2-oracle_ebs_apps-alb.tf:1-19
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-alb-drops-http-headers

		1  | resource "aws_lb" "ebsapps_lb" {
		2  |   name               = lower(format("lb-%s-ebsapp", local.application_name))
		3  |   internal           = true
		4  |   load_balancer_type = "application"
		5  |   security_groups    = [aws_security_group.sg_ebsapps_lb.id]
		6  |   subnets            = data.aws_subnets.shared-private.ids
		7  | 
		8  |   enable_deletion_protection = true
		9  | 
		10 |   access_logs {
		11 |     bucket  = module.s3-bucket-logging.bucket.id
		12 |     prefix  = local.lb_log_prefix_ebsapp
		13 |     enabled = true
		14 |   }
		15 | 
		16 |   tags = merge(local.tags,
		17 |     { Name = lower(format("lb-%s-ebsapp", local.application_name)) }
		18 |   )
		19 | }

Check: CKV_AWS_378: "Ensure AWS Load Balancer doesn't use HTTP protocol"
	FAILED for resource: aws_lb_target_group.ebsapp_tg
	File: /ec2-oracle_ebs_apps-alb.tf:38-53

		38 | resource "aws_lb_target_group" "ebsapp_tg" {
		39 |   name     = lower(format("tg-%s-ebsapp", local.application_name))
		40 |   port     = local.application_data.accounts[local.environment].tg_apps_port
		41 |   protocol = "HTTP"
		42 |   vpc_id   = data.aws_vpc.shared.id
		43 |   health_check {
		44 |     port     = local.application_data.accounts[local.environment].tg_apps_port
		45 |     protocol = "HTTP"
		46 |   }
		47 | 
		48 |   stickiness {
		49 |     enabled         = true
		50 |     type            = "lb_cookie"
		51 |     cookie_duration = 3600
		52 |   }
		53 | }

Check: CKV_AWS_261: "Ensure HTTP HTTPS Target group defines Healthcheck"
	FAILED for resource: aws_lb_target_group.ebsapp_tg
	File: /ec2-oracle_ebs_apps-alb.tf:38-53
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-kendra-index-server-side-encryption-uses-customer-managed-keys-cmks

		38 | resource "aws_lb_target_group" "ebsapp_tg" {
		39 |   name     = lower(format("tg-%s-ebsapp", local.application_name))
		40 |   port     = local.application_data.accounts[local.environment].tg_apps_port
		41 |   protocol = "HTTP"
		42 |   vpc_id   = data.aws_vpc.shared.id
		43 |   health_check {
		44 |     port     = local.application_data.accounts[local.environment].tg_apps_port
		45 |     protocol = "HTTP"
		46 |   }
		47 | 
		48 |   stickiness {
		49 |     enabled         = true
		50 |     type            = "lb_cookie"
		51 |     cookie_duration = 3600
		52 |   }
		53 | }

Check: CKV_AWS_79: "Ensure Instance Metadata Service Version 1 is not enabled"
	FAILED for resource: aws_instance.ec2_ebsapps
	File: /ec2-oracle_ebs_apps.tf:1-50
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-general-31

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_135: "Ensure that EC2 is EBS optimized"
	FAILED for resource: aws_instance.ec2_ebsapps
	File: /ec2-oracle_ebs_apps.tf:1-50
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-ec2-is-ebs-optimized

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_135: "Ensure that EC2 is EBS optimized"
	FAILED for resource: aws_instance.ec2_oracle_conc
	File: /ec2-oracle_ebs_conc.tf:1-48
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-ec2-is-ebs-optimized

		1  | resource "aws_instance" "ec2_oracle_conc" {
		2  |   count                       = local.application_data.accounts[local.environment].conc_no_instances
		3  |   instance_type               = local.application_data.accounts[local.environment].ec2_oracle_instance_type_ebsconc
		4  |   ami                         = local.application_data.accounts[local.environment].ebsconc_ami_id
		5  |   key_name                    = local.application_data.accounts[local.environment].key_name
		6  |   vpc_security_group_ids      = [aws_security_group.ec2_sg_ebsconc.id]
		7  |   subnet_id                   = data.aws_subnet.data_subnets_a.id
		8  |   monitoring                  = true
		9  |   ebs_optimized               = local.application_data.accounts[local.environment].ebs_optimized
		10 |   associate_public_ip_address = false
		11 |   iam_instance_profile        = aws_iam_instance_profile.iam_instace_profile_ccms_base.name
		12 | 
		13 |   cpu_core_count       = local.application_data.accounts[local.environment].ec2_oracle_instance_cores_ebsconc
		14 |   cpu_threads_per_core = local.application_data.accounts[local.environment].ec2_oracle_instance_threads_ebsconc
		15 | 
		16 |   # Due to a bug in terraform wanting to rebuild the ec2 if more than 1 ebs block is attached, we need the lifecycle clause below.
		17 |   #lifecycle {
		18 |   #  ignore_changes = [ebs_block_device]
		19 |   #}
		20 |   lifecycle {
		21 |     ignore_changes = [
		22 |       cpu_core_count,
		23 |       ebs_block_device,
		24 |       ebs_optimized,
		25 |       user_data,
		26 |       user_data_replace_on_change
		27 |     ]
		28 |   }
		29 |   user_data_replace_on_change = false
		30 |   user_data = base64encode(templatefile("./templates/ec2_user_data_ebs.sh", {
		31 |     environment = "${local.environment}"
		32 |     hostname    = "ebs"
		33 |   }))
		34 | 
		35 |   metadata_options {
		36 |     http_endpoint = "enabled"
		37 |     http_tokens   = "required"
		38 |   }
		39 | 
		40 |   tags = merge(local.tags,
		41 |     { Name = lower(format("ec2-%s-%s-ebsconc", local.application_name, local.environment)) },
		42 |     { instance-scheduling = local.application_data.accounts[local.environment].instance-scheduling-ebsconc },
		43 |     { instance-role = local.application_data.accounts[local.environment].instance_role_ebsconc },
		44 |     { backup = "true" },
		45 |     { OracleDbLTS-ManagedInstance = "true" }
		46 |   )
		47 |   depends_on = [aws_security_group.ec2_sg_ebsconc]
		48 | }

Check: CKV_AWS_8: "Ensure all data stored in the Launch configuration or instance Elastic Blocks Store is securely encrypted"
	FAILED for resource: aws_instance.ec2_oracle_conc
	File: /ec2-oracle_ebs_conc.tf:1-48
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-13

		1  | resource "aws_instance" "ec2_oracle_conc" {
		2  |   count                       = local.application_data.accounts[local.environment].conc_no_instances
		3  |   instance_type               = local.application_data.accounts[local.environment].ec2_oracle_instance_type_ebsconc
		4  |   ami                         = local.application_data.accounts[local.environment].ebsconc_ami_id
		5  |   key_name                    = local.application_data.accounts[local.environment].key_name
		6  |   vpc_security_group_ids      = [aws_security_group.ec2_sg_ebsconc.id]
		7  |   subnet_id                   = data.aws_subnet.data_subnets_a.id
		8  |   monitoring                  = true
		9  |   ebs_optimized               = local.application_data.accounts[local.environment].ebs_optimized
		10 |   associate_public_ip_address = false
		11 |   iam_instance_profile        = aws_iam_instance_profile.iam_instace_profile_ccms_base.name
		12 | 
		13 |   cpu_core_count       = local.application_data.accounts[local.environment].ec2_oracle_instance_cores_ebsconc
		14 |   cpu_threads_per_core = local.application_data.accounts[local.environment].ec2_oracle_instance_threads_ebsconc
		15 | 
		16 |   # Due to a bug in terraform wanting to rebuild the ec2 if more than 1 ebs block is attached, we need the lifecycle clause below.
		17 |   #lifecycle {
		18 |   #  ignore_changes = [ebs_block_device]
		19 |   #}
		20 |   lifecycle {
		21 |     ignore_changes = [
		22 |       cpu_core_count,
		23 |       ebs_block_device,
		24 |       ebs_optimized,
		25 |       user_data,
		26 |       user_data_replace_on_change
		27 |     ]
		28 |   }
		29 |   user_data_replace_on_change = false
		30 |   user_data = base64encode(templatefile("./templates/ec2_user_data_ebs.sh", {
		31 |     environment = "${local.environment}"
		32 |     hostname    = "ebs"
		33 |   }))
		34 | 
		35 |   metadata_options {
		36 |     http_endpoint = "enabled"
		37 |     http_tokens   = "required"
		38 |   }
		39 | 
		40 |   tags = merge(local.tags,
		41 |     { Name = lower(format("ec2-%s-%s-ebsconc", local.application_name, local.environment)) },
		42 |     { instance-scheduling = local.application_data.accounts[local.environment].instance-scheduling-ebsconc },
		43 |     { instance-role = local.application_data.accounts[local.environment].instance_role_ebsconc },
		44 |     { backup = "true" },
		45 |     { OracleDbLTS-ManagedInstance = "true" }
		46 |   )
		47 |   depends_on = [aws_security_group.ec2_sg_ebsconc]
		48 | }

Check: CKV_AWS_135: "Ensure that EC2 is EBS optimized"
	FAILED for resource: aws_instance.ec2_oracle_ebs
	File: /ec2-oracle_ebs_db.tf:1-48
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-ec2-is-ebs-optimized

		1  | resource "aws_instance" "ec2_oracle_ebs" {
		2  |   instance_type = local.application_data.accounts[local.environment].ec2_oracle_instance_type_ebsdb
		3  |   #ami                         = data.aws_ami.oracle_db.id
		4  |   ami                         = local.application_data.accounts[local.environment].ebsdb_ami_id
		5  |   key_name                    = local.application_data.accounts[local.environment].key_name
		6  |   vpc_security_group_ids      = [aws_security_group.ec2_sg_ebsdb.id]
		7  |   subnet_id                   = data.aws_subnet.data_subnets_a.id
		8  |   monitoring                  = true
		9  |   ebs_optimized               = false
		10 |   associate_public_ip_address = false
		11 |   iam_instance_profile        = aws_iam_instance_profile.iam_instace_profile_ccms_base.name
		12 | 
		13 |   cpu_core_count       = local.application_data.accounts[local.environment].ec2_oracle_instance_cores_ebsdb
		14 |   cpu_threads_per_core = local.application_data.accounts[local.environment].ec2_oracle_instance_threads_ebsdb
		15 | 
		16 |   # Due to a bug in terraform wanting to rebuild the ec2 if more than 1 ebs block is attached, we need the lifecycle clause below.
		17 |   #lifecycle {
		18 |   #  ignore_changes = [ebs_block_device]
		19 |   #}
		20 |   lifecycle {
		21 |     ignore_changes = [
		22 |       cpu_core_count,
		23 |       ebs_block_device,
		24 |       ebs_optimized,
		25 |       user_data,
		26 |       user_data_replace_on_change
		27 |     ]
		28 |   }
		29 |   user_data_replace_on_change = false
		30 |   user_data = base64encode(templatefile("./templates/ec2_user_data_ebs.sh", {
		31 |     environment = "${local.environment}"
		32 |     hostname    = "ebs"
		33 |   }))
		34 | 
		35 |   metadata_options {
		36 |     http_endpoint = "enabled"
		37 |     http_tokens   = "required"
		38 |   }
		39 | 
		40 |   tags = merge(local.tags,
		41 |     { Name = lower(format("ec2-%s-%s-ebsdb", local.application_name, local.environment)) },
		42 |     { instance-role = local.application_data.accounts[local.environment].instance_role_ebsdb },
		43 |     { instance-scheduling = local.application_data.accounts[local.environment].instance-scheduling-ebsdb },
		44 |     { backup = "true" },
		45 |     { OracleDbLTS-ManagedInstance = "true" }
		46 |   )
		47 |   depends_on = [aws_security_group.ec2_sg_ebsdb]
		48 | }

Check: CKV_AWS_8: "Ensure all data stored in the Launch configuration or instance Elastic Blocks Store is securely encrypted"
	FAILED for resource: aws_instance.ec2_oracle_ebs
	File: /ec2-oracle_ebs_db.tf:1-48
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-13

		1  | resource "aws_instance" "ec2_oracle_ebs" {
		2  |   instance_type = local.application_data.accounts[local.environment].ec2_oracle_instance_type_ebsdb
		3  |   #ami                         = data.aws_ami.oracle_db.id
		4  |   ami                         = local.application_data.accounts[local.environment].ebsdb_ami_id
		5  |   key_name                    = local.application_data.accounts[local.environment].key_name
		6  |   vpc_security_group_ids      = [aws_security_group.ec2_sg_ebsdb.id]
		7  |   subnet_id                   = data.aws_subnet.data_subnets_a.id
		8  |   monitoring                  = true
		9  |   ebs_optimized               = false
		10 |   associate_public_ip_address = false
		11 |   iam_instance_profile        = aws_iam_instance_profile.iam_instace_profile_ccms_base.name
		12 | 
		13 |   cpu_core_count       = local.application_data.accounts[local.environment].ec2_oracle_instance_cores_ebsdb
		14 |   cpu_threads_per_core = local.application_data.accounts[local.environment].ec2_oracle_instance_threads_ebsdb
		15 | 
		16 |   # Due to a bug in terraform wanting to rebuild the ec2 if more than 1 ebs block is attached, we need the lifecycle clause below.
		17 |   #lifecycle {
		18 |   #  ignore_changes = [ebs_block_device]
		19 |   #}
		20 |   lifecycle {
		21 |     ignore_changes = [
		22 |       cpu_core_count,
		23 |       ebs_block_device,
		24 |       ebs_optimized,
		25 |       user_data,
		26 |       user_data_replace_on_change
		27 |     ]
		28 |   }
		29 |   user_data_replace_on_change = false
		30 |   user_data = base64encode(templatefile("./templates/ec2_user_data_ebs.sh", {
		31 |     environment = "${local.environment}"
		32 |     hostname    = "ebs"
		33 |   }))
		34 | 
		35 |   metadata_options {
		36 |     http_endpoint = "enabled"
		37 |     http_tokens   = "required"
		38 |   }
		39 | 
		40 |   tags = merge(local.tags,
		41 |     { Name = lower(format("ec2-%s-%s-ebsdb", local.application_name, local.environment)) },
		42 |     { instance-role = local.application_data.accounts[local.environment].instance_role_ebsdb },
		43 |     { instance-scheduling = local.application_data.accounts[local.environment].instance-scheduling-ebsdb },
		44 |     { backup = "true" },
		45 |     { OracleDbLTS-ManagedInstance = "true" }
		46 |   )
		47 |   depends_on = [aws_security_group.ec2_sg_ebsdb]
		48 | }

Check: CKV_AWS_131: "Ensure that ALB drops HTTP headers"
	FAILED for resource: aws_lb.webgate_lb
	File: /ec2-oracle_webgate-alb.tf:1-19
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-alb-drops-http-headers

		1  | resource "aws_lb" "webgate_lb" {
		2  |   name               = lower(format("lb-%s-webgate", local.application_name))
		3  |   internal           = true
		4  |   load_balancer_type = "application"
		5  |   security_groups    = [aws_security_group.sg_webgate_lb.id]
		6  |   subnets            = data.aws_subnets.shared-private.ids
		7  | 
		8  |   enable_deletion_protection = true
		9  | 
		10 |   access_logs {
		11 |     bucket  = module.s3-bucket-logging.bucket.id
		12 |     prefix  = local.lb_log_prefix_wgate_public
		13 |     enabled = true
		14 |   }
		15 | 
		16 |   tags = merge(local.tags,
		17 |     { Name = lower(format("lb-%s-webgate", local.application_name)) }
		18 |   )
		19 | }

Check: CKV_AWS_378: "Ensure AWS Load Balancer doesn't use HTTP protocol"
	FAILED for resource: aws_lb_target_group.webgate_tg
	File: /ec2-oracle_webgate-alb.tf:38-49

		38 | resource "aws_lb_target_group" "webgate_tg" {
		39 |   name     = lower(format("tg-%s-webgate", local.application_name))
		40 |   port     = 5401
		41 |   protocol = "HTTP"
		42 |   vpc_id   = data.aws_vpc.shared.id
		43 |   health_check {
		44 |     port     = 5401
		45 |     protocol = "HTTP"
		46 |     matcher  = 302
		47 |     timeout  = 10
		48 |   }
		49 | }

Check: CKV_AWS_261: "Ensure HTTP HTTPS Target group defines Healthcheck"
	FAILED for resource: aws_lb_target_group.webgate_tg
	File: /ec2-oracle_webgate-alb.tf:38-49
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-kendra-index-server-side-encryption-uses-customer-managed-keys-cmks

		38 | resource "aws_lb_target_group" "webgate_tg" {
		39 |   name     = lower(format("tg-%s-webgate", local.application_name))
		40 |   port     = 5401
		41 |   protocol = "HTTP"
		42 |   vpc_id   = data.aws_vpc.shared.id
		43 |   health_check {
		44 |     port     = 5401
		45 |     protocol = "HTTP"
		46 |     matcher  = 302
		47 |     timeout  = 10
		48 |   }
		49 | }

Check: CKV_AWS_79: "Ensure Instance Metadata Service Version 1 is not enabled"
	FAILED for resource: aws_instance.ec2_webgate
	File: /ec2-oracle_webgate.tf:1-104
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-general-31

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_135: "Ensure that EC2 is EBS optimized"
	FAILED for resource: aws_instance.ec2_webgate
	File: /ec2-oracle_webgate.tf:1-104
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-ec2-is-ebs-optimized

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_184: "Ensure resource is encrypted by KMS using a customer managed Key (CMK)"
	FAILED for resource: aws_efs_file_system.appshare
	File: /efs.tf:1-8
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-general-104

		1 | resource "aws_efs_file_system" "appshare" {
		2 |   encrypted        = true
		3 |   throughput_mode  = "bursting"
		4 |   performance_mode = "maxIO"
		5 |   tags = merge(local.tags,
		6 |     { Name = "appshare" }
		7 |   )
		8 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: aws_security_group.efs-security-group
	File: /efs.tf:34-63
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		34 | resource "aws_security_group" "efs-security-group" {
		35 |   name_prefix = "efs-security-group"
		36 |   description = "allow inbound access from ebsdb and ebsconc"
		37 |   vpc_id      = data.aws_vpc.shared.id
		38 | 
		39 |   # Allow inbound access from container instances	
		40 |   ingress {
		41 |     protocol  = "tcp"
		42 |     from_port = 2049
		43 |     to_port   = 2049
		44 |     cidr_blocks = [
		45 |       data.aws_subnet.data_subnets_a.cidr_block,
		46 |       data.aws_subnet.data_subnets_b.cidr_block,
		47 |       data.aws_subnet.data_subnets_c.cidr_block,
		48 |     ]
		49 |   }
		50 | 
		51 |   egress {
		52 |     protocol  = "-1"
		53 |     from_port = 0
		54 |     to_port   = 0
		55 |     cidr_blocks = [
		56 |       "0.0.0.0/0",
		57 |     ]
		58 |   }
		59 | 
		60 |   tags = merge(local.tags,
		61 |     { Name = lower(format("sg-%s-%s-efs", local.application_name, local.environment)) }
		62 |   )
		63 | }

Check: CKV_AWS_355: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy.ec2_operations_policy
	File: /iam.tf:249-273
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-355

		249 | resource "aws_iam_policy" "ec2_operations_policy" {
		250 |   name        = "ec2_operations-${local.environment}"
		251 |   description = "Allows EC2 operations."
		252 | 
		253 |   policy = jsonencode(
		254 |     {
		255 |       "Version" : "2012-10-17",
		256 |       "Statement" : [
		257 |         {
		258 |           "Sid" : "EC2Operations",
		259 |           "Effect" : "Allow",
		260 |           "Action" : [
		261 |             "ec2:Describe*",
		262 |             "ec2:CreateSnapshot",
		263 |             "ec2:CreateSnapshots",
		264 |             "ec2:DeleteSnapshot",
		265 |             "ec2:CreateTags",
		266 |             "ec2:DeleteTags"
		267 |           ],
		268 |           "Resource" : "*"
		269 |         }
		270 |       ]
		271 |     }
		272 |   )
		273 | }

Check: CKV_AWS_290: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy.ec2_operations_policy
	File: /iam.tf:249-273
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-290

		249 | resource "aws_iam_policy" "ec2_operations_policy" {
		250 |   name        = "ec2_operations-${local.environment}"
		251 |   description = "Allows EC2 operations."
		252 | 
		253 |   policy = jsonencode(
		254 |     {
		255 |       "Version" : "2012-10-17",
		256 |       "Statement" : [
		257 |         {
		258 |           "Sid" : "EC2Operations",
		259 |           "Effect" : "Allow",
		260 |           "Action" : [
		261 |             "ec2:Describe*",
		262 |             "ec2:CreateSnapshot",
		263 |             "ec2:CreateSnapshots",
		264 |             "ec2:DeleteSnapshot",
		265 |             "ec2:CreateTags",
		266 |             "ec2:DeleteTags"
		267 |           ],
		268 |           "Resource" : "*"
		269 |         }
		270 |       ]
		271 |     }
		272 |   )
		273 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: s3-bucket
	File: /s3.tf:2-69
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: s3-bucket-logging
	File: /s3.tf:96-162
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: s3-bucket-dbbackup
	File: /s3.tf:186-252
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_365: "Ensure SES Configuration Set enforces TLS usage"
	FAILED for resource: aws_ses_configuration_set.default_configuration_set
	File: /ses.tf:35-43
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/bc-aws-365

		35 | resource "aws_ses_configuration_set" "default_configuration_set" {
		36 |   name = "default-configuration-set"
		37 | 
		38 |   delivery_options {
		39 |     tls_policy = "Optional"
		40 |   }
		41 |   reputation_metrics_enabled = true
		42 |   sending_enabled            = true
		43 | }

Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.support_email_account
	File: /sns.tf:2-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		2 | resource "aws_secretsmanager_secret" "support_email_account" {
		3 |   name                    = "support_email_account"
		4 |   description             = "email address of the support account for cw alerts"
		5 |   recovery_window_in_days = local.is-production ? 30 : 0
		6 | }

Check: CKV_AWS_26: "Ensure all data stored in the SNS topic is encrypted"
	FAILED for resource: aws_sns_topic.cw_alerts
	File: /sns.tf:18-21
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-15

		18 | resource "aws_sns_topic" "cw_alerts" {
		19 |   name = "ccms-ebs-ec2-alerts"
		20 |   #kms_master_key_id = "alias/aws/sns"
		21 | }

Check: CKV_AWS_26: "Ensure all data stored in the SNS topic is encrypted"
	FAILED for resource: aws_sns_topic.s3_topic
	File: /sns.tf:35-38
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-15

		35 | resource "aws_sns_topic" "s3_topic" {
		36 |   name   = "s3-event-notification-topic"
		37 |   policy = data.aws_iam_policy_document.s3_topic_policy.json
		38 | }

Check: CKV_AWS_26: "Ensure all data stored in the SNS topic is encrypted"
	FAILED for resource: aws_sns_topic.ddos_alarm
	File: /sns.tf:52-55
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-15

		52 | resource "aws_sns_topic" "ddos_alarm" {
		53 |   name = format("%s_ddos_alarm", local.application_name)
		54 |   #kms_master_key_id = "alias/aws/sns"
		55 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.support_email_account
	File: /sns.tf:2-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		2 | resource "aws_secretsmanager_secret" "support_email_account" {
		3 |   name                    = "support_email_account"
		4 |   description             = "email address of the support account for cw alerts"
		5 |   recovery_window_in_days = local.is-production ? 30 : 0
		6 | }

Check: CKV2_AWS_62: "Ensure S3 buckets should have event notifications enabled"
	FAILED for resource: aws_s3_bucket.ccms_ebs_shared
	File: /s3.tf:280-282
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-2-62

		280 | resource "aws_s3_bucket" "ccms_ebs_shared" {
		281 |   bucket = "${local.application_name}-${local.environment}-shared"
		282 | }

Check: CKV_AWS_18: "Ensure the S3 bucket has access logging enabled"
	FAILED for resource: aws_s3_bucket.ccms_ebs_shared
	File: /s3.tf:280-282
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-13-enable-logging

		280 | resource "aws_s3_bucket" "ccms_ebs_shared" {
		281 |   bucket = "${local.application_name}-${local.environment}-shared"
		282 | }

Check: CKV2_AWS_34: "AWS SSM Parameter should be Encrypted"
	FAILED for resource: aws_ssm_parameter.cw_agent_config
	File: /cloudwatch.tf:28-37
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-ssm-parameter-is-encrypted

		28 | resource "aws_ssm_parameter" "cw_agent_config" {
		29 |   description = "cloud watch agent config"
		30 |   name        = "cloud-watch-config"
		31 |   type        = "String"
		32 |   value       = file("./templates/cw_agent_config.json")
		33 | 
		34 |   tags = merge(local.tags,
		35 |     { Name = "cw-config" }
		36 |   )
		37 | }

Check: CKV2_AWS_6: "Ensure that S3 bucket has a Public Access block"
	FAILED for resource: aws_s3_bucket.ccms_ebs_shared
	File: /s3.tf:280-282
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/s3-bucket-should-have-public-access-blocks-defaults-to-false-if-the-public-access-block-is-not-attached

		280 | resource "aws_s3_bucket" "ccms_ebs_shared" {
		281 |   bucket = "${local.application_name}-${local.environment}-shared"
		282 | }

Check: CKV_AWS_145: "Ensure that S3 buckets are encrypted with KMS by default"
	FAILED for resource: aws_s3_bucket.ccms_ebs_shared
	File: /s3.tf:280-282
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-s3-buckets-are-encrypted-with-kms-by-default

		280 | resource "aws_s3_bucket" "ccms_ebs_shared" {
		281 |   bucket = "${local.application_name}-${local.environment}-shared"
		282 | }

Check: CKV_AWS_144: "Ensure that S3 bucket has cross-region replication enabled"
	FAILED for resource: aws_s3_bucket.ccms_ebs_shared
	File: /s3.tf:280-282
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-s3-bucket-has-cross-region-replication-enabled

		280 | resource "aws_s3_bucket" "ccms_ebs_shared" {
		281 |   bucket = "${local.application_name}-${local.environment}-shared"
		282 | }

Check: CKV_AWS_21: "Ensure all data stored in the S3 bucket have versioning enabled"
	FAILED for resource: aws_s3_bucket.ccms_ebs_shared
	File: /s3.tf:280-282
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-16-enable-versioning

		280 | resource "aws_s3_bucket" "ccms_ebs_shared" {
		281 |   bucket = "${local.application_name}-${local.environment}-shared"
		282 | }

Check: CKV2_AWS_61: "Ensure that an S3 bucket has a lifecycle configuration"
	FAILED for resource: aws_s3_bucket.ccms_ebs_shared
	File: /s3.tf:280-282
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-2-61

		280 | resource "aws_s3_bucket" "ccms_ebs_shared" {
		281 |   bucket = "${local.application_name}-${local.environment}-shared"
		282 | }

Check: CKV2_AWS_64: "Ensure KMS key Policy is defined"
	FAILED for resource: aws_kms_key.oracle_ec2
	File: /kms.tf:1-7
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-2-64

		1 | resource "aws_kms_key" "oracle_ec2" {
		2 |   enable_key_rotation = true
		3 | 
		4 |   tags = merge(local.tags,
		5 |     { Name = "oracle_ec2" }
		6 |   )
		7 | }


checkov_exitcode=1

*****************************

Running Checkov in terraform/environments/ccms-ebs
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2024-11-04 13:25:04,830 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.1.0:None (for external modules, the --download-external-modules flag is required)
2024-11-04 13:25:04,861 [MainThread  ] [WARNI]  [ArmLocalGraph] created 0 vertices
2024-11-04 13:25:04,862 [MainThread  ] [WARNI]  [ArmLocalGraph] created 0 edges
terraform scan results:

Passed checks: 859, Failed checks: 69, Skipped checks: 3

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.cloudwatch_datasource
	File: /ccms-cloudwatch.tf:54-106
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.groups
	File: /ccms-cloudwatch.tf:15-26
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		15 | resource "aws_cloudwatch_log_group" "groups" {
		16 |   for_each          = local.application_data.cw_log_groups
		17 |   name              = each.key
		18 |   retention_in_days = each.value.retention_days
		19 | 
		20 |   tags = merge(
		21 |     local.tags,
		22 |     {
		23 |       Name = each.key
		24 |     },
		25 |   )
		26 | }

Check: CKV_AWS_355: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_role_policy.dlm_lifecycle
	File: /ccms-dlm.tf:24-53
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-355

		24 | resource "aws_iam_role_policy" "dlm_lifecycle" {
		25 |   count = local.is-production ? 0 : 1
		26 |   name  = "dlm-lifecycle-policy"
		27 |   role  = aws_iam_role.dlm_lifecycle_role[0].id
		28 | 
		29 |   policy = <<EOF
		30 | {
		31 |    "Version": "2012-10-17",
		32 |    "Statement": [
		33 |       {
		34 |          "Effect": "Allow",
		35 |          "Action": [
		36 |             "ec2:CreateSnapshot",
		37 |             "ec2:DeleteSnapshot",
		38 |             "ec2:DescribeVolumes",
		39 |             "ec2:DescribeSnapshots"
		40 |          ],
		41 |          "Resource": "*"
		42 |       },
		43 |       {
		44 |          "Effect": "Allow",
		45 |          "Action": [
		46 |             "ec2:CreateTags"
		47 |          ],
		48 |          "Resource": "arn:aws:ec2:*::snapshot/*"
		49 |       }
		50 |    ]
		51 | }
		52 | EOF
		53 | }

Check: CKV_AWS_290: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_role_policy.dlm_lifecycle
	File: /ccms-dlm.tf:24-53
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-290

		24 | resource "aws_iam_role_policy" "dlm_lifecycle" {
		25 |   count = local.is-production ? 0 : 1
		26 |   name  = "dlm-lifecycle-policy"
		27 |   role  = aws_iam_role.dlm_lifecycle_role[0].id
		28 | 
		29 |   policy = <<EOF
		30 | {
		31 |    "Version": "2012-10-17",
		32 |    "Statement": [
		33 |       {
		34 |          "Effect": "Allow",
		35 |          "Action": [
		36 |             "ec2:CreateSnapshot",
		37 |             "ec2:DeleteSnapshot",
		38 |             "ec2:DescribeVolumes",
		39 |             "ec2:DescribeSnapshots"
		40 |          ],
		41 |          "Resource": "*"
		42 |       },
		43 |       {
		44 |          "Effect": "Allow",
		45 |          "Action": [
		46 |             "ec2:CreateTags"
		47 |          ],
		48 |          "Resource": "arn:aws:ec2:*::snapshot/*"
		49 |       }
		50 |    ]
		51 | }
		52 | EOF
		53 | }

Check: CKV_AWS_135: "Ensure that EC2 is EBS optimized"
	FAILED for resource: aws_instance.ec2_ftp
	File: /ccms-ec2-ftp.tf:1-67
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-ec2-is-ebs-optimized

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_135: "Ensure that EC2 is EBS optimized"
	FAILED for resource: aws_instance.ec2_mailrelay
	File: /ccms-ec2-mailrelay.tf:2-57
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-ec2-is-ebs-optimized

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_79: "Ensure Instance Metadata Service Version 1 is not enabled"
	FAILED for resource: aws_instance.ec2_accessgate
	File: /ccms-ec2-oracle_accessgate.tf:1-104
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-general-31

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_135: "Ensure that EC2 is EBS optimized"
	FAILED for resource: aws_instance.ec2_accessgate
	File: /ccms-ec2-oracle_accessgate.tf:1-104
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-ec2-is-ebs-optimized

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_131: "Ensure that ALB drops HTTP headers"
	FAILED for resource: aws_lb.ebsapps_lb
	File: /ccms-ec2-oracle_ebs_apps-alb.tf:1-19
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-alb-drops-http-headers

		1  | resource "aws_lb" "ebsapps_lb" {
		2  |   name               = lower(format("lb-%s-%s-ebsapp", local.application_name, local.environment))
		3  |   internal           = false
		4  |   load_balancer_type = "application"
		5  |   security_groups    = [aws_security_group.sg_ebsapps_lb.id]
		6  |   subnets            = data.aws_subnets.shared-public.ids
		7  | 
		8  |   enable_deletion_protection = true
		9  | 
		10 |   access_logs {
		11 |     bucket  = module.s3-bucket-logging.bucket.id
		12 |     prefix  = local.lb_log_prefix_ebsapp
		13 |     enabled = true
		14 |   }
		15 | 
		16 |   tags = merge(local.tags,
		17 |     { Name = lower(format("lb-%s-%s-ebsapp", local.application_name, local.environment)) }
		18 |   )
		19 | }

Check: CKV_AWS_378: "Ensure AWS Load Balancer doesn't use HTTP protocol"
	FAILED for resource: aws_lb_target_group.ebsapp_tg
	File: /ccms-ec2-oracle_ebs_apps-alb.tf:39-54

		39 | resource "aws_lb_target_group" "ebsapp_tg" {
		40 |   name     = lower(format("tg-%s-%s-ebsapp", local.application_name, local.environment))
		41 |   port     = local.application_data.accounts[local.environment].tg_apps_port
		42 |   protocol = "HTTP"
		43 |   vpc_id   = data.aws_vpc.shared.id
		44 |   health_check {
		45 |     port     = local.application_data.accounts[local.environment].tg_apps_port
		46 |     protocol = "HTTP"
		47 |   }
		48 | 
		49 |   stickiness {
		50 |     enabled         = true
		51 |     type            = "lb_cookie"
		52 |     cookie_duration = 3600
		53 |   }
		54 | }

Check: CKV_AWS_261: "Ensure HTTP HTTPS Target group defines Healthcheck"
	FAILED for resource: aws_lb_target_group.ebsapp_tg
	File: /ccms-ec2-oracle_ebs_apps-alb.tf:39-54
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-kendra-index-server-side-encryption-uses-customer-managed-keys-cmks

		39 | resource "aws_lb_target_group" "ebsapp_tg" {
		40 |   name     = lower(format("tg-%s-%s-ebsapp", local.application_name, local.environment))
		41 |   port     = local.application_data.accounts[local.environment].tg_apps_port
		42 |   protocol = "HTTP"
		43 |   vpc_id   = data.aws_vpc.shared.id
		44 |   health_check {
		45 |     port     = local.application_data.accounts[local.environment].tg_apps_port
		46 |     protocol = "HTTP"
		47 |   }
		48 | 
		49 |   stickiness {
		50 |     enabled         = true
		51 |     type            = "lb_cookie"
		52 |     cookie_duration = 3600
		53 |   }
		54 | }

Check: CKV_AWS_91: "Ensure the ELBv2 (Application/Network) has access logging enabled"
	FAILED for resource: aws_lb.ebsapps_nlb
	File: /ccms-ec2-oracle_ebs_apps-nlb.tf:16-42
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-logging-22

		16 | resource "aws_lb" "ebsapps_nlb" {
		17 |   name               = lower(format("nlb-%s-%s-ebs", local.application_name, local.environment))
		18 |   internal           = false
		19 |   load_balancer_type = "network"
		20 | 
		21 |   enable_deletion_protection       = true
		22 |   enable_cross_zone_load_balancing = true
		23 | 
		24 |   subnet_mapping {
		25 |     subnet_id     = data.aws_subnets.shared-public.ids[0]
		26 |     allocation_id = aws_eip.ebs_eip[0].id
		27 |   }
		28 | 
		29 |   subnet_mapping {
		30 |     subnet_id     = data.aws_subnets.shared-public.ids[1]
		31 |     allocation_id = aws_eip.ebs_eip[1].id
		32 |   }
		33 | 
		34 |   subnet_mapping {
		35 |     subnet_id     = data.aws_subnets.shared-public.ids[2]
		36 |     allocation_id = aws_eip.ebs_eip[2].id
		37 |   }
		38 | 
		39 |   tags = merge(local.tags,
		40 |     { Name = lower(format("nlb-%s-%s-ebsapp", local.application_name, local.environment)) }
		41 |   )
		42 | }

Check: CKV_AWS_79: "Ensure Instance Metadata Service Version 1 is not enabled"
	FAILED for resource: aws_instance.ec2_ebsapps
	File: /ccms-ec2-oracle_ebs_apps.tf:1-127
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-general-31

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_135: "Ensure that EC2 is EBS optimized"
	FAILED for resource: aws_instance.ec2_ebsapps
	File: /ccms-ec2-oracle_ebs_apps.tf:1-127
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-ec2-is-ebs-optimized

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_135: "Ensure that EC2 is EBS optimized"
	FAILED for resource: aws_instance.ec2_oracle_ebs
	File: /ccms-ec2-oracle_ebs_db.tf:1-68
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-ec2-is-ebs-optimized

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_8: "Ensure all data stored in the Launch configuration or instance Elastic Blocks Store is securely encrypted"
	FAILED for resource: aws_instance.ec2_oracle_ebs
	File: /ccms-ec2-oracle_ebs_db.tf:1-68
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-13

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_131: "Ensure that ALB drops HTTP headers"
	FAILED for resource: aws_lb.webgate_lb
	File: /ccms-ec2-oracle_webgate-alb.tf:1-20
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-alb-drops-http-headers

		1  | resource "aws_lb" "webgate_lb" {
		2  |   count              = local.is-production ? 1 : 1
		3  |   name               = lower(format("lb-%s-%s-wgate", local.application_name, local.environment))
		4  |   internal           = true
		5  |   load_balancer_type = "application"
		6  |   security_groups    = [aws_security_group.sg_webgate_lb.id]
		7  |   subnets            = data.aws_subnets.shared-private.ids
		8  | 
		9  |   enable_deletion_protection = true
		10 | 
		11 |   access_logs {
		12 |     bucket  = module.s3-bucket-logging.bucket.id
		13 |     prefix  = local.lb_log_prefix_wgate
		14 |     enabled = true
		15 |   }
		16 | 
		17 |   tags = merge(local.tags,
		18 |     { Name = lower(format("lb-%s-%s-wgate", local.application_name, local.environment)) }
		19 |   )
		20 | }

Check: CKV_AWS_378: "Ensure AWS Load Balancer doesn't use HTTP protocol"
	FAILED for resource: aws_lb_target_group.webgate_tg
	File: /ccms-ec2-oracle_webgate-alb.tf:40-52

		40 | resource "aws_lb_target_group" "webgate_tg" {
		41 |   count    = local.is-production ? 1 : 1
		42 |   name     = lower(format("tg-%s-%s-wgate", local.application_name, local.environment))
		43 |   port     = 5401
		44 |   protocol = "HTTP"
		45 |   vpc_id   = data.aws_vpc.shared.id
		46 |   health_check {
		47 |     port     = 5401
		48 |     protocol = "HTTP"
		49 |     matcher  = 302
		50 |     timeout  = 10
		51 |   }
		52 | }

Check: CKV_AWS_261: "Ensure HTTP HTTPS Target group defines Healthcheck"
	FAILED for resource: aws_lb_target_group.webgate_tg
	File: /ccms-ec2-oracle_webgate-alb.tf:40-52
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-kendra-index-server-side-encryption-uses-customer-managed-keys-cmks

		40 | resource "aws_lb_target_group" "webgate_tg" {
		41 |   count    = local.is-production ? 1 : 1
		42 |   name     = lower(format("tg-%s-%s-wgate", local.application_name, local.environment))
		43 |   port     = 5401
		44 |   protocol = "HTTP"
		45 |   vpc_id   = data.aws_vpc.shared.id
		46 |   health_check {
		47 |     port     = 5401
		48 |     protocol = "HTTP"
		49 |     matcher  = 302
		50 |     timeout  = 10
		51 |   }
		52 | }

Check: CKV_AWS_131: "Ensure that ALB drops HTTP headers"
	FAILED for resource: aws_lb.webgate_public_lb
	File: /ccms-ec2-oracle_webgate-alb.tf:62-80
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-alb-drops-http-headers

		62 | resource "aws_lb" "webgate_public_lb" {
		63 |   name               = lower(format("public-alb-webgate"))
		64 |   internal           = false
		65 |   load_balancer_type = "application"
		66 |   security_groups    = [aws_security_group.sg_webgate_lb.id]
		67 |   subnets            = data.aws_subnets.shared-public.ids
		68 | 
		69 |   enable_deletion_protection = true
		70 | 
		71 |   access_logs {
		72 |     bucket  = module.s3-bucket-logging.bucket.id
		73 |     prefix  = local.lb_log_prefix_wgate_public
		74 |     enabled = true
		75 |   }
		76 | 
		77 |   tags = merge(local.tags,
		78 |     { Name = lower(format("public-alb-webgate")) }
		79 |   )
		80 | }

Check: CKV_AWS_378: "Ensure AWS Load Balancer doesn't use HTTP protocol"
	FAILED for resource: aws_lb_target_group.webgate_tg_public
	File: /ccms-ec2-oracle_webgate-alb.tf:100-111

		100 | resource "aws_lb_target_group" "webgate_tg_public" {
		101 |   name     = lower(format("public-alb-webgate-tg"))
		102 |   port     = 5401
		103 |   protocol = "HTTP"
		104 |   vpc_id   = data.aws_vpc.shared.id
		105 |   health_check {
		106 |     port     = 5401
		107 |     protocol = "HTTP"
		108 |     matcher  = 302
		109 |     timeout  = 10
		110 |   }
		111 | }

Check: CKV_AWS_261: "Ensure HTTP HTTPS Target group defines Healthcheck"
	FAILED for resource: aws_lb_target_group.webgate_tg_public
	File: /ccms-ec2-oracle_webgate-alb.tf:100-111
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-kendra-index-server-side-encryption-uses-customer-managed-keys-cmks

		100 | resource "aws_lb_target_group" "webgate_tg_public" {
		101 |   name     = lower(format("public-alb-webgate-tg"))
		102 |   port     = 5401
		103 |   protocol = "HTTP"
		104 |   vpc_id   = data.aws_vpc.shared.id
		105 |   health_check {
		106 |     port     = 5401
		107 |     protocol = "HTTP"
		108 |     matcher  = 302
		109 |     timeout  = 10
		110 |   }
		111 | }

Check: CKV_AWS_91: "Ensure the ELBv2 (Application/Network) has access logging enabled"
	FAILED for resource: aws_lb.webgate_nlb
	File: /ccms-ec2-oracle_webgate-nlb.tf:16-42
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-logging-22

		16 | resource "aws_lb" "webgate_nlb" {
		17 |   name               = lower(format("public-nlb-webgate"))
		18 |   internal           = false
		19 |   load_balancer_type = "network"
		20 | 
		21 |   enable_deletion_protection       = true
		22 |   enable_cross_zone_load_balancing = true
		23 | 
		24 |   subnet_mapping {
		25 |     subnet_id     = data.aws_subnets.shared-public.ids[0]
		26 |     allocation_id = aws_eip.webgate_eip[0].id
		27 |   }
		28 | 
		29 |   subnet_mapping {
		30 |     subnet_id     = data.aws_subnets.shared-public.ids[1]
		31 |     allocation_id = aws_eip.webgate_eip[1].id
		32 |   }
		33 | 
		34 |   subnet_mapping {
		35 |     subnet_id     = data.aws_subnets.shared-public.ids[2]
		36 |     allocation_id = aws_eip.webgate_eip[2].id
		37 |   }
		38 | 
		39 |   tags = merge(local.tags,
		40 |     { Name = lower(format("public-nlb-webgate")) }
		41 |   )
		42 | }

Check: CKV_AWS_79: "Ensure Instance Metadata Service Version 1 is not enabled"
	FAILED for resource: aws_instance.ec2_webgate
	File: /ccms-ec2-oracle_webgate.tf:1-104
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-general-31

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_135: "Ensure that EC2 is EBS optimized"
	FAILED for resource: aws_instance.ec2_webgate
	File: /ccms-ec2-oracle_webgate.tf:1-104
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-ec2-is-ebs-optimized

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_355: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy.ec2_operations_policy
	File: /ccms-iam.tf:249-273
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-355

		249 | resource "aws_iam_policy" "ec2_operations_policy" {
		250 |   name        = "ec2_operations-${local.environment}"
		251 |   description = "Allows EC2 operations."
		252 | 
		253 |   policy = jsonencode(
		254 |     {
		255 |       "Version" : "2012-10-17",
		256 |       "Statement" : [
		257 |         {
		258 |           "Sid" : "EC2Operations",
		259 |           "Effect" : "Allow",
		260 |           "Action" : [
		261 |             "ec2:Describe*",
		262 |             "ec2:CreateSnapshot",
		263 |             "ec2:CreateSnapshots",
		264 |             "ec2:DeleteSnapshot",
		265 |             "ec2:CreateTags",
		266 |             "ec2:DeleteTags"
		267 |           ],
		268 |           "Resource" : "*"
		269 |         }
		270 |       ]
		271 |     }
		272 |   )
		273 | }

Check: CKV_AWS_290: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy.ec2_operations_policy
	File: /ccms-iam.tf:249-273
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-290

		249 | resource "aws_iam_policy" "ec2_operations_policy" {
		250 |   name        = "ec2_operations-${local.environment}"
		251 |   description = "Allows EC2 operations."
		252 | 
		253 |   policy = jsonencode(
		254 |     {
		255 |       "Version" : "2012-10-17",
		256 |       "Statement" : [
		257 |         {
		258 |           "Sid" : "EC2Operations",
		259 |           "Effect" : "Allow",
		260 |           "Action" : [
		261 |             "ec2:Describe*",
		262 |             "ec2:CreateSnapshot",
		263 |             "ec2:CreateSnapshots",
		264 |             "ec2:DeleteSnapshot",
		265 |             "ec2:CreateTags",
		266 |             "ec2:DeleteTags"
		267 |           ],
		268 |           "Resource" : "*"
		269 |         }
		270 |       ]
		271 |     }
		272 |   )
		273 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: aws_security_group.lambda_security_group
	File: /ccms-lambda.tf:22-44
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		22 | resource "aws_security_group" "lambda_security_group" {
		23 |   name        = "${local.application_name}-${local.environment}-lambda-sg"
		24 |   description = "SG traffic control for Payment Load Lambda"
		25 |   vpc_id      = data.aws_vpc.shared.id
		26 | 
		27 |   ingress {
		28 |     from_port   = 1521
		29 |     to_port     = 1522
		30 |     protocol    = "tcp"
		31 |     cidr_blocks = [data.aws_vpc.shared.cidr_block]
		32 |   }
		33 | 
		34 |   egress {
		35 |     from_port   = 0
		36 |     to_port     = 0
		37 |     protocol    = "-1"
		38 |     cidr_blocks = ["0.0.0.0/0"]
		39 |   }
		40 | 
		41 |   tags = merge(local.tags,
		42 |     { Name = "${local.application_name}-${local.environment}-lambda-sg" }
		43 |   )
		44 | }

Check: CKV_AWS_115: "Ensure that AWS Lambda function is configured for function-level concurrent execution limit"
	FAILED for resource: aws_lambda_function.lambda_function
	File: /ccms-lambda.tf:48-82
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-function-level-concurrent-execution-limit

		48 | resource "aws_lambda_function" "lambda_function" {
		49 |   function_name = "${local.application_name}-${local.environment}-payment-load"
		50 |   filename      = "lambda/functionV2.zip"
		51 |   handler       = "lambda_function.lambda_handler"
		52 |   runtime       = "python3.10"
		53 |   role          = aws_iam_role.lambda_execution_role.arn
		54 |   layers        = [aws_lambda_layer_version.lambda_layer.arn]
		55 |   architectures = ["x86_64"]
		56 |   memory_size   = 128
		57 |   timeout       = 120
		58 | 
		59 |   vpc_config {
		60 |     subnet_ids         = [data.aws_subnet.data_subnets_a.id]
		61 |     security_group_ids = [aws_security_group.lambda_security_group.id]
		62 |   }
		63 |   environment {
		64 |     variables = {
		65 |       IS_PRODUCTION   = local.is-production ? "true" : "false"
		66 |       LD_LIBRARY_PATH = "/opt/instantclient_12_2_linux"
		67 |       S3_BUCKET_NAME  = aws_s3_bucket.lambda_payment_load.bucket
		68 |       SECRET_NAME     = aws_secretsmanager_secret.secret_lambda_s3.name
		69 |     }
		70 |   }
		71 |   logging_config {
		72 |     log_format            = "JSON"
		73 |     application_log_level = "INFO"
		74 |     system_log_level      = "INFO"
		75 |   }
		76 | 
		77 |   tags = merge(local.tags, {
		78 |     Name = "${local.application_name}-${local.environment}-payment-load"
		79 |   })
		80 | 
		81 |   depends_on = [aws_lambda_layer_version.lambda_layer]
		82 | }

Check: CKV_AWS_173: "Check encryption settings for Lambda environmental variable"
	FAILED for resource: aws_lambda_function.lambda_function
	File: /ccms-lambda.tf:48-82
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-5

		48 | resource "aws_lambda_function" "lambda_function" {
		49 |   function_name = "${local.application_name}-${local.environment}-payment-load"
		50 |   filename      = "lambda/functionV2.zip"
		51 |   handler       = "lambda_function.lambda_handler"
		52 |   runtime       = "python3.10"
		53 |   role          = aws_iam_role.lambda_execution_role.arn
		54 |   layers        = [aws_lambda_layer_version.lambda_layer.arn]
		55 |   architectures = ["x86_64"]
		56 |   memory_size   = 128
		57 |   timeout       = 120
		58 | 
		59 |   vpc_config {
		60 |     subnet_ids         = [data.aws_subnet.data_subnets_a.id]
		61 |     security_group_ids = [aws_security_group.lambda_security_group.id]
		62 |   }
		63 |   environment {
		64 |     variables = {
		65 |       IS_PRODUCTION   = local.is-production ? "true" : "false"
		66 |       LD_LIBRARY_PATH = "/opt/instantclient_12_2_linux"
		67 |       S3_BUCKET_NAME  = aws_s3_bucket.lambda_payment_load.bucket
		68 |       SECRET_NAME     = aws_secretsmanager_secret.secret_lambda_s3.name
		69 |     }
		70 |   }
		71 |   logging_config {
		72 |     log_format            = "JSON"
		73 |     application_log_level = "INFO"
		74 |     system_log_level      = "INFO"
		75 |   }
		76 | 
		77 |   tags = merge(local.tags, {
		78 |     Name = "${local.application_name}-${local.environment}-payment-load"
		79 |   })
		80 | 
		81 |   depends_on = [aws_lambda_layer_version.lambda_layer]
		82 | }

Check: CKV_AWS_116: "Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)"
	FAILED for resource: aws_lambda_function.lambda_function
	File: /ccms-lambda.tf:48-82
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-a-dead-letter-queue-dlq

		48 | resource "aws_lambda_function" "lambda_function" {
		49 |   function_name = "${local.application_name}-${local.environment}-payment-load"
		50 |   filename      = "lambda/functionV2.zip"
		51 |   handler       = "lambda_function.lambda_handler"
		52 |   runtime       = "python3.10"
		53 |   role          = aws_iam_role.lambda_execution_role.arn
		54 |   layers        = [aws_lambda_layer_version.lambda_layer.arn]
		55 |   architectures = ["x86_64"]
		56 |   memory_size   = 128
		57 |   timeout       = 120
		58 | 
		59 |   vpc_config {
		60 |     subnet_ids         = [data.aws_subnet.data_subnets_a.id]
		61 |     security_group_ids = [aws_security_group.lambda_security_group.id]
		62 |   }
		63 |   environment {
		64 |     variables = {
		65 |       IS_PRODUCTION   = local.is-production ? "true" : "false"
		66 |       LD_LIBRARY_PATH = "/opt/instantclient_12_2_linux"
		67 |       S3_BUCKET_NAME  = aws_s3_bucket.lambda_payment_load.bucket
		68 |       SECRET_NAME     = aws_secretsmanager_secret.secret_lambda_s3.name
		69 |     }
		70 |   }
		71 |   logging_config {
		72 |     log_format            = "JSON"
		73 |     application_log_level = "INFO"
		74 |     system_log_level      = "INFO"
		75 |   }
		76 | 
		77 |   tags = merge(local.tags, {
		78 |     Name = "${local.application_name}-${local.environment}-payment-load"
		79 |   })
		80 | 
		81 |   depends_on = [aws_lambda_layer_version.lambda_layer]
		82 | }

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: aws_lambda_function.lambda_function
	File: /ccms-lambda.tf:48-82
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		48 | resource "aws_lambda_function" "lambda_function" {
		49 |   function_name = "${local.application_name}-${local.environment}-payment-load"
		50 |   filename      = "lambda/functionV2.zip"
		51 |   handler       = "lambda_function.lambda_handler"
		52 |   runtime       = "python3.10"
		53 |   role          = aws_iam_role.lambda_execution_role.arn
		54 |   layers        = [aws_lambda_layer_version.lambda_layer.arn]
		55 |   architectures = ["x86_64"]
		56 |   memory_size   = 128
		57 |   timeout       = 120
		58 | 
		59 |   vpc_config {
		60 |     subnet_ids         = [data.aws_subnet.data_subnets_a.id]
		61 |     security_group_ids = [aws_security_group.lambda_security_group.id]
		62 |   }
		63 |   environment {
		64 |     variables = {
		65 |       IS_PRODUCTION   = local.is-production ? "true" : "false"
		66 |       LD_LIBRARY_PATH = "/opt/instantclient_12_2_linux"
		67 |       S3_BUCKET_NAME  = aws_s3_bucket.lambda_payment_load.bucket
		68 |       SECRET_NAME     = aws_secretsmanager_secret.secret_lambda_s3.name
		69 |     }
		70 |   }
		71 |   logging_config {
		72 |     log_format            = "JSON"
		73 |     application_log_level = "INFO"
		74 |     system_log_level      = "INFO"
		75 |   }
		76 | 
		77 |   tags = merge(local.tags, {
		78 |     Name = "${local.application_name}-${local.environment}-payment-load"
		79 |   })
		80 | 
		81 |   depends_on = [aws_lambda_layer_version.lambda_layer]
		82 | }

Check: CKV_AWS_272: "Ensure AWS Lambda function is configured to validate code-signing"
	FAILED for resource: aws_lambda_function.lambda_function
	File: /ccms-lambda.tf:48-82
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-272

		48 | resource "aws_lambda_function" "lambda_function" {
		49 |   function_name = "${local.application_name}-${local.environment}-payment-load"
		50 |   filename      = "lambda/functionV2.zip"
		51 |   handler       = "lambda_function.lambda_handler"
		52 |   runtime       = "python3.10"
		53 |   role          = aws_iam_role.lambda_execution_role.arn
		54 |   layers        = [aws_lambda_layer_version.lambda_layer.arn]
		55 |   architectures = ["x86_64"]
		56 |   memory_size   = 128
		57 |   timeout       = 120
		58 | 
		59 |   vpc_config {
		60 |     subnet_ids         = [data.aws_subnet.data_subnets_a.id]
		61 |     security_group_ids = [aws_security_group.lambda_security_group.id]
		62 |   }
		63 |   environment {
		64 |     variables = {
		65 |       IS_PRODUCTION   = local.is-production ? "true" : "false"
		66 |       LD_LIBRARY_PATH = "/opt/instantclient_12_2_linux"
		67 |       S3_BUCKET_NAME  = aws_s3_bucket.lambda_payment_load.bucket
		68 |       SECRET_NAME     = aws_secretsmanager_secret.secret_lambda_s3.name
		69 |     }
		70 |   }
		71 |   logging_config {
		72 |     log_format            = "JSON"
		73 |     application_log_level = "INFO"
		74 |     system_log_level      = "INFO"
		75 |   }
		76 | 
		77 |   tags = merge(local.tags, {
		78 |     Name = "${local.application_name}-${local.environment}-payment-load"
		79 |   })
		80 | 
		81 |   depends_on = [aws_lambda_layer_version.lambda_layer]
		82 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: s3-bucket
	File: /ccms-s3.tf:2-71
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: s3-bucket-logging
	File: /ccms-s3.tf:98-166
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: s3-bucket-dbbackup
	File: /ccms-s3.tf:190-258
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.secret_ftp_s3
	File: /ccms-secrets.tf:3-10
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		3  | resource "aws_secretsmanager_secret" "secret_ftp_s3" {
		4  |   name        = "ftp-s3-${local.environment}-aws-key"
		5  |   description = "AWS credentials for mounting of s3 buckets for the FTP Service to access"
		6  | 
		7  |   tags = merge(local.tags,
		8  |     { Name = "ftp-s3-${local.environment}-aws-key" }
		9  |   )
		10 | }

Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.secret_ses_smtp_credentials
	File: /ccms-secrets.tf:12-19
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		12 | resource "aws_secretsmanager_secret" "secret_ses_smtp_credentials" {
		13 |   name        = "ses-smtp-credentials"
		14 |   description = "SMTP credentials for Postfix to send messages through SES."
		15 | 
		16 |   tags = merge(local.tags,
		17 |     { Name = "ses-smtp-credentials-${local.environment}" }
		18 |   )
		19 | }

Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.secret_lambda_s3
	File: /ccms-secrets.tf:23-30
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		23 | resource "aws_secretsmanager_secret" "secret_lambda_s3" {
		24 |   name        = "db-${local.environment}-credentials"
		25 |   description = "AWS credentials for lambda to connect to the db"
		26 | 
		27 |   tags = merge(local.tags,
		28 |     { Name = "db-${local.environment}-credentials" }
		29 |   )
		30 | }
Check: CKV_AWS_365: "Ensure SES Configuration Set enforces TLS usage"
	FAILED for resource: aws_ses_configuration_set.default_configuration_set
	File: /ccms-ses.tf:35-43
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/bc-aws-365

		35 | resource "aws_ses_configuration_set" "default_configuration_set" {
		36 |   name = "default-configuration-set"
		37 | 
		38 |   delivery_options {
		39 |     tls_policy = "Optional"
		40 |   }
		41 |   reputation_metrics_enabled = true
		42 |   sending_enabled            = true
		43 | }

Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.support_email_account
	File: /ccms-sns.tf:2-5
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		2 | resource "aws_secretsmanager_secret" "support_email_account" {
		3 |   name        = "support_email_account"
		4 |   description = "email address of the support account for cw alerts"
		5 | }

Check: CKV_AWS_26: "Ensure all data stored in the SNS topic is encrypted"
	FAILED for resource: aws_sns_topic.cw_alerts
	File: /ccms-sns.tf:17-20
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-15

		17 | resource "aws_sns_topic" "cw_alerts" {
		18 |   name = "ccms-ebs-ec2-alerts"
		19 |   #kms_master_key_id = "alias/aws/sns"
		20 | }

Check: CKV_AWS_26: "Ensure all data stored in the SNS topic is encrypted"
	FAILED for resource: aws_sns_topic.s3_topic
	File: /ccms-sns.tf:34-37
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-15

		34 | resource "aws_sns_topic" "s3_topic" {
		35 |   name   = "s3-event-notification-topic"
		36 |   policy = data.aws_iam_policy_document.s3_topic_policy.json
		37 | }

Check: CKV_AWS_26: "Ensure all data stored in the SNS topic is encrypted"
	FAILED for resource: aws_sns_topic.ddos_alarm
	File: /ccms-sns.tf:51-54
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-15

		51 | resource "aws_sns_topic" "ddos_alarm" {
		52 |   name = format("%s_ddos_alarm", local.application_name)
		53 |   #kms_master_key_id = "alias/aws/sns"
		54 | }

Check: CKV_AWS_192: "Ensure WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell"
	FAILED for resource: aws_wafv2_web_acl.ebs_web_acl
	File: /ccms-waf.tf:172-211
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-waf-prevents-message-lookup-in-log4j2

		172 | resource "aws_wafv2_web_acl" "ebs_web_acl" {
		173 |   name        = "ebs_waf"
		174 |   scope       = "REGIONAL"
		175 |   description = "AWS WAF Web ACL for EBS"
		176 | 
		177 |   default_action {
		178 |     block {}
		179 |   }
		180 | 
		181 |   rule {
		182 |     name = "ebs-trusted-rule"
		183 | 
		184 |     priority = 1
		185 |     action {
		186 |       allow {}
		187 |     }
		188 | 
		189 |     statement {
		190 |       ip_set_reference_statement {
		191 |         arn = aws_wafv2_ip_set.ebs_waf_ip_set.arn
		192 |       }
		193 |     }
		194 | 
		195 |     visibility_config {
		196 |       cloudwatch_metrics_enabled = true
		197 |       metric_name                = "ebs_waf_metrics"
		198 |       sampled_requests_enabled   = true
		199 |     }
		200 |   }
		201 | 
		202 |   tags = merge(local.tags,
		203 |     { Name = lower(format("lb-%s-%s-ebsapp-web-acl", local.application_name, local.environment)) }
		204 |   )
		205 | 
		206 |   visibility_config {
		207 |     cloudwatch_metrics_enabled = true
		208 |     metric_name                = "ebs_waf_metrics"
		209 |     sampled_requests_enabled   = true
		210 |   }
		211 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.ebs_waf_logs
	File: /ccms-waf.tf:213-220
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		213 | resource "aws_cloudwatch_log_group" "ebs_waf_logs" {
		214 |   name              = "aws-waf-logs-ebs/ebs-waf-logs"
		215 |   retention_in_days = 30
		216 | 
		217 |   tags = merge(local.tags,
		218 |     { Name = lower(format("lb-%s-%s-ebs-waf-logs", local.application_name, local.environment)) }
		219 |   )
		220 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.ebs_waf_logs
	File: /ccms-waf.tf:213-220
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		213 | resource "aws_cloudwatch_log_group" "ebs_waf_logs" {
		214 |   name              = "aws-waf-logs-ebs/ebs-waf-logs"
		215 |   retention_in_days = 30
		216 | 
		217 |   tags = merge(local.tags,
		218 |     { Name = lower(format("lb-%s-%s-ebs-waf-logs", local.application_name, local.environment)) }
		219 |   )
		220 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.secret_ftp_s3
	File: /ccms-secrets.tf:3-10
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		3  | resource "aws_secretsmanager_secret" "secret_ftp_s3" {
		4  |   name        = "ftp-s3-${local.environment}-aws-key"
		5  |   description = "AWS credentials for mounting of s3 buckets for the FTP Service to access"
		6  | 
		7  |   tags = merge(local.tags,
		8  |     { Name = "ftp-s3-${local.environment}-aws-key" }
		9  |   )
		10 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.secret_ses_smtp_credentials
	File: /ccms-secrets.tf:12-19
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		12 | resource "aws_secretsmanager_secret" "secret_ses_smtp_credentials" {
		13 |   name        = "ses-smtp-credentials"
		14 |   description = "SMTP credentials for Postfix to send messages through SES."
		15 | 
		16 |   tags = merge(local.tags,
		17 |     { Name = "ses-smtp-credentials-${local.environment}" }
		18 |   )
		19 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.secret_lambda_s3
	File: /ccms-secrets.tf:23-30
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		23 | resource "aws_secretsmanager_secret" "secret_lambda_s3" {
		24 |   name        = "db-${local.environment}-credentials"
		25 |   description = "AWS credentials for lambda to connect to the db"
		26 | 
		27 |   tags = merge(local.tags,
		28 |     { Name = "db-${local.environment}-credentials" }
		29 |   )
		30 | }
Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.support_email_account
	File: /ccms-sns.tf:2-5
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		2 | resource "aws_secretsmanager_secret" "support_email_account" {
		3 |   name        = "support_email_account"
		4 |   description = "email address of the support account for cw alerts"
		5 | }

Check: CKV2_AWS_62: "Ensure S3 buckets should have event notifications enabled"
	FAILED for resource: aws_s3_bucket.ccms_ebs_shared
	File: /ccms-s3.tf:286-288
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-2-62

		286 | resource "aws_s3_bucket" "ccms_ebs_shared" {
		287 |   bucket = "${local.application_name}-${local.environment}-shared"
		288 | }

Check: CKV2_AWS_62: "Ensure S3 buckets should have event notifications enabled"
	FAILED for resource: aws_s3_bucket.lambda_payment_load
	File: /ccms-s3.tf:293-295
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-2-62

		293 | resource "aws_s3_bucket" "lambda_payment_load" {
		294 |   bucket = "${local.application_name}-${local.environment}-payment-load"
		295 | }
Check: CKV_AWS_18: "Ensure the S3 bucket has access logging enabled"
	FAILED for resource: aws_s3_bucket.ccms_ebs_shared
	File: /ccms-s3.tf:286-288
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-13-enable-logging

		286 | resource "aws_s3_bucket" "ccms_ebs_shared" {
		287 |   bucket = "${local.application_name}-${local.environment}-shared"
		288 | }

Check: CKV_AWS_18: "Ensure the S3 bucket has access logging enabled"
	FAILED for resource: aws_s3_bucket.lambda_payment_load
	File: /ccms-s3.tf:293-295
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-13-enable-logging

		293 | resource "aws_s3_bucket" "lambda_payment_load" {
		294 |   bucket = "${local.application_name}-${local.environment}-payment-load"
		295 | }
Check: CKV2_AWS_34: "AWS SSM Parameter should be Encrypted"
	FAILED for resource: aws_ssm_parameter.cw_agent_config
	File: /ccms-cloudwatch.tf:28-37
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-ssm-parameter-is-encrypted

		28 | resource "aws_ssm_parameter" "cw_agent_config" {
		29 |   description = "cloud watch agent config"
		30 |   name        = "cloud-watch-config"
		31 |   type        = "String"
		32 |   value       = file("./templates/cw_agent_config.json")
		33 | 
		34 |   tags = merge(local.tags,
		35 |     { Name = "cw-config" }
		36 |   )
		37 | }

Check: CKV2_AWS_6: "Ensure that S3 bucket has a Public Access block"
	FAILED for resource: aws_s3_bucket.ccms_ebs_shared
	File: /ccms-s3.tf:286-288
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/s3-bucket-should-have-public-access-blocks-defaults-to-false-if-the-public-access-block-is-not-attached

		286 | resource "aws_s3_bucket" "ccms_ebs_shared" {
		287 |   bucket = "${local.application_name}-${local.environment}-shared"
		288 | }

Check: CKV2_AWS_6: "Ensure that S3 bucket has a Public Access block"
	FAILED for resource: aws_s3_bucket.lambda_payment_load
	File: /ccms-s3.tf:293-295
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/s3-bucket-should-have-public-access-blocks-defaults-to-false-if-the-public-access-block-is-not-attached

		293 | resource "aws_s3_bucket" "lambda_payment_load" {
		294 |   bucket = "${local.application_name}-${local.environment}-payment-load"
		295 | }
Check: CKV_AWS_144: "Ensure that S3 bucket has cross-region replication enabled"
	FAILED for resource: aws_s3_bucket.ccms_ebs_shared
	File: /ccms-s3.tf:286-288
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-s3-bucket-has-cross-region-replication-enabled

		286 | resource "aws_s3_bucket" "ccms_ebs_shared" {
		287 |   bucket = "${local.application_name}-${local.environment}-shared"
		288 | }

Check: CKV_AWS_144: "Ensure that S3 bucket has cross-region replication enabled"
	FAILED for resource: aws_s3_bucket.lambda_payment_load
	File: /ccms-s3.tf:293-295
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-s3-bucket-has-cross-region-replication-enabled

		293 | resource "aws_s3_bucket" "lambda_payment_load" {
		294 |   bucket = "${local.application_name}-${local.environment}-payment-load"
		295 | }
Check: CKV_AWS_145: "Ensure that S3 buckets are encrypted with KMS by default"
	FAILED for resource: aws_s3_bucket.ccms_ebs_shared
	File: /ccms-s3.tf:286-288
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-s3-buckets-are-encrypted-with-kms-by-default

		286 | resource "aws_s3_bucket" "ccms_ebs_shared" {
		287 |   bucket = "${local.application_name}-${local.environment}-shared"
		288 | }

Check: CKV_AWS_145: "Ensure that S3 buckets are encrypted with KMS by default"
	FAILED for resource: aws_s3_bucket.lambda_payment_load
	File: /ccms-s3.tf:293-295
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-s3-buckets-are-encrypted-with-kms-by-default

		293 | resource "aws_s3_bucket" "lambda_payment_load" {
		294 |   bucket = "${local.application_name}-${local.environment}-payment-load"
		295 | }
Check: CKV_AWS_21: "Ensure all data stored in the S3 bucket have versioning enabled"
	FAILED for resource: aws_s3_bucket.ccms_ebs_shared
	File: /ccms-s3.tf:286-288
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-16-enable-versioning

		286 | resource "aws_s3_bucket" "ccms_ebs_shared" {
		287 |   bucket = "${local.application_name}-${local.environment}-shared"
		288 | }

Check: CKV_AWS_21: "Ensure all data stored in the S3 bucket have versioning enabled"
	FAILED for resource: aws_s3_bucket.lambda_payment_load
	File: /ccms-s3.tf:293-295
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-16-enable-versioning

		293 | resource "aws_s3_bucket" "lambda_payment_load" {
		294 |   bucket = "${local.application_name}-${local.environment}-payment-load"
		295 | }
Check: CKV2_AWS_64: "Ensure KMS key Policy is defined"
	FAILED for resource: aws_kms_key.oracle_ec2
	File: /ccms-kms.tf:1-7
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-2-64

		1 | resource "aws_kms_key" "oracle_ec2" {
		2 |   enable_key_rotation = true
		3 | 
		4 |   tags = merge(local.tags,
		5 |     { Name = "oracle_ec2" }
		6 |   )
		7 | }

Check: CKV2_AWS_61: "Ensure that an S3 bucket has a lifecycle configuration"
	FAILED for resource: aws_s3_bucket.ccms_ebs_shared
	File: /ccms-s3.tf:286-288
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-2-61

		286 | resource "aws_s3_bucket" "ccms_ebs_shared" {
		287 |   bucket = "${local.application_name}-${local.environment}-shared"
		288 | }

Check: CKV2_AWS_61: "Ensure that an S3 bucket has a lifecycle configuration"
	FAILED for resource: aws_s3_bucket.lambda_payment_load
	File: /ccms-s3.tf:293-295
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-2-61

		293 | resource "aws_s3_bucket" "lambda_payment_load" {
		294 |   bucket = "${local.application_name}-${local.environment}-payment-load"
		295 | }
Check: CKV2_AWS_19: "Ensure that all EIP addresses allocated to a VPC are attached to EC2 instances"
	FAILED for resource: aws_eip.ebs_eip
	File: /ccms-ec2-oracle_ebs_apps-nlb.tf:2-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-all-eip-addresses-allocated-to-a-vpc-are-attached-to-ec2-instances

		2  | resource "aws_eip" "ebs_eip" {
		3  |   count = local.is-production ? 6 : 3
		4  |   vpc   = true
		5  | 
		6  |   lifecycle {
		7  |     prevent_destroy = true
		8  |   }
		9  | 
		10 |   tags = merge(local.tags,
		11 |     { Name = lower(format("lb-%s-%s-eip-${count.index + 1}", local.application_name, local.environment)) }
		12 |   )
		13 | }

Check: CKV2_AWS_19: "Ensure that all EIP addresses allocated to a VPC are attached to EC2 instances"
	FAILED for resource: aws_eip.webgate_eip
	File: /ccms-ec2-oracle_webgate-nlb.tf:2-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-all-eip-addresses-allocated-to-a-vpc-are-attached-to-ec2-instances

		2  | resource "aws_eip" "webgate_eip" {
		3  |   count = local.is-production ? 6 : 3
		4  |   vpc   = true
		5  | 
		6  |   lifecycle {
		7  |     prevent_destroy = true
		8  |   }
		9  | 
		10 |   tags = merge(local.tags,
		11 |     { Name = lower(format("lb-%s-%s-webgate-eip-${count.index + 1}", local.application_name, local.environment)) }
		12 |   )
		13 | }


checkov_exitcode=2

`CTFLint Scan` Failed

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
terraform/environments/ccms-ebs-upgrade
terraform/environments/ccms-ebs

*****************************

Running tflint in terraform/environments/ccms-ebs-upgrade
Excluding the following checks: terraform_unused_declarations
2 issue(s) found:

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/ccms-ebs-upgrade/ec2-oracle_ebs_conc.tf line 31:
  31:     environment = "${local.environment}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/ccms-ebs-upgrade/ec2-oracle_ebs_db.tf line 31:
  31:     environment = "${local.environment}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

tflint_exitcode=2

*****************************

Running tflint in terraform/environments/ccms-ebs
Excluding the following checks: terraform_unused_declarations
5 issue(s) found:

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/ccms-ebs/ccms-ec2-ftp.tf line 23:
  23:     environment               = "${local.environment}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/ccms-ebs/ccms-ec2-ftp.tf line 24:
  24:     lz_aws_account_id_env     = "${local.application_data.accounts[local.environment].lz_aws_account_id_env}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/ccms-ebs/ccms-ec2-ftp.tf line 25:
  25:     lz_ftp_bucket_environment = "${local.application_data.accounts[local.environment].lz_ftp_bucket_environment}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/ccms-ebs/ccms-ec2-mailrelay.tf line 28:
  28:     smtp_fqdn = "${local.application_data.accounts[local.environment].ses_domain_identity}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/ccms-ebs/ccms-ec2-oracle_ebs_db.tf line 31:
  31:     environment = "${local.environment}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

tflint_exitcode=4

`Trivy Scan` Failed

Show Output

*****************************

Trivy will check the following folders:
terraform/environments/ccms-ebs-upgrade
terraform/environments/ccms-ebs

*****************************

Running Trivy in terraform/environments/ccms-ebs-upgrade
2024-11-04T13:24:41Z	INFO	[vulndb] Need to update DB
2024-11-04T13:24:41Z	INFO	[vulndb] Downloading vulnerability DB...
2024-11-04T13:24:41Z	INFO	[vulndb] Downloading artifact...	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2024-11-04T13:24:43Z	INFO	[vulndb] Artifact successfully downloaded	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2024-11-04T13:24:43Z	INFO	[vuln] Vulnerability scanning is enabled
2024-11-04T13:24:43Z	INFO	[misconfig] Misconfiguration scanning is enabled
2024-11-04T13:24:43Z	INFO	[misconfig] Need to update the built-in checks
2024-11-04T13:24:43Z	INFO	[misconfig] Downloading the built-in checks...
160.60 KiB / 160.60 KiB [---------------------------------------------------------] 100.00% ? p/s 0s2024-11-04T13:24:43Z	INFO	[secret] Secret scanning is enabled
2024-11-04T13:24:43Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-11-04T13:24:43Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2024-11-04T13:24:45Z	INFO	[terraform scanner] Scanning root module	file_path="."
2024-11-04T13:24:45Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="networking"
2024-11-04T13:24:45Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_cloudwatch_log_group.groups" value="cty.NilVal"
2024-11-04T13:24:45Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_route53_record.external_validation" value="cty.NilVal"
2024-11-04T13:24:45Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_security_group_rule.all_internal_egress_traffic" value="cty.NilVal"
2024-11-04T13:24:45Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_security_group_rule.all_internal_ingress_traffic" value="cty.NilVal"
2024-11-04T13:24:47Z	INFO	[terraform scanner] Scanning root module	file_path="modules"
2024-11-04T13:24:47Z	INFO	[terraform scanner] Scanning root module	file_path="modules/cw-logs"
2024-11-04T13:24:50Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-versioning" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0/main.tf:167-172"
2024-11-04T13:24:50Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0/main.tf:157-165"
2024-11-04T13:24:50Z	INFO	Number of language-specific files	num=0
2024-11-04T13:24:50Z	INFO	Detected config files	num=21

ec2-oracle_accessgate.tf (terraform)
====================================
Tests: 1 (SUCCESSES: 0, FAILURES: 1)
Failures: 1 (HIGH: 1, CRITICAL: 0)

AVD-AWS-0028 (HIGH): Instance does not require IMDS access to require a token.
════════════════════════════════════════
IMDS v2 (Instance Metadata Service) introduced session authentication tokens which improve security when talking to IMDS.

By default <code>aws_instance</code> resource sets IMDS session auth tokens to be optional.

To fully protect IMDS you need to enable session tokens by using <code>metadata_options</code> block and its <code>http_tokens</code> variable set to <code>required</code>.


See https://avd.aquasec.com/misconfig/avd-aws-0028
────────────────────────────────────────
 ec2-oracle_accessgate.tf:1-104
────────────────────────────────────────
   1 ┌ resource "aws_instance" "ec2_accessgate" {
   2 │   count                  = local.application_data.accounts[local.environment].accessgate_no_instances
   3 │   instance_type          = local.application_data.accounts[local.environment].ec2_oracle_instance_type_accessgate
   4 │   ami                    = local.application_data.accounts[local.environment]["accessgate_ami_id-${count.index + 1}"]
   5 │   key_name               = local.application_data.accounts[local.environment].key_name
   6 │   vpc_security_group_ids = [aws_security_group.ec2_sg_accessgate.id]
   7 │   subnet_id              = local.private_subnets[count.index]
   8 │   #subnet_id                   = data.aws_subnet.data_subnets_a.id
   9 └   monitoring                  = true
  ..   
────────────────────────────────────────



ec2-oracle_ebs_apps-alb.tf (terraform)
======================================
Tests: 1 (SUCCESSES: 0, FAILURES: 1)
Failures: 1 (HIGH: 1, CRITICAL: 0)

AVD-AWS-0052 (HIGH): Application load balancer is not set to drop invalid headers.
════════════════════════════════════════
Passing unknown or invalid headers through to the target poses a potential risk of compromise.
By setting drop_invalid_header_fields to true, anything that does not conform to well known, defined headers will be removed by the load balancer.


See https://avd.aquasec.com/misconfig/avd-aws-0052
────────────────────────────────────────
 ec2-oracle_ebs_apps-alb.tf:1-19
────────────────────────────────────────
   1 ┌ resource "aws_lb" "ebsapps_lb" {
   2 │   name               = lower(format("lb-%s-ebsapp", local.application_name))
   3 │   internal           = true
   4 │   load_balancer_type = "application"
   5 │   security_groups    = [aws_security_group.sg_ebsapps_lb.id]
   6 │   subnets            = data.aws_subnets.shared-private.ids
   7 │ 
   8 │   enable_deletion_protection = true
   9 └ 
  ..   
────────────────────────────────────────



ec2-oracle_ebs_apps.tf (terraform)
==================================
Tests: 1 (SUCCESSES: 0, FAILURES: 1)
Failures: 1 (HIGH: 1, CRITICAL: 0)

AVD-AWS-0028 (HIGH): Instance does not require IMDS access to require a token.
════════════════════════════════════════
IMDS v2 (Instance Metadata Service) introduced session authentication tokens which improve security when talking to IMDS.

By default <code>aws_instance</code> resource sets IMDS session auth tokens to be optional.

To fully protect IMDS you need to enable session tokens by using <code>metadata_options</code> block and its <code>http_tokens</code> variable set to <code>required</code>.


See https://avd.aquasec.com/misconfig/avd-aws-0028
────────────────────────────────────────
 ec2-oracle_ebs_apps.tf:1-50
────────────────────────────────────────
   1 ┌ resource "aws_instance" "ec2_ebsapps" {
   2 │   count                  = local.application_data.accounts[local.environment].ebsapps_no_instances
   3 │   instance_type          = local.application_data.accounts[local.environment].ec2_oracle_instance_type_ebsapps
   4 │   ami                    = local.application_data.accounts[local.environment]["ebsapps_ami_id-${count.index + 1}"]
   5 │   key_name               = local.application_data.accounts[local.environment].key_name
   6 │   vpc_security_group_ids = [aws_security_group.ec2_sg_ebsapps.id]
   7 │   subnet_id              = local.private_subnets[count.index]
   8 │   #subnet_id                   = data.aws_subnet.data_subnets_a.id
   9 └   monitoring                  = true
  ..   
────────────────────────────────────────



ec2-oracle_ebs_conc.tf (terraform)
==================================
Tests: 1 (SUCCESSES: 0, FAILURES: 1)
Failures: 1 (HIGH: 1, CRITICAL: 0)

AVD-AWS-0131 (HIGH): Root block device is not encrypted.
════════════════════════════════════════
Block devices should be encrypted to ensure sensitive data is held securely at rest.


See https://avd.aquasec.com/misconfig/avd-aws-0131
────────────────────────────────────────
 ec2-oracle_ebs_conc.tf:1-48
────────────────────────────────────────
   1 ┌ resource "aws_instance" "ec2_oracle_conc" {
   2 │   count                       = local.application_data.accounts[local.environment].conc_no_instances
   3 │   instance_type               = local.application_data.accounts[local.environment].ec2_oracle_instance_type_ebsconc
   4 │   ami                         = local.application_data.accounts[local.environment].ebsconc_ami_id
   5 │   key_name                    = local.application_data.accounts[local.environment].key_name
   6 │   vpc_security_group_ids      = [aws_security_group.ec2_sg_ebsconc.id]
   7 │   subnet_id                   = data.aws_subnet.data_subnets_a.id
   8 │   monitoring                  = true
   9 └   ebs_optimized               = local.application_data.accounts[local.environment].ebs_optimized
  ..   
────────────────────────────────────────



ec2-oracle_ebs_db.tf (terraform)
================================
Tests: 1 (SUCCESSES: 0, FAILURES: 1)
Failures: 1 (HIGH: 1, CRITICAL: 0)

AVD-AWS-0131 (HIGH): Root block device is not encrypted.
════════════════════════════════════════
Block devices should be encrypted to ensure sensitive data is held securely at rest.


See https://avd.aquasec.com/misconfig/avd-aws-0131
────────────────────────────────────────
 ec2-oracle_ebs_db.tf:1-48
────────────────────────────────────────
   1 ┌ resource "aws_instance" "ec2_oracle_ebs" {
   2 │   instance_type = local.application_data.accounts[local.environment].ec2_oracle_instance_type_ebsdb
   3 │   #ami                         = data.aws_ami.oracle_db.id
   4 │   ami                         = local.application_data.accounts[local.environment].ebsdb_ami_id
   5 │   key_name                    = local.application_data.accounts[local.environment].key_name
   6 │   vpc_security_group_ids      = [aws_security_group.ec2_sg_ebsdb.id]
   7 │   subnet_id                   = data.aws_subnet.data_subnets_a.id
   8 │   monitoring                  = true
   9 └   ebs_optimized               = false
  ..   
────────────────────────────────────────



ec2-oracle_webgate-alb.tf (terraform)
=====================================
Tests: 1 (SUCCESSES: 0, FAILURES: 1)
Failures: 1 (HIGH: 1, CRITICAL: 0)

AVD-AWS-0052 (HIGH): Application load balancer is not set to drop invalid headers.
════════════════════════════════════════
Passing unknown or invalid headers through to the target poses a potential risk of compromise.
By setting drop_invalid_header_fields to true, anything that does not conform to well known, defined headers will be removed by the load balancer.


See https://avd.aquasec.com/misconfig/avd-aws-0052
────────────────────────────────────────
 ec2-oracle_webgate-alb.tf:1-19
────────────────────────────────────────
   1 ┌ resource "aws_lb" "webgate_lb" {
   2 │   name               = lower(format("lb-%s-webgate", local.application_name))
   3 │   internal           = true
   4 │   load_balancer_type = "application"
   5 │   security_groups    = [aws_security_group.sg_webgate_lb.id]
   6 │   subnets            = data.aws_subnets.shared-private.ids
   7 │ 
   8 │   enable_deletion_protection = true
   9 └ 
  ..   
────────────────────────────────────────



ec2-oracle_webgate.tf (terraform)
=================================
Tests: 1 (SUCCESSES: 0, FAILURES: 1)
Failures: 1 (HIGH: 1, CRITICAL: 0)

AVD-AWS-0028 (HIGH): Instance does not require IMDS access to require a token.
════════════════════════════════════════
IMDS v2 (Instance Metadata Service) introduced session authentication tokens which improve security when talking to IMDS.

By default <code>aws_instance</code> resource sets IMDS session auth tokens to be optional.

To fully protect IMDS you need to enable session tokens by using <code>metadata_options</code> block and its <code>http_tokens</code> variable set to <code>required</code>.


See https://avd.aquasec.com/misconfig/avd-aws-0028
────────────────────────────────────────
 ec2-oracle_webgate.tf:1-104
────────────────────────────────────────
   1 ┌ resource "aws_instance" "ec2_webgate" {
   2 │   count                  = local.application_data.accounts[local.environment].webgate_no_instances
   3 │   instance_type          = local.application_data.accounts[local.environment].ec2_oracle_instance_type_webgate
   4 │   ami                    = local.application_data.accounts[local.environment]["webgate_ami_id-${count.index + 1}"]
   5 │   key_name               = local.application_data.accounts[local.environment].key_name
   6 │   vpc_security_group_ids = [aws_security_group.ec2_sg_webgate.id]
   7 │   subnet_id              = local.private_subnets[count.index]
   8 │   #subnet_id                   = data.aws_subnet.data_subnets_a.id
   9 └   monitoring                  = true
  ..   
────────────────────────────────────────



s3.tf (terraform)
=================
Tests: 4 (SUCCESSES: 0, FAILURES: 4)
Failures: 4 (HIGH: 4, CRITICAL: 0)

AVD-AWS-0086 (HIGH): No public access block so not blocking public acls
════════════════════════════════════════
S3 buckets should block public ACLs on buckets and any objects they contain. By blocking, PUTs with fail if the object has any public ACL a.


See https://avd.aquasec.com/misconfig/avd-aws-0086
────────────────────────────────────────
 s3.tf:280-282
────────────────────────────────────────
 280 ┌ resource "aws_s3_bucket" "ccms_ebs_shared" {
 281 │   bucket = "${local.application_name}-${local.environment}-shared"
 282 └ }
────────────────────────────────────────


AVD-AWS-0087 (HIGH): No public access block so not blocking public policies
════════════════════════════════════════
S3 bucket policy should have block public policy to prevent users from putting a policy that enable public access.


See https://avd.aquasec.com/misconfig/avd-aws-0087
────────────────────────────────────────
 s3.tf:280-282
────────────────────────────────────────
 280 ┌ resource "aws_s3_bucket" "ccms_ebs_shared" {
 281 │   bucket = "${local.application_name}-${local.environment}-shared"
 282 └ }
────────────────────────────────────────


AVD-AWS-0091 (HIGH): No public access block so not blocking public acls
════════════════════════════════════════
S3 buckets should ignore public ACLs on buckets and any objects they contain. By ignoring rather than blocking, PUT calls with public ACLs will still be applied but the ACL will be ignored.


See https://avd.aquasec.com/misconfig/avd-aws-0091
────────────────────────────────────────
 s3.tf:280-282
────────────────────────────────────────
 280 ┌ resource "aws_s3_bucket" "ccms_ebs_shared" {
 281 │   bucket = "${local.application_name}-${local.environment}-shared"
 282 └ }
────────────────────────────────────────


AVD-AWS-0093 (HIGH): No public access block so not restricting public buckets
════════════════════════════════════════
S3 buckets should restrict public policies for the bucket. By enabling, the restrict_public_buckets, only the bucket owner and AWS Services can access if it has a public policy.


See https://avd.aquasec.com/misconfig/avd-aws-0093
────────────────────────────────────────
 s3.tf:280-282
────────────────────────────────────────
 280 ┌ resource "aws_s3_bucket" "ccms_ebs_shared" {
 281 │   bucket = "${local.application_name}-${local.environment}-shared"
 282 └ }
────────────────────────────────────────


trivy_exitcode=1

*****************************

Running Trivy in terraform/environments/ccms-ebs
2024-11-04T13:24:51Z	INFO	[vuln] Vulnerability scanning is enabled
2024-11-04T13:24:51Z	INFO	[misconfig] Misconfiguration scanning is enabled
2024-11-04T13:24:51Z	INFO	[secret] Secret scanning is enabled
2024-11-04T13:24:51Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-11-04T13:24:51Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2024-11-04T13:24:52Z	INFO	[terraform scanner] Scanning root module	file_path="."
2024-11-04T13:24:52Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="networking"
2024-11-04T13:24:52Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_cloudwatch_log_group.groups" value="cty.NilVal"
2024-11-04T13:24:52Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_security_group_rule.all_internal_egress_traffic" value="cty.NilVal"
2024-11-04T13:24:52Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_security_group_rule.all_internal_ingress_traffic" value="cty.NilVal"
2024-11-04T13:24:52Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.s3-bucket.aws_s3_bucket_lifecycle_configuration.default" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_lifecycle_configuration.default.dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-04T13:24:52Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.s3-bucket.aws_s3_bucket_lifecycle_configuration.default" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_lifecycle_configuration.default.dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-04T13:24:52Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.s3-bucket-dbbackup.aws_s3_bucket_lifecycle_configuration.default" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_lifecycle_configuration.default.dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-04T13:24:52Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.s3-bucket-dbbackup.aws_s3_bucket_lifecycle_configuration.default" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_lifecycle_configuration.default.dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-04T13:24:52Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.s3-bucket-logging.aws_s3_bucket_lifecycle_configuration.default" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_lifecycle_configuration.default.dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-04T13:24:52Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.s3-bucket-logging.aws_s3_bucket_lifecycle_configuration.default" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_lifecycle_configuration.default.dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-04T13:24:52Z	INFO	[terraform scanner] Scanning root module	file_path="modules"
2024-11-04T13:24:52Z	INFO	[terraform scanner] Scanning root module	file_path="modules/cw-logs"
2024-11-04T13:24:55Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.1.0/main.tf:171-179"
2024-11-04T13:24:55Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-user-attached-policies" range="ccms-iam.tf:283-289"
2024-11-04T13:24:56Z	INFO	Number of language-specific files	num=0
2024-11-04T13:24:56Z	INFO	Detected config files	num=27

ccms-ec2-oracle_accessgate.tf (terraform)
=========================================
Tests: 1 (SUCCESSES: 0, FAILURES: 1)
Failures: 1 (HIGH: 1, CRITICAL: 0)

AVD-AWS-0028 (HIGH): Instance does not require IMDS access to require a token.
════════════════════════════════════════
IMDS v2 (Instance Metadata Service) introduced session authentication tokens which improve security when talking to IMDS.

By default <code>aws_instance</code> resource sets IMDS session auth tokens to be optional.

To fully protect IMDS you need to enable session tokens by using <code>metadata_options</code> block and its <code>http_tokens</code> variable set to <code>required</code>.


See https://avd.aquasec.com/misconfig/avd-aws-0028
────────────────────────────────────────
 ccms-ec2-oracle_accessgate.tf:1-104
────────────────────────────────────────
   1 ┌ resource "aws_instance" "ec2_accessgate" {
   2 │   count                  = local.application_data.accounts[local.environment].accessgate_no_instances
   3 │   instance_type          = local.application_data.accounts[local.environment].ec2_oracle_instance_type_accessgate
   4 │   ami                    = local.application_data.accounts[local.environment]["accessgate_ami_id-${count.index + 1}"]
   5 │   key_name               = local.application_data.accounts[local.environment].key_name
   6 │   vpc_security_group_ids = [aws_security_group.ec2_sg_accessgate.id]
   7 │   subnet_id              = local.private_subnets[count.index]
   8 │   #subnet_id                   = data.aws_subnet.data_subnets_a.id
   9 └   monitoring                  = true
  ..   
────────────────────────────────────────



ccms-ec2-oracle_ebs_apps-alb.tf (terraform)
===========================================
Tests: 2 (SUCCESSES: 0, FAILURES: 2)
Failures: 2 (HIGH: 2, CRITICAL: 0)

AVD-AWS-0052 (HIGH): Application load balancer is not set to drop invalid headers.
════════════════════════════════════════
Passing unknown or invalid headers through to the target poses a potential risk of compromise.
By setting drop_invalid_header_fields to true, anything that does not conform to well known, defined headers will be removed by the load balancer.


See https://avd.aquasec.com/misconfig/avd-aws-0052
────────────────────────────────────────
 ccms-ec2-oracle_ebs_apps-alb.tf:1-19
────────────────────────────────────────
   1 ┌ resource "aws_lb" "ebsapps_lb" {
   2 │   name               = lower(format("lb-%s-%s-ebsapp", local.application_name, local.environment))
   3 │   internal           = false
   4 │   load_balancer_type = "application"
   5 │   security_groups    = [aws_security_group.sg_ebsapps_lb.id]
   6 │   subnets            = data.aws_subnets.shared-public.ids
   7 │ 
   8 │   enable_deletion_protection = true
   9 └ 
  ..   
────────────────────────────────────────


AVD-AWS-0053 (HIGH): Load balancer is exposed publicly.
════════════════════════════════════════
There are many scenarios in which you would want to expose a load balancer to the wider internet, but this check exists as a warning to prevent accidental exposure of internal assets. You should ensure that this resource should be exposed publicly.


See https://avd.aquasec.com/misconfig/avd-aws-0053
────────────────────────────────────────
 ccms-ec2-oracle_ebs_apps-alb.tf:1-19
────────────────────────────────────────
   1 ┌ resource "aws_lb" "ebsapps_lb" {
   2 │   name               = lower(format("lb-%s-%s-ebsapp", local.application_name, local.environment))
   3 │   internal           = false
   4 │   load_balancer_type = "application"
   5 │   security_groups    = [aws_security_group.sg_ebsapps_lb.id]
   6 │   subnets            = data.aws_subnets.shared-public.ids
   7 │ 
   8 │   enable_deletion_protection = true
   9 └ 
  ..   
────────────────────────────────────────



ccms-ec2-oracle_ebs_apps-nlb.tf (terraform)
===========================================
Tests: 1 (SUCCESSES: 0, FAILURES: 1)
Failures: 1 (HIGH: 1, CRITICAL: 0)

AVD-AWS-0053 (HIGH): Load balancer is exposed publicly.
════════════════════════════════════════
There are many scenarios in which you would want to expose a load balancer to the wider internet, but this check exists as a warning to prevent accidental exposure of internal assets. You should ensure that this resource should be exposed publicly.


See https://avd.aquasec.com/misconfig/avd-aws-0053
────────────────────────────────────────
 ccms-ec2-oracle_ebs_apps-nlb.tf:16-42
────────────────────────────────────────
  16 ┌ resource "aws_lb" "ebsapps_nlb" {
  17 │   name               = lower(format("nlb-%s-%s-ebs", local.application_name, local.environment))
  18 │   internal           = false
  19 │   load_balancer_type = "network"
  20 │ 
  21 │   enable_deletion_protection       = true
  22 │   enable_cross_zone_load_balancing = true
  23 │ 
  24 └   subnet_mapping {
  ..   
────────────────────────────────────────



ccms-ec2-oracle_ebs_apps.tf (terraform)
=======================================
Tests: 1 (SUCCESSES: 0, FAILURES: 1)
Failures: 1 (HIGH: 1, CRITICAL: 0)

AVD-AWS-0028 (HIGH): Instance does not require IMDS access to require a token.
════════════════════════════════════════
IMDS v2 (Instance Metadata Service) introduced session authentication tokens which improve security when talking to IMDS.

By default <code>aws_instance</code> resource sets IMDS session auth tokens to be optional.

To fully protect IMDS you need to enable session tokens by using <code>metadata_options</code> block and its <code>http_tokens</code> variable set to <code>required</code>.


See https://avd.aquasec.com/misconfig/avd-aws-0028
────────────────────────────────────────
 ccms-ec2-oracle_ebs_apps.tf:1-127
────────────────────────────────────────
   1 ┌ resource "aws_instance" "ec2_ebsapps" {
   2 │   count                  = local.application_data.accounts[local.environment].ebsapps_no_instances
   3 │   instance_type          = local.application_data.accounts[local.environment].ec2_oracle_instance_type_ebsapps
   4 │   ami                    = local.application_data.accounts[local.environment]["ebsapps_ami_id-${count.index + 1}"]
   5 │   key_name               = local.application_data.accounts[local.environment].key_name
   6 │   vpc_security_group_ids = [aws_security_group.ec2_sg_ebsapps.id]
   7 │   subnet_id              = local.private_subnets[count.index]
   8 │   #subnet_id                   = data.aws_subnet.data_subnets_a.id
   9 └   monitoring                  = true
  ..   
────────────────────────────────────────



ccms-ec2-oracle_ebs_db.tf (terraform)
=====================================
Tests: 1 (SUCCESSES: 0, FAILURES: 1)
Failures: 1 (HIGH: 1, CRITICAL: 0)

AVD-AWS-0131 (HIGH): Root block device is not encrypted.
════════════════════════════════════════
Block devices should be encrypted to ensure sensitive data is held securely at rest.


See https://avd.aquasec.com/misconfig/avd-aws-0131
────────────────────────────────────────
 ccms-ec2-oracle_ebs_db.tf:1-68
────────────────────────────────────────
   1 ┌ resource "aws_instance" "ec2_oracle_ebs" {
   2 │   instance_type = local.application_data.accounts[local.environment].ec2_oracle_instance_type_ebsdb
   3 │   #ami                         = data.aws_ami.oracle_db.id
   4 │   ami                         = local.application_data.accounts[local.environment].ebsdb_ami_id
   5 │   key_name                    = local.application_data.accounts[local.environment].key_name
   6 │   vpc_security_group_ids      = [aws_security_group.ec2_sg_ebsdb.id]
   7 │   subnet_id                   = data.aws_subnet.data_subnets_a.id
   8 │   monitoring                  = true
   9 └   ebs_optimized               = false
  ..   
────────────────────────────────────────



ccms-ec2-oracle_webgate-alb.tf (terraform)
==========================================
Tests: 3 (SUCCESSES: 0, FAILURES: 3)
Failures: 3 (HIGH: 3, CRITICAL: 0)

AVD-AWS-0052 (HIGH): Application load balancer is not set to drop invalid headers.
════════════════════════════════════════
Passing unknown or invalid headers through to the target poses a potential risk of compromise.
By setting drop_invalid_header_fields to true, anything that does not conform to well known, defined headers will be removed by the load balancer.


See https://avd.aquasec.com/misconfig/avd-aws-0052
────────────────────────────────────────
 ccms-ec2-oracle_webgate-alb.tf:1-20
────────────────────────────────────────
   1 ┌ resource "aws_lb" "webgate_lb" {
   2 │   count              = local.is-production ? 1 : 1
   3 │   name               = lower(format("lb-%s-%s-wgate", local.application_name, local.environment))
   4 │   internal           = true
   5 │   load_balancer_type = "application"
   6 │   security_groups    = [aws_security_group.sg_webgate_lb.id]
   7 │   subnets            = data.aws_subnets.shared-private.ids
   8 │ 
   9 └   enable_deletion_protection = true
  ..   
────────────────────────────────────────


AVD-AWS-0052 (HIGH): Application load balancer is not set to drop invalid headers.
════════════════════════════════════════
Passing unknown or invalid headers through to the target poses a potential risk of compromise.
By setting drop_invalid_header_fields to true, anything that does not conform to well known, defined headers will be removed by the load balancer.


See https://avd.aquasec.com/misconfig/avd-aws-0052
────────────────────────────────────────
 ccms-ec2-oracle_webgate-alb.tf:62-80
────────────────────────────────────────
  62 ┌ resource "aws_lb" "webgate_public_lb" {
  63 │   name               = lower(format("public-alb-webgate"))
  64 │   internal           = false
  65 │   load_balancer_type = "application"
  66 │   security_groups    = [aws_security_group.sg_webgate_lb.id]
  67 │   subnets            = data.aws_subnets.shared-public.ids
  68 │ 
  69 │   enable_deletion_protection = true
  70 └ 
  ..   
────────────────────────────────────────


AVD-AWS-0053 (HIGH): Load balancer is exposed publicly.
════════════════════════════════════════
There are many scenarios in which you would want to expose a load balancer to the wider internet, but this check exists as a warning to prevent accidental exposure of internal assets. You should ensure that this resource should be exposed publicly.


See https://avd.aquasec.com/misconfig/avd-aws-0053
────────────────────────────────────────
 ccms-ec2-oracle_webgate-alb.tf:62-80
────────────────────────────────────────
  62 ┌ resource "aws_lb" "webgate_public_lb" {
  63 │   name               = lower(format("public-alb-webgate"))
  64 │   internal           = false
  65 │   load_balancer_type = "application"
  66 │   security_groups    = [aws_security_group.sg_webgate_lb.id]
  67 │   subnets            = data.aws_subnets.shared-public.ids
  68 │ 
  69 │   enable_deletion_protection = true
  70 └ 
  ..   
────────────────────────────────────────



ccms-ec2-oracle_webgate-nlb.tf (terraform)
==========================================
Tests: 1 (SUCCESSES: 0, FAILURES: 1)
Failures: 1 (HIGH: 1, CRITICAL: 0)

AVD-AWS-0053 (HIGH): Load balancer is exposed publicly.
════════════════════════════════════════
There are many scenarios in which you would want to expose a load balancer to the wider internet, but this check exists as a warning to prevent accidental exposure of internal assets. You should ensure that this resource should be exposed publicly.


See https://avd.aquasec.com/misconfig/avd-aws-0053
────────────────────────────────────────
 ccms-ec2-oracle_webgate-nlb.tf:16-42
────────────────────────────────────────
  16 ┌ resource "aws_lb" "webgate_nlb" {
  17 │   name               = lower(format("public-nlb-webgate"))
  18 │   internal           = false
  19 │   load_balancer_type = "network"
  20 │ 
  21 │   enable_deletion_protection       = true
  22 │   enable_cross_zone_load_balancing = true
  23 │ 
  24 └   subnet_mapping {
  ..   
────────────────────────────────────────



ccms-ec2-oracle_webgate.tf (terraform)
======================================
Tests: 1 (SUCCESSES: 0, FAILURES: 1)
Failures: 1 (HIGH: 1, CRITICAL: 0)

AVD-AWS-0028 (HIGH): Instance does not require IMDS access to require a token.
════════════════════════════════════════
IMDS v2 (Instance Metadata Service) introduced session authentication tokens which improve security when talking to IMDS.

By default <code>aws_instance</code> resource sets IMDS session auth tokens to be optional.

To fully protect IMDS you need to enable session tokens by using <code>metadata_options</code> block and its <code>http_tokens</code> variable set to <code>required</code>.


See https://avd.aquasec.com/misconfig/avd-aws-0028
────────────────────────────────────────
 ccms-ec2-oracle_webgate.tf:1-104
────────────────────────────────────────
   1 ┌ resource "aws_instance" "ec2_webgate" {
   2 │   count                  = local.application_data.accounts[local.environment].webgate_no_instances
   3 │   instance_type          = local.application_data.accounts[local.environment].ec2_oracle_instance_type_webgate
   4 │   ami                    = local.application_data.accounts[local.environment]["webgate_ami_id-${count.index + 1}"]
   5 │   key_name               = local.application_data.accounts[local.environment].key_name
   6 │   vpc_security_group_ids = [aws_security_group.ec2_sg_webgate.id]
   7 │   subnet_id              = local.private_subnets[count.index]
   8 │   #subnet_id                   = data.aws_subnet.data_subnets_a.id
   9 └   monitoring                  = true
  ..   
────────────────────────────────────────



ccms-s3.tf (terraform)
======================
Tests: 8 (SUCCESSES: 0, FAILURES: 8)
Failures: 8 (HIGH: 8, CRITICAL: 0)

AVD-AWS-0086 (HIGH): No public access block so not blocking public acls
════════════════════════════════════════
S3 buckets should block public ACLs on buckets and any objects they contain. By blocking, PUTs with fail if the object has any public ACL a.


See https://avd.aquasec.com/misconfig/avd-aws-0086
────────────────────────────────────────
 ccms-s3.tf:286-288
────────────────────────────────────────
 286 ┌ resource "aws_s3_bucket" "ccms_ebs_shared" {
 287 │   bucket = "${local.application_name}-${local.environment}-shared"
 288 └ }
────────────────────────────────────────


AVD-AWS-0086 (HIGH): No public access block so not blocking public acls
════════════════════════════════════════
S3 buckets should block public ACLs on buckets and any objects they contain. By blocking, PUTs with fail if the object has any public ACL a.


See https://avd.aquasec.com/misconfig/avd-aws-0086
────────────────────────────────────────
 ccms-s3.tf:293-295
────────────────────────────────────────
 293 ┌ resource "aws_s3_bucket" "lambda_payment_load" {
 294 │   bucket = "${local.application_name}-${local.environment}-payment-load"
 295 └ }
────────────────────────────────────────


AVD-AWS-0087 (HIGH): No public access block so not blocking public policies
════════════════════════════════════════
S3 bucket policy should have block public policy to prevent users from putting a policy that enable public access.


See https://avd.aquasec.com/misconfig/avd-aws-0087
────────────────────────────────────────
 ccms-s3.tf:286-288
────────────────────────────────────────
 286 ┌ resource "aws_s3_bucket" "ccms_ebs_shared" {
 287 │   bucket = "${local.application_name}-${local.environment}-shared"
 288 └ }
────────────────────────────────────────


AVD-AWS-0087 (HIGH): No public access block so not blocking public policies
════════════════════════════════════════
S3 bucket policy should have block public policy to prevent users from putting a policy that enable public access.


See https://avd.aquasec.com/misconfig/avd-aws-0087
────────────────────────────────────────
 ccms-s3.tf:293-295
────────────────────────────────────────
 293 ┌ resource "aws_s3_bucket" "lambda_payment_load" {
 294 │   bucket = "${local.application_name}-${local.environment}-payment-load"
 295 └ }
────────────────────────────────────────


AVD-AWS-0091 (HIGH): No public access block so not blocking public acls
════════════════════════════════════════
S3 buckets should ignore public ACLs on buckets and any objects they contain. By ignoring rather than blocking, PUT calls with public ACLs will still be applied but the ACL will be ignored.


See https://avd.aquasec.com/misconfig/avd-aws-0091
────────────────────────────────────────
 ccms-s3.tf:286-288
────────────────────────────────────────
 286 ┌ resource "aws_s3_bucket" "ccms_ebs_shared" {
 287 │   bucket = "${local.application_name}-${local.environment}-shared"
 288 └ }
────────────────────────────────────────


AVD-AWS-0091 (HIGH): No public access block so not blocking public acls
════════════════════════════════════════
S3 buckets should ignore public ACLs on buckets and any objects they contain. By ignoring rather than blocking, PUT calls with public ACLs will still be applied but the ACL will be ignored.


See https://avd.aquasec.com/misconfig/avd-aws-0091
────────────────────────────────────────
 ccms-s3.tf:293-295
────────────────────────────────────────
 293 ┌ resource "aws_s3_bucket" "lambda_payment_load" {
 294 │   bucket = "${local.application_name}-${local.environment}-payment-load"
 295 └ }
────────────────────────────────────────


AVD-AWS-0093 (HIGH): No public access block so not restricting public buckets
════════════════════════════════════════
S3 buckets should restrict public policies for the bucket. By enabling, the restrict_public_buckets, only the bucket owner and AWS Services can access if it has a public policy.


See https://avd.aquasec.com/misconfig/avd-aws-0093
────────────────────────────────────────
 ccms-s3.tf:286-288
────────────────────────────────────────
 286 ┌ resource "aws_s3_bucket" "ccms_ebs_shared" {
 287 │   bucket = "${local.application_name}-${local.environment}-shared"
 288 └ }
────────────────────────────────────────


AVD-AWS-0093 (HIGH): No public access block so not restricting public buckets
════════════════════════════════════════
S3 buckets should restrict public policies for the bucket. By enabling, the restrict_public_buckets, only the bucket owner and AWS Services can access if it has a public policy.


See https://avd.aquasec.com/misconfig/avd-aws-0093
────────────────────────────────────────
 ccms-s3.tf:293-295
────────────────────────────────────────
 293 ┌ resource "aws_s3_bucket" "lambda_payment_load" {
 294 │   bucket = "${local.application_name}-${local.environment}-payment-load"
 295 └ }
────────────────────────────────────────


trivy_exitcode=2

ep-93

Approved to run workflows, thanks to Aarons input

reviewed by MP team

CC-2923: SSM command for executing 'yum update'.

4826bdf

mmgovuk requested a review from SahidKhan89 November 4, 2024 13:22

mmgovuk self-assigned this Nov 4, 2024

github-actions bot added the environments-repository Used to exclude PRs from this repo in our Slack PR update label Nov 4, 2024

mmgovuk temporarily deployed to ccms-ebs-upgrade-development November 4, 2024 13:23 — with GitHub Actions Inactive

modernisation-platform-ci requested changes Nov 4, 2024

View reviewed changes

mmgovuk had a problem deploying to ccms-ebs-upgrade-test November 4, 2024 13:24 — with GitHub Actions Error

modernisation-platform-ci previously requested changes Nov 4, 2024

View reviewed changes

mmgovuk marked this pull request as ready for review November 4, 2024 13:46

mmgovuk requested review from a team as code owners November 4, 2024 13:46

ep-93 approved these changes Nov 4, 2024

View reviewed changes

mmgovuk temporarily deployed to ccms-ebs-test November 4, 2024 14:01 — with GitHub Actions Inactive

mmgovuk temporarily deployed to ccms-ebs-development November 4, 2024 14:01 — with GitHub Actions Inactive

SahidKhan89 approved these changes Nov 4, 2024

View reviewed changes

mmgovuk merged commit 9ec4b20 into main Nov 4, 2024
20 of 22 checks passed

mmgovuk deleted the CC-2923/ssm-command-system-update branch November 4, 2024 16:55

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

CC-2923: SSM command for executing 'yum update'. #8553

CC-2923: SSM command for executing 'yum update'. #8553

mmgovuk commented Nov 4, 2024

modernisation-platform-ci left a comment

modernisation-platform-ci commented Nov 4, 2024

modernisation-platform-ci left a comment

modernisation-platform-ci commented Nov 4, 2024

modernisation-platform-ci left a comment

modernisation-platform-ci commented Nov 4, 2024

modernisation-platform-ci left a comment

modernisation-platform-ci commented Nov 4, 2024

github-actions bot commented Nov 4, 2024

ec2-oracle_accessgate.tf (terraform)

ec2-oracle_ebs_apps-alb.tf (terraform)

ec2-oracle_ebs_apps.tf (terraform)

ec2-oracle_ebs_conc.tf (terraform)

ec2-oracle_ebs_db.tf (terraform)

ec2-oracle_webgate-alb.tf (terraform)

ec2-oracle_webgate.tf (terraform)

s3.tf (terraform)

ccms-ec2-oracle_accessgate.tf (terraform)

ccms-ec2-oracle_ebs_apps-alb.tf (terraform)

ccms-ec2-oracle_ebs_apps-nlb.tf (terraform)

ccms-ec2-oracle_ebs_apps.tf (terraform)

ccms-ec2-oracle_ebs_db.tf (terraform)

ccms-ec2-oracle_webgate-alb.tf (terraform)

ccms-ec2-oracle_webgate-nlb.tf (terraform)

ccms-ec2-oracle_webgate.tf (terraform)

ccms-s3.tf (terraform)

ep-93 left a comment

CC-2923: SSM command for executing 'yum update'. #8553

CC-2923: SSM command for executing 'yum update'. #8553

Conversation

mmgovuk commented Nov 4, 2024

modernisation-platform-ci left a comment

Choose a reason for hiding this comment

modernisation-platform-ci commented Nov 4, 2024

modernisation-platform-ci left a comment

Choose a reason for hiding this comment

modernisation-platform-ci commented Nov 4, 2024

modernisation-platform-ci left a comment

Choose a reason for hiding this comment

modernisation-platform-ci commented Nov 4, 2024

modernisation-platform-ci left a comment

Choose a reason for hiding this comment

modernisation-platform-ci commented Nov 4, 2024

github-actions bot commented Nov 4, 2024

Trivy Scan Failed

ec2-oracle_accessgate.tf (terraform)

ec2-oracle_ebs_apps-alb.tf (terraform)

ec2-oracle_ebs_apps.tf (terraform)

ec2-oracle_ebs_conc.tf (terraform)

ec2-oracle_ebs_db.tf (terraform)

ec2-oracle_webgate-alb.tf (terraform)

ec2-oracle_webgate.tf (terraform)

s3.tf (terraform)

ccms-ec2-oracle_accessgate.tf (terraform)

ccms-ec2-oracle_ebs_apps-alb.tf (terraform)

ccms-ec2-oracle_ebs_apps-nlb.tf (terraform)

ccms-ec2-oracle_ebs_apps.tf (terraform)

ccms-ec2-oracle_ebs_db.tf (terraform)

ccms-ec2-oracle_webgate-alb.tf (terraform)

ccms-ec2-oracle_webgate-nlb.tf (terraform)

ccms-ec2-oracle_webgate.tf (terraform)

ccms-s3.tf (terraform)

CTFLint Scan Failed

Trivy Scan Failed

ep-93 left a comment

Choose a reason for hiding this comment

`Trivy Scan` Failed

`CTFLint Scan` Failed

`Trivy Scan` Failed