Bump terraform-aws-modules/iam/aws from 5.44.1 to 5.48.0 in /terraform/environments/analytical-platform-ingestion #8636

dependabot · 2024-11-12T00:41:24Z

Bumps terraform-aws-modules/iam/aws from 5.44.1 to 5.48.0.

Release notes

Sourced from terraform-aws-modules/iam/aws's releases.

v5.48.0

5.48.0 (2024-11-11)

Features

Add ec2:GetSecurityGroupsForVpc for AWS LB Controller v2.10.0 (#536) (9cfab4a)

v5.47.1

5.47.1 (2024-10-22)

Bug Fixes

Use dynamic partition value (#532) (9986b50)

v5.47.0

5.47.0 (2024-10-21)

Features

Update AWS EBS CSI Driver IAM Policy (#530) (1bc058c)

Bug Fixes

Update CI workflow versions to latest (#527) (15fd175)

v5.46.0

5.46.0 (2024-10-04)

Features

Update IAM policy for AWS Load Balancer Controller to support Listener Attributes (#525) (966c4f8)

v5.45.0

5.45.0 (2024-10-04)

Features

Allow modifying the iam-github-oidc-role subject condition (#523) (f2ade86)

v5.44.2

5.44.2 (2024-10-01)

Bug Fixes

... (truncated)

Changelog

Sourced from terraform-aws-modules/iam/aws's changelog.

5.48.0 (2024-11-11)

Features

Add ec2:GetSecurityGroupsForVpc for AWS LB Controller v2.10.0 (#536) (9cfab4a)

5.47.1 (2024-10-22)

Bug Fixes

Use dynamic partition value (#532) (9986b50)

5.47.0 (2024-10-21)

Features

Update AWS EBS CSI Driver IAM Policy (#530) (1bc058c)

Bug Fixes

Update CI workflow versions to latest (#527) (15fd175)

5.46.0 (2024-10-04)

Features

Update IAM policy for AWS Load Balancer Controller to support Listener Attributes (#525) (966c4f8)

5.45.0 (2024-10-04)

Features

Allow modifying the iam-github-oidc-role subject condition (#523) (f2ade86)

5.44.2 (2024-10-01)

Bug Fixes

Add required S3 PutObjectTagging permission to Velero IRSA policy (#517) (f0e65a7)

Commits

e20e0b9 chore(release): version 5.48.0 [skip ci]
9cfab4a feat: Add ec2:GetSecurityGroupsForVpc for AWS LB Controller v2.10.0 (#536)
ef31aca docs: Add Mountpoint S3 CSI Driver to the list of optional supported policies...
cfb6845 chore(release): version 5.47.1 [skip ci]
9986b50 fix: Use dynamic partition value (#532)
0773c17 chore(release): version 5.47.0 [skip ci]
1bc058c feat: Update AWS EBS CSI Driver IAM Policy (#530)
15fd175 fix: Update CI workflow versions to latest (#527)
617f4cb chore(release): version 5.46.0 [skip ci]
966c4f8 feat: Update IAM policy for AWS Load Balancer Controller to support Listener ...
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

github-actions · 2024-11-12T00:44:04Z

`Trivy Scan` Failed

Show Output

```hcl

Trivy will check the following folders:
terraform/environments/analytical-platform-ingestion
terraform/environments/analytical-platform-ingestion/modules/transfer-family/user-with-egress
terraform/environments/analytical-platform-ingestion/modules/transfer-family/user
terraform/environments/analytical-platform-ingestion

Running Trivy in terraform/environments/analytical-platform-ingestion
2024-11-12T00:43:34Z INFO [vulndb] Need to update DB
2024-11-12T00:43:34Z INFO [vulndb] Downloading vulnerability DB...
2024-11-12T00:43:34Z INFO [vulndb] Downloading artifact... repo="public.ecr.aws/aquasecurity/trivy-db:2"
2024-11-12T00:43:37Z INFO [vulndb] Artifact successfully downloaded repo="public.ecr.aws/aquasecurity/trivy-db:2"
2024-11-12T00:43:37Z INFO [vuln] Vulnerability scanning is enabled
2024-11-12T00:43:37Z INFO [misconfig] Misconfiguration scanning is enabled
2024-11-12T00:43:37Z INFO [misconfig] Need to update the built-in checks
2024-11-12T00:43:37Z INFO [misconfig] Downloading the built-in checks...
160.60 KiB / 160.60 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2024-11-12T00:43:37Z INFO [secret] Secret scanning is enabled
2024-11-12T00:43:37Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-11-12T00:43:37Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2024-11-12T00:43:38Z INFO [terraform scanner] Scanning root module file_path="."
2024-11-12T00:43:38Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="networking"
2024-11-12T00:43:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.connected_vpc_transit_gateway_routes" value="cty.NilVal"
2024-11-12T00:43:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.sftp_users" value="cty.NilVal"
2024-11-12T00:43:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.sftp_users_with_egress" value="cty.NilVal"
2024-11-12T00:43:42Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.bold_egress_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-12T00:43:42Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.bold_egress_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-12T00:43:43Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.definition_upload_lambda.aws_lambda_function.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.vpc_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.logging_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-12T00:43:43Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.definition_upload_lambda.aws_lambda_function.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.vpc_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.logging_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-12T00:43:43Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.definition_upload_lambda.aws_lambda_function.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.vpc_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.logging_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-12T00:43:43Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.definition_upload_lambda.aws_lambda_function.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.vpc_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.logging_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-12T00:43:43Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.definitions_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-12T00:43:43Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.definitions_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-12T00:43:43Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.definition_upload_lambda.aws_lambda_function.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.vpc_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.logging_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-12T00:43:43Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.definition_upload_lambda.aws_lambda_function.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.vpc_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.logging_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-12T00:43:44Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-bucket-encryption" range="git::https:/github.com/terraform-aws-modules/terraform-aws-s3-bucket?ref=8a0b697adfbc673e6135c70246cff7f8052ad95a/main.tf:176-198"
2024-11-12T00:43:44Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-public-egress-sgr" range="terraform-aws-modules/security-group/aws/main.tf:533"
2024-11-12T00:43:44Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-public-egress-sgr" range="terraform-aws-modules/security-group/aws/main.tf:534"
2024-11-12T00:43:44Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="git::https:/github.com/terraform-aws-modules/terraform-aws-s3-bucket?ref=8a0b697adfbc673e6135c70246cff7f8052ad95a/main.tf:176-198"
2024-11-12T00:43:44Z INFO Number of language-specific files num=0
2024-11-12T00:43:44Z INFO Detected config files num=10

git::https:/github.com/terraform-aws-modules/terraform-aws-alb?ref=349540d1a611cd98a6383cc64ef0d9bf08d88fb7/main.tf (terraform)

Tests: 1 (SUCCESSES: 0, FAILURES: 1)
Failures: 1 (HIGH: 1, CRITICAL: 0)

AVD-AWS-0053 (HIGH): Load balancer is exposed publicly.
════════════════════════════════════════
There are many scenarios in which you would want to expose a load balancer to the wider internet, but this check exists as a warning to prevent accidental exposure of internal assets. You should ensure that this resource should be exposed publicly.

See https://avd.aquasec.com/misconfig/avd-aws-0053
────────────────────────────────────────
git::https:/github.com/terraform-aws-modules/terraform-aws-alb?ref=349540d1a611cd98a6383cc64ef0d9bf08d88fb7/main.tf:12-81
via network-load-balancers.tf:1-37 (module.datasync_activation_nlb)
────────────────────────────────────────
12 ┌ resource "aws_lb" "this" {
13 │ count = local.create ? 1 : 0
14 │
15 │ dynamic "access_logs" {
16 │ for_each = length(var.access_logs) > 0 ? [var.access_logs] : []
17 │
18 │ content {
19 │ bucket = access_logs.value.bucket
20 └ enabled = try(access_logs.value.enabled, true)
..
────────────────────────────────────────

git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf (terraform)

Tests: 4 (SUCCESSES: 0, FAILURES: 4)
Failures: 4 (HIGH: 0, CRITICAL: 4)

AVD-AWS-0102 (CRITICAL): Network ACL rule allows access using ALL ports.
════════════════════════════════════════
Ensure access to specific required ports is allowed, and nothing else.

See https://avd.aquasec.com/misconfig/aws-vpc-no-excessive-port-access
────────────────────────────────────────
git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:340
via git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:328-343 (aws_network_acl_rule.private_outbound[0])
via vpc.tf:1-23 (module.connected_vpc)
────────────────────────────────────────
328 resource "aws_network_acl_rule" "private_outbound" {
...
340 [ protocol = var.private_outbound_acl_rules[count.index]["protocol"]
...
343 }
────────────────────────────────────────

AVD-AWS-0102 (CRITICAL): Network ACL rule allows access using ALL ports.
════════════════════════════════════════
Ensure access to specific required ports is allowed, and nothing else.

See https://avd.aquasec.com/misconfig/aws-vpc-no-excessive-port-access
────────────────────────────────────────
git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:323
via git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:311-326 (aws_network_acl_rule.private_inbound[0])
via vpc.tf:1-23 (module.connected_vpc)
────────────────────────────────────────
311 resource "aws_network_acl_rule" "private_inbound" {
...
323 [ protocol = var.private_inbound_acl_rules[count.index]["protocol"]
...
326 }
────────────────────────────────────────

AVD-AWS-0102 (CRITICAL): Network ACL rule allows access using ALL ports.
════════════════════════════════════════
Ensure access to specific required ports is allowed, and nothing else.

See https://avd.aquasec.com/misconfig/aws-vpc-no-excessive-port-access
────────────────────────────────────────
git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:221
via git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:209-224 (aws_network_acl_rule.public_outbound[0])
via vpc.tf:1-23 (module.connected_vpc)
────────────────────────────────────────
209 resource "aws_network_acl_rule" "public_outbound" {
...
221 [ protocol = var.public_outbound_acl_rules[count.index]["protocol"]
...
224 }
────────────────────────────────────────

AVD-AWS-0102 (CRITICAL): Network ACL rule allows access using ALL ports.
════════════════════════════════════════
Ensure access to specific required ports is allowed, and nothing else.

See https://avd.aquasec.com/misconfig/aws-vpc-no-excessive-port-access
────────────────────────────────────────
git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:204
via git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:192-207 (aws_network_acl_rule.public_inbound[0])
via vpc.tf:1-23 (module.connected_vpc)
────────────────────────────────────────
192 resource "aws_network_acl_rule" "public_inbound" {
...
204 [ protocol = var.public_inbound_acl_rules[count.index]["protocol"]
...
207 }
────────────────────────────────────────

terraform-aws-modules/vpc/aws/main.tf (terraform)

Tests: 4 (SUCCESSES: 0, FAILURES: 4)
Failures: 4 (HIGH: 0, CRITICAL: 4)

AVD-AWS-0102 (CRITICAL): Network ACL rule allows access using ALL ports.
════════════════════════════════════════
Ensure access to specific required ports is allowed, and nothing else.

See https://avd.aquasec.com/misconfig/aws-vpc-no-excessive-port-access
────────────────────────────────────────
terraform-aws-modules/vpc/aws/main.tf:340
via terraform-aws-modules/vpc/aws/main.tf:328-343 (aws_network_acl_rule.private_outbound[0])
via vpc.tf:25-46 (module.isolated_vpc)
────────────────────────────────────────
328 resource "aws_network_acl_rule" "private_outbound" {
...
340 [ protocol = var.private_outbound_acl_rules[count.index]["protocol"]
...
343 }
────────────────────────────────────────

AVD-AWS-0102 (CRITICAL): Network ACL rule allows access using ALL ports.
════════════════════════════════════════
Ensure access to specific required ports is allowed, and nothing else.

See https://avd.aquasec.com/misconfig/aws-vpc-no-excessive-port-access
────────────────────────────────────────
terraform-aws-modules/vpc/aws/main.tf:323
via terraform-aws-modules/vpc/aws/main.tf:311-326 (aws_network_acl_rule.private_inbound[0])
via vpc.tf:25-46 (module.isolated_vpc)
────────────────────────────────────────
311 resource "aws_network_acl_rule" "private_inbound" {
...
323 [ protocol = var.private_inbound_acl_rules[count.index]["protocol"]
...
326 }
────────────────────────────────────────

AVD-AWS-0102 (CRITICAL): Network ACL rule allows access using ALL ports.
════════════════════════════════════════
Ensure access to specific required ports is allowed, and nothing else.

See https://avd.aquasec.com/misconfig/aws-vpc-no-excessive-port-access
────────────────────────────────────────
terraform-aws-modules/vpc/aws/main.tf:221
via terraform-aws-modules/vpc/aws/main.tf:209-224 (aws_network_acl_rule.public_outbound[0])
via vpc.tf:25-46 (module.isolated_vpc)
────────────────────────────────────────
209 resource "aws_network_acl_rule" "public_outbound" {
...
221 [ protocol = var.public_outbound_acl_rules[count.index]["protocol"]
...
224 }
────────────────────────────────────────

AVD-AWS-0102 (CRITICAL): Network ACL rule allows access using ALL ports.
════════════════════════════════════════
Ensure access to specific required ports is allowed, and nothing else.

See https://avd.aquasec.com/misconfig/aws-vpc-no-excessive-port-access
────────────────────────────────────────
terraform-aws-modules/vpc/aws/main.tf:204
via terraform-aws-modules/vpc/aws/main.tf:192-207 (aws_network_acl_rule.public_inbound[0])
via vpc.tf:25-46 (module.isolated_vpc)
────────────────────────────────────────
192 resource "aws_network_acl_rule" "public_inbound" {
...
204 [ protocol = var.public_inbound_acl_rules[count.index]["protocol"]
...
207 }
────────────────────────────────────────

trivy_exitcode=1

Running Trivy in terraform/environments/analytical-platform-ingestion/modules/transfer-family/user-with-egress
2024-11-12T00:43:44Z INFO [vuln] Vulnerability scanning is enabled
2024-11-12T00:43:44Z INFO [misconfig] Misconfiguration scanning is enabled
2024-11-12T00:43:44Z INFO [secret] Secret scanning is enabled
2024-11-12T00:43:44Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-11-12T00:43:44Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2024-11-12T00:43:45Z INFO [terraform scanner] Scanning root module file_path="."
2024-11-12T00:43:45Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="cidr_blocks, egress_bucket, egress_bucket_kms_key, landing_bucket, landing_bucket_kms_key, name, ssh_key, supplier_data_kms_key, transfer_server, transfer_server_security_group"
2024-11-12T00:43:45Z INFO Number of language-specific files num=0
2024-11-12T00:43:45Z INFO Detected config files num=1
trivy_exitcode=1

Running Trivy in terraform/environments/analytical-platform-ingestion/modules/transfer-family/user
2024-11-12T00:43:45Z INFO [vuln] Vulnerability scanning is enabled
2024-11-12T00:43:45Z INFO [misconfig] Misconfiguration scanning is enabled
2024-11-12T00:43:45Z INFO [secret] Secret scanning is enabled
2024-11-12T00:43:45Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-11-12T00:43:45Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2024-11-12T00:43:47Z INFO [terraform scanner] Scanning root module file_path="."
2024-11-12T00:43:47Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="cidr_blocks, landing_bucket, landing_bucket_kms_key, name, ssh_key, supplier_data_kms_key, transfer_server, transfer_server_security_group"
2024-11-12T00:43:47Z INFO Number of language-specific files num=0
2024-11-12T00:43:47Z INFO Detected config files num=1
trivy_exitcode=1

Running Trivy in terraform/environments/analytical-platform-ingestion
2024-11-12T00:43:47Z INFO [vuln] Vulnerability scanning is enabled
2024-11-12T00:43:47Z INFO [misconfig] Misconfiguration scanning is enabled
2024-11-12T00:43:47Z INFO [secret] Secret scanning is enabled
2024-11-12T00:43:47Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-11-12T00:43:47Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2024-11-12T00:43:48Z INFO [terraform scanner] Scanning root module file_path="."
2024-11-12T00:43:48Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="networking"
2024-11-12T00:43:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.connected_vpc_transit_gateway_routes" value="cty.NilVal"
2024-11-12T00:43:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.sftp_users" value="cty.NilVal"
2024-11-12T00:43:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.sftp_users_with_egress" value="cty.NilVal"
2024-11-12T00:43:49Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.bold_egress_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-12T00:43:49Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.bold_egress_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-12T00:43:49Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.definition_upload_lambda.aws_lambda_function.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.vpc_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.logging_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-12T00:43:49Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.definition_upload_lambda.aws_lambda_function.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.vpc_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.logging_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-12T00:43:49Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.definition_upload_lambda.aws_lambda_function.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.vpc_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.logging_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-12T00:43:49Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.definition_upload_lambda.aws_lambda_function.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.vpc_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.logging_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-12T00:43:49Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.definitions_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-12T00:43:49Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.definitions_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-12T00:43:49Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.definition_upload_lambda.aws_lambda_function.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.vpc_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.logging_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-12T00:43:49Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.definition_upload_lambda.aws_lambda_function.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.vpc_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.logging_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-12T00:43:51Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-bucket-encryption" range="terraform-aws-modules/s3-bucket/aws/main.tf:176-198"
2024-11-12T00:43:51Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-public-egress-sgr" range="terraform-aws-modules/security-group/aws/main.tf:533"
2024-11-12T00:43:51Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-public-egress-sgr" range="terraform-aws-modules/security-group/aws/main.tf:534"
2024-11-12T00:43:51Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="terraform-aws-modules/s3-bucket/aws/main.tf:176-198"
2024-11-12T00:43:51Z INFO Number of language-specific files num=0
2024-11-12T00:43:51Z INFO Detected config files num=7

terraform-aws-modules/alb/aws/main.tf (terraform)

Tests: 1 (SUCCESSES: 0, FAILURES: 1)
Failures: 1 (HIGH: 1, CRITICAL: 0)

AVD-AWS-0053 (HIGH): Load balancer is exposed publicly.
════════════════════════════════════════
There are many scenarios in which you would want to expose a load balancer to the wider internet, but this check exists as a warning to prevent accidental exposure of internal assets. You should ensure that this resource should be exposed publicly.

See https://avd.aquasec.com/misconfig/avd-aws-0053
────────────────────────────────────────
terraform-aws-modules/alb/aws/main.tf:12-81
via network-load-balancers.tf:1-37 (module.datasync_activation_nlb)
────────────────────────────────────────
12 ┌ resource "aws_lb" "this" {
13 │ count = local.create ? 1 : 0
14 │
15 │ dynamic "access_logs" {
16 │ for_each = length(var.access_logs) > 0 ? [var.access_logs] : []
17 │
18 │ content {
19 │ bucket = access_logs.value.bucket
20 └ enabled = try(access_logs.value.enabled, true)
..
────────────────────────────────────────

terraform-aws-modules/vpc/aws/main.tf (terraform)

Tests: 8 (SUCCESSES: 0, FAILURES: 8)
Failures: 8 (HIGH: 0, CRITICAL: 8)

AVD-AWS-0102 (CRITICAL): Network ACL rule allows access using ALL ports.
════════════════════════════════════════
Ensure access to specific required ports is allowed, and nothing else.

See https://avd.aquasec.com/misconfig/aws-vpc-no-excessive-port-access
────────────────────────────────────────
terraform-aws-modules/vpc/aws/main.tf:340
via terraform-aws-modules/vpc/aws/main.tf:328-343 (aws_network_acl_rule.private_outbound[0])
via vpc.tf:1-23 (module.connected_vpc)
────────────────────────────────────────
328 resource "aws_network_acl_rule" "private_outbound" {
...
340 [ protocol = var.private_outbound_acl_rules[count.index]["protocol"]
...
343 }
────────────────────────────────────────

AVD-AWS-0102 (CRITICAL): Network ACL rule allows access using ALL ports.
════════════════════════════════════════
Ensure access to specific required ports is allowed, and nothing else.

See https://avd.aquasec.com/misconfig/aws-vpc-no-excessive-port-access
────────────────────────────────────────
terraform-aws-modules/vpc/aws/main.tf:323
via terraform-aws-modules/vpc/aws/main.tf:311-326 (aws_network_acl_rule.private_inbound[0])
via vpc.tf:1-23 (module.connected_vpc)
────────────────────────────────────────
311 resource "aws_network_acl_rule" "private_inbound" {
...
323 [ protocol = var.private_inbound_acl_rules[count.index]["protocol"]
...
326 }
────────────────────────────────────────

AVD-AWS-0102 (CRITICAL): Network ACL rule allows access using ALL ports.
════════════════════════════════════════
Ensure access to specific required ports is allowed, and nothing else.

See https://avd.aquasec.com/misconfig/aws-vpc-no-excessive-port-access
────────────────────────────────────────
terraform-aws-modules/vpc/aws/main.tf:221
via terraform-aws-modules/vpc/aws/main.tf:209-224 (aws_network_acl_rule.public_outbound[0])
via vpc.tf:1-23 (module.connected_vpc)
────────────────────────────────────────
209 resource "aws_network_acl_rule" "public_outbound" {
...
221 [ protocol = var.public_outbound_acl_rules[count.index]["protocol"]
...
224 }
────────────────────────────────────────

AVD-AWS-0102 (CRITICAL): Network ACL rule allows access using ALL ports.
════════════════════════════════════════
Ensure access to specific required ports is allowed, and nothing else.

See https://avd.aquasec.com/misconfig/aws-vpc-no-excessive-port-access
────────────────────────────────────────
terraform-aws-modules/vpc/aws/main.tf:204
via terraform-aws-modules/vpc/aws/main.tf:192-207 (aws_network_acl_rule.public_inbound[0])
via vpc.tf:1-23 (module.connected_vpc)
────────────────────────────────────────
192 resource "aws_network_acl_rule" "public_inbound" {
...
204 [ protocol = var.public_inbound_acl_rules[count.index]["protocol"]
...
207 }
────────────────────────────────────────