🔪 Removing external collaborators. Trying in one PR #8774

julialawrence · 2024-11-25T09:41:20Z

Removing ingestion access for external collaborators.

github-actions · 2024-11-25T09:43:54Z

`Trivy Scan` Failed

Show Output

```hcl

Trivy will check the following folders:
terraform/environments/analytical-platform-ingestion

Running Trivy in terraform/environments/analytical-platform-ingestion
2024-11-25T09:43:33Z INFO [vulndb] Need to update DB
2024-11-25T09:43:33Z INFO [vulndb] Downloading vulnerability DB...
2024-11-25T09:43:33Z INFO [vulndb] Downloading artifact... repo="public.ecr.aws/aquasecurity/trivy-db:2"
2024-11-25T09:43:35Z INFO [vulndb] Artifact successfully downloaded repo="public.ecr.aws/aquasecurity/trivy-db:2"
2024-11-25T09:43:35Z INFO [vuln] Vulnerability scanning is enabled
2024-11-25T09:43:35Z INFO [misconfig] Misconfiguration scanning is enabled
2024-11-25T09:43:35Z INFO [misconfig] Need to update the built-in checks
2024-11-25T09:43:35Z INFO [misconfig] Downloading the built-in checks...
160.25 KiB / 160.25 KiB [---------------------------------------------------------] 100.00% ? p/s 0s2024-11-25T09:43:35Z INFO [secret] Secret scanning is enabled
2024-11-25T09:43:35Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-11-25T09:43:35Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2024-11-25T09:43:36Z INFO [terraform scanner] Scanning root module file_path="."
2024-11-25T09:43:36Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="networking"
2024-11-25T09:43:36Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.connected_vpc_transit_gateway_routes" value="cty.NilVal"
2024-11-25T09:43:36Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.sftp_users" value="cty.NilVal"
2024-11-25T09:43:36Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.sftp_users_with_egress" value="cty.NilVal"
2024-11-25T09:43:45Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.bold_egress_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T09:43:45Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.bold_egress_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T09:43:45Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datasync_bucket.aws_s3_bucket_replication_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_replication_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T09:43:45Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datasync_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T09:43:45Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datasync_bucket.aws_s3_bucket_replication_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_replication_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T09:43:45Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datasync_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T09:43:45Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datasync_bucket.aws_s3_bucket_replication_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_replication_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T09:43:45Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datasync_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T09:43:45Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datasync_bucket.aws_s3_bucket_replication_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_replication_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T09:43:45Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datasync_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T09:43:46Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.definition_upload_lambda.aws_lambda_function.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.vpc_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.logging_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T09:43:46Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.definition_upload_lambda.aws_lambda_function.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.vpc_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.logging_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T09:43:46Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.definition_upload_lambda.aws_lambda_function.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.vpc_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.logging_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T09:43:46Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.definition_upload_lambda.aws_lambda_function.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.vpc_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.logging_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T09:43:46Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.definitions_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T09:43:46Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.definitions_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T09:43:46Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.definition_upload_lambda.aws_lambda_function.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.vpc_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.logging_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T09:43:46Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.definition_upload_lambda.aws_lambda_function.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.vpc_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.logging_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T09:43:47Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-bucket-encryption" range="git::https:/github.com/terraform-aws-modules/terraform-aws-s3-bucket?ref=8a0b697adfbc673e6135c70246cff7f8052ad95a/main.tf:176-198"
2024-11-25T09:43:47Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-public-egress-sgr" range="terraform-aws-modules/security-group/aws/main.tf:533"
2024-11-25T09:43:47Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-public-egress-sgr" range="terraform-aws-modules/security-group/aws/main.tf:534"
2024-11-25T09:43:47Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="git::https:/github.com/terraform-aws-modules/terraform-aws-s3-bucket?ref=8a0b697adfbc673e6135c70246cff7f8052ad95a/main.tf:176-198"
2024-11-25T09:43:47Z INFO Number of language-specific files num=0
2024-11-25T09:43:47Z INFO Detected config files num=8

git::https:/github.com/terraform-aws-modules/terraform-aws-alb?ref=349540d1a611cd98a6383cc64ef0d9bf08d88fb7/main.tf (terraform)

Tests: 1 (SUCCESSES: 0, FAILURES: 1)
Failures: 1 (HIGH: 1, CRITICAL: 0)

AVD-AWS-0053 (HIGH): Load balancer is exposed publicly.
════════════════════════════════════════
There are many scenarios in which you would want to expose a load balancer to the wider internet, but this check exists as a warning to prevent accidental exposure of internal assets. You should ensure that this resource should be exposed publicly.

See https://avd.aquasec.com/misconfig/avd-aws-0053
────────────────────────────────────────
git::https:/github.com/terraform-aws-modules/terraform-aws-alb?ref=349540d1a611cd98a6383cc64ef0d9bf08d88fb7/main.tf:47
via git::https:/github.com/terraform-aws-modules/terraform-aws-alb?ref=349540d1a611cd98a6383cc64ef0d9bf08d88fb7/main.tf:12-81 (aws_lb.this[0])
via network-load-balancers.tf:1-37 (module.datasync_activation_nlb)
────────────────────────────────────────
12 resource "aws_lb" "this" {
..
47 [ internal = var.internal
..
81 }
────────────────────────────────────────

git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf (terraform)

Tests: 4 (SUCCESSES: 0, FAILURES: 4)
Failures: 4 (HIGH: 0, CRITICAL: 4)

AVD-AWS-0102 (CRITICAL): Network ACL rule allows access using ALL ports.
════════════════════════════════════════
Ensure access to specific required ports is allowed, and nothing else.

See https://avd.aquasec.com/misconfig/aws-vpc-no-excessive-port-access
────────────────────────────────────────
git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:340
via git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:328-343 (aws_network_acl_rule.private_outbound[0])
via vpc.tf:1-23 (module.connected_vpc)
────────────────────────────────────────
328 resource "aws_network_acl_rule" "private_outbound" {
...
340 [ protocol = var.private_outbound_acl_rules[count.index]["protocol"]
...
343 }
────────────────────────────────────────

AVD-AWS-0102 (CRITICAL): Network ACL rule allows access using ALL ports.
════════════════════════════════════════
Ensure access to specific required ports is allowed, and nothing else.

See https://avd.aquasec.com/misconfig/aws-vpc-no-excessive-port-access
────────────────────────────────────────
git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:323
via git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:311-326 (aws_network_acl_rule.private_inbound[0])
via vpc.tf:1-23 (module.connected_vpc)
────────────────────────────────────────
311 resource "aws_network_acl_rule" "private_inbound" {
...
323 [ protocol = var.private_inbound_acl_rules[count.index]["protocol"]
...
326 }
────────────────────────────────────────

AVD-AWS-0102 (CRITICAL): Network ACL rule allows access using ALL ports.
════════════════════════════════════════
Ensure access to specific required ports is allowed, and nothing else.

See https://avd.aquasec.com/misconfig/aws-vpc-no-excessive-port-access
────────────────────────────────────────
git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:221
via git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:209-224 (aws_network_acl_rule.public_outbound[0])
via vpc.tf:1-23 (module.connected_vpc)
────────────────────────────────────────
209 resource "aws_network_acl_rule" "public_outbound" {
...
221 [ protocol = var.public_outbound_acl_rules[count.index]["protocol"]
...
224 }
────────────────────────────────────────

AVD-AWS-0102 (CRITICAL): Network ACL rule allows access using ALL ports.
════════════════════════════════════════
Ensure access to specific required ports is allowed, and nothing else.

See https://avd.aquasec.com/misconfig/aws-vpc-no-excessive-port-access
────────────────────────────────────────
git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:204
via git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:192-207 (aws_network_acl_rule.public_inbound[0])
via vpc.tf:1-23 (module.connected_vpc)
────────────────────────────────────────
192 resource "aws_network_acl_rule" "public_inbound" {
...
204 [ protocol = var.public_inbound_acl_rules[count.index]["protocol"]
...
207 }
────────────────────────────────────────

trivy_exitcode=1

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/analytical-platform-ingestion

*****************************

Running Checkov in terraform/environments/analytical-platform-ingestion
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2024-11-25 09:43:50,193 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/cloudwatch/aws//modules/log-group:5.6.0 (for external modules, the --download-external-modules flag is required)
2024-11-25 09:43:50,194 [MainThread  ] [WARNI]  Failed to download module ministryofjustice/observability-platform-tenant/aws:1.2.0 (for external modules, the --download-external-modules flag is required)
2024-11-25 09:43:50,194 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/kms/aws:3.1.0 (for external modules, the --download-external-modules flag is required)
2024-11-25 09:43:50,194 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/route53/aws//modules/resolver-rule-associations:4.1.0 (for external modules, the --download-external-modules flag is required)
2024-11-25 09:43:50,194 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/secrets-manager/aws:1.3.1 (for external modules, the --download-external-modules flag is required)
2024-11-25 09:43:50,194 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/sns/aws:6.1.0 (for external modules, the --download-external-modules flag is required)
2024-11-25 09:43:50,194 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/vpc/aws//modules/vpc-endpoints:5.13.0 (for external modules, the --download-external-modules flag is required)
2024-11-25 09:43:50,195 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/route53/aws//modules/resolver-endpoints:4.1.0 (for external modules, the --download-external-modules flag is required)
2024-11-25 09:43:50,195 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/lambda/aws:7.9.0 (for external modules, the --download-external-modules flag is required)
2024-11-25 09:43:50,195 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/vpc/aws:5.13.0 (for external modules, the --download-external-modules flag is required)
2024-11-25 09:43:50,195 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/iam/aws//modules/iam-assumable-role:5.44.1 (for external modules, the --download-external-modules flag is required)
2024-11-25 09:43:50,195 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/s3-bucket/aws:4.1.2 (for external modules, the --download-external-modules flag is required)
2024-11-25 09:43:50,195 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/security-group/aws:5.2.0 (for external modules, the --download-external-modules flag is required)
2024-11-25 09:43:50,196 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/alb/aws:9.11.0 (for external modules, the --download-external-modules flag is required)
2024-11-25 09:43:50,196 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/s3-bucket/aws//modules/notification:4.1.2 (for external modules, the --download-external-modules flag is required)
2024-11-25 09:43:50,196 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/iam/aws//modules/iam-policy:5.44.1 (for external modules, the --download-external-modules flag is required)
2024-11-25 09:43:50,196 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/ec2-instance/aws:5.7.1 (for external modules, the --download-external-modules flag is required)
2024-11-25 09:43:51,212 [MainThread  ] [WARNI]  Failed updating attribute for key: statement.1.resources and value {'1': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'} forvertex attributes {'__end_line__': 31, '__start_line__': 3, 'statement': [{'actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'effect': 'Allow', 'resources': ['module.s3_landing_kms.key_arn'], 'sid': 'AllowKMS'}, {'actions': ['s3:ListBucket'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}', 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3ListBucket'}, {'actions': ['s3:PutObject'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3LandingBucketObjectActions'}], 'statement.0': {'actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'effect': 'Allow', 'resources': ['module.s3_landing_kms.key_arn'], 'sid': 'AllowKMS'}, 'statement.0.actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'statement.0.actions.0': 'kms:Decrypt', 'statement.0.actions.1': 'kms:DescribeKey', 'statement.0.actions.2': 'kms:Encrypt', 'statement.0.actions.3': 'kms:GenerateDataKey*', 'statement.0.actions.4': 'kms:ReEncrypt*', 'statement.0.effect': 'Allow', 'statement.0.resources': {'0': 'module.s3_landing_kms.key_arn'}, 'statement.0.resources.0': 'module.s3_landing_kms.key_arn', 'statement.0.sid': 'AllowKMS', 'statement.1': {'actions': ['s3:ListBucket'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}', 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3ListBucket'}, 'statement.1.actions': ['s3:ListBucket'], 'statement.1.actions.0': 's3:ListBucket', 'statement.1.effect': 'Allow', 'statement.1.resources': {'0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}'}, 'statement.1.resources.0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}', 'statement.1.resources.1': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*', 'statement.1.sid': 'AllowS3ListBucket', 'statement.2': {'actions': ['s3:PutObject'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3LandingBucketObjectActions'}, 'statement.2.actions': ['s3:PutObject'], 'statement.2.actions.0': 's3:PutObject', 'statement.2.effect': 'Allow', 'statement.2.resources': {'0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'}, 'statement.2.resources.0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*', 'statement.2.sid': 'AllowS3LandingBucketObjectActions'}. Falling back to explicitly setting it.Exception - Parse error at 1:14 near token resources (ID)
2024-11-25 09:43:51,229 [MainThread  ] [WARNI]  Failed updating attribute for key: statement.1.resources and value {'0': 'arn:aws:s3:::${each.value.egress_bucket}'} forvertex attributes {'__end_line__': 44, '__start_line__': 3, 'statement': [{'actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'effect': 'Allow', 'resources': ['${var.egress_bucket_kms_key}', 'module.s3_landing_kms.key_arn'], 'sid': 'AllowKMS'}, {'actions': ['s3:ListBucket'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${each.value.egress_bucket}', 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}'], 'sid': 'AllowS3ListBucket'}, {'actions': ['s3:PutObject'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3LandingBucketObjectActions'}, {'actions': ['s3:GetObject', 's3:GetObjectAcl', 's3:GetObjectVersion'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${var.egress_bucket}/${var.name}/*'], 'sid': 'AllowS3EgressBucketObjectActions'}], 'statement.0': {'actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'effect': 'Allow', 'resources': ['${var.egress_bucket_kms_key}', 'module.s3_landing_kms.key_arn'], 'sid': 'AllowKMS'}, 'statement.0.actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'statement.0.actions.0': 'kms:Decrypt', 'statement.0.actions.1': 'kms:DescribeKey', 'statement.0.actions.2': 'kms:Encrypt', 'statement.0.actions.3': 'kms:GenerateDataKey*', 'statement.0.actions.4': 'kms:ReEncrypt*', 'statement.0.effect': 'Allow', 'statement.0.resources': {'1': 'module.s3_landing_kms.key_arn'}, 'statement.0.resources.0': '${var.egress_bucket_kms_key}', 'statement.0.resources.1': 'module.s3_landing_kms.key_arn', 'statement.0.sid': 'AllowKMS', 'statement.1': {'actions': ['s3:ListBucket'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${each.value.egress_bucket}', 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}'], 'sid': 'AllowS3ListBucket'}, 'statement.1.actions': ['s3:ListBucket'], 'statement.1.actions.0': 's3:ListBucket', 'statement.1.effect': 'Allow', 'statement.1.resources': {'1': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}'}, 'statement.1.resources.0': 'arn:aws:s3:::${each.value.egress_bucket}', 'statement.1.resources.1': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}', 'statement.1.sid': 'AllowS3ListBucket', 'statement.2': {'actions': ['s3:PutObject'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3LandingBucketObjectActions'}, 'statement.2.actions': ['s3:PutObject'], 'statement.2.actions.0': 's3:PutObject', 'statement.2.effect': 'Allow', 'statement.2.resources': {'0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'}, 'statement.2.resources.0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*', 'statement.2.sid': 'AllowS3LandingBucketObjectActions', 'statement.3': {'actions': ['s3:GetObject', 's3:GetObjectAcl', 's3:GetObjectVersion'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${var.egress_bucket}/${var.name}/*'], 'sid': 'AllowS3EgressBucketObjectActions'}, 'statement.3.actions': ['s3:GetObject', 's3:GetObjectAcl', 's3:GetObjectVersion'], 'statement.3.actions.0': 's3:GetObject', 'statement.3.actions.1': 's3:GetObjectAcl', 'statement.3.actions.2': 's3:GetObjectVersion', 'statement.3.effect': 'Allow', 'statement.3.resources': ['arn:aws:s3:::${var.egress_bucket}/${var.name}/*'], 'statement.3.resources.0': 'arn:aws:s3:::${var.egress_bucket}/${var.name}/*', 'statement.3.sid': 'AllowS3EgressBucketObjectActions'}. Falling back to explicitly setting it.Exception - Parse error at 1:14 near token resources (ID)
2024-11-25 09:43:51,246 [MainThread  ] [WARNI]  Failed updating attribute for key: statement.0.resources and value {'0': 'each.value.egress_bucket_kms_key'} forvertex attributes {'__end_line__': 44, '__start_line__': 3, 'statement': [{'actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'effect': 'Allow', 'resources': ['each.value.egress_bucket_kms_key', 'module.s3_landing_kms.key_arn'], 'sid': 'AllowKMS'}, {'actions': ['s3:ListBucket'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${each.value.egress_bucket}', 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}'], 'sid': 'AllowS3ListBucket'}, {'actions': ['s3:PutObject'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3LandingBucketObjectActions'}, {'actions': ['s3:GetObject', 's3:GetObjectAcl', 's3:GetObjectVersion'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${var.egress_bucket}/${var.name}/*'], 'sid': 'AllowS3EgressBucketObjectActions'}], 'statement.0': {'actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'effect': 'Allow', 'resources': ['each.value.egress_bucket_kms_key', 'module.s3_landing_kms.key_arn'], 'sid': 'AllowKMS'}, 'statement.0.actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'statement.0.actions.0': 'kms:Decrypt', 'statement.0.actions.1': 'kms:DescribeKey', 'statement.0.actions.2': 'kms:Encrypt', 'statement.0.actions.3': 'kms:GenerateDataKey*', 'statement.0.actions.4': 'kms:ReEncrypt*', 'statement.0.effect': 'Allow', 'statement.0.resources': {'1': 'module.s3_landing_kms.key_arn'}, 'statement.0.resources.0': 'each.value.egress_bucket_kms_key', 'statement.0.resources.1': 'module.s3_landing_kms.key_arn', 'statement.0.sid': 'AllowKMS', 'statement.1': {'actions': ['s3:ListBucket'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${each.value.egress_bucket}', 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}'], 'sid': 'AllowS3ListBucket'}, 'statement.1.actions': ['s3:ListBucket'], 'statement.1.actions.0': 's3:ListBucket', 'statement.1.effect': 'Allow', 'statement.1.resources': {'0': 'arn:aws:s3:::${each.value.egress_bucket}'}, 'statement.1.resources.0': 'arn:aws:s3:::${each.value.egress_bucket}', 'statement.1.resources.1': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}', 'statement.1.sid': 'AllowS3ListBucket', 'statement.2': {'actions': ['s3:PutObject'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3LandingBucketObjectActions'}, 'statement.2.actions': ['s3:PutObject'], 'statement.2.actions.0': 's3:PutObject', 'statement.2.effect': 'Allow', 'statement.2.resources': {'0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'}, 'statement.2.resources.0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*', 'statement.2.sid': 'AllowS3LandingBucketObjectActions', 'statement.3': {'actions': ['s3:GetObject', 's3:GetObjectAcl', 's3:GetObjectVersion'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${var.egress_bucket}/${var.name}/*'], 'sid': 'AllowS3EgressBucketObjectActions'}, 'statement.3.actions': ['s3:GetObject', 's3:GetObjectAcl', 's3:GetObjectVersion'], 'statement.3.actions.0': 's3:GetObject', 'statement.3.actions.1': 's3:GetObjectAcl', 'statement.3.actions.2': 's3:GetObjectVersion', 'statement.3.effect': 'Allow', 'statement.3.resources': ['arn:aws:s3:::${var.egress_bucket}/${var.name}/*'], 'statement.3.resources.0': 'arn:aws:s3:::${var.egress_bucket}/${var.name}/*', 'statement.3.sid': 'AllowS3EgressBucketObjectActions'}. Falling back to explicitly setting it.Exception - Parse error at 1:14 near token resources (ID)
2024-11-25 09:43:51,352 [MainThread  ] [WARNI]  Failed updating attribute for key: statement.1.resources and value {'1': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'} forvertex attributes {'__end_line__': 31, '__start_line__': 3, 'statement': [{'actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'effect': 'Allow', 'resources': ['module.s3_landing_kms.key_arn'], 'sid': 'AllowKMS'}, {'actions': ['s3:ListBucket'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}', 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3ListBucket'}, {'actions': ['s3:PutObject'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3LandingBucketObjectActions'}], 'statement.0': {'actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'effect': 'Allow', 'resources': ['module.s3_landing_kms.key_arn'], 'sid': 'AllowKMS'}, 'statement.0.actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'statement.0.actions.0': 'kms:Decrypt', 'statement.0.actions.1': 'kms:DescribeKey', 'statement.0.actions.2': 'kms:Encrypt', 'statement.0.actions.3': 'kms:GenerateDataKey*', 'statement.0.actions.4': 'kms:ReEncrypt*', 'statement.0.effect': 'Allow', 'statement.0.resources': {'0': 'module.s3_landing_kms.key_arn'}, 'statement.0.resources.0': 'module.s3_landing_kms.key_arn', 'statement.0.sid': 'AllowKMS', 'statement.1': {'actions': ['s3:ListBucket'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}', 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3ListBucket'}, 'statement.1.actions': ['s3:ListBucket'], 'statement.1.actions.0': 's3:ListBucket', 'statement.1.effect': 'Allow', 'statement.1.resources': {'0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}'}, 'statement.1.resources.0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}', 'statement.1.resources.1': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*', 'statement.1.sid': 'AllowS3ListBucket', 'statement.2': {'actions': ['s3:PutObject'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3LandingBucketObjectActions'}, 'statement.2.actions': ['s3:PutObject'], 'statement.2.actions.0': 's3:PutObject', 'statement.2.effect': 'Allow', 'statement.2.resources': {'0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'}, 'statement.2.resources.0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*', 'statement.2.sid': 'AllowS3LandingBucketObjectActions'}. Falling back to explicitly setting it.Exception - Parse error at 1:14 near token resources (ID)
2024-11-25 09:43:51,370 [MainThread  ] [WARNI]  Failed updating attribute for key: statement.1.resources and value {'0': 'arn:aws:s3:::${each.value.egress_bucket}'} forvertex attributes {'__end_line__': 44, '__start_line__': 3, 'statement': [{'actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'effect': 'Allow', 'resources': ['${var.egress_bucket_kms_key}', 'module.s3_landing_kms.key_arn'], 'sid': 'AllowKMS'}, {'actions': ['s3:ListBucket'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${each.value.egress_bucket}', 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}'], 'sid': 'AllowS3ListBucket'}, {'actions': ['s3:PutObject'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3LandingBucketObjectActions'}, {'actions': ['s3:GetObject', 's3:GetObjectAcl', 's3:GetObjectVersion'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${var.egress_bucket}/${var.name}/*'], 'sid': 'AllowS3EgressBucketObjectActions'}], 'statement.0': {'actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'effect': 'Allow', 'resources': ['${var.egress_bucket_kms_key}', 'module.s3_landing_kms.key_arn'], 'sid': 'AllowKMS'}, 'statement.0.actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'statement.0.actions.0': 'kms:Decrypt', 'statement.0.actions.1': 'kms:DescribeKey', 'statement.0.actions.2': 'kms:Encrypt', 'statement.0.actions.3': 'kms:GenerateDataKey*', 'statement.0.actions.4': 'kms:ReEncrypt*', 'statement.0.effect': 'Allow', 'statement.0.resources': {'1': 'module.s3_landing_kms.key_arn'}, 'statement.0.resources.0': '${var.egress_bucket_kms_key}', 'statement.0.resources.1': 'module.s3_landing_kms.key_arn', 'statement.0.sid': 'AllowKMS', 'statement.1': {'actions': ['s3:ListBucket'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${each.value.egress_bucket}', 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}'], 'sid': 'AllowS3ListBucket'}, 'statement.1.actions': ['s3:ListBucket'], 'statement.1.actions.0': 's3:ListBucket', 'statement.1.effect': 'Allow', 'statement.1.resources': {'1': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}'}, 'statement.1.resources.0': 'arn:aws:s3:::${each.value.egress_bucket}', 'statement.1.resources.1': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}', 'statement.1.sid': 'AllowS3ListBucket', 'statement.2': {'actions': ['s3:PutObject'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3LandingBucketObjectActions'}, 'statement.2.actions': ['s3:PutObject'], 'statement.2.actions.0': 's3:PutObject', 'statement.2.effect': 'Allow', 'statement.2.resources': {'0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'}, 'statement.2.resources.0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*', 'statement.2.sid': 'AllowS3LandingBucketObjectActions', 'statement.3': {'actions': ['s3:GetObject', 's3:GetObjectAcl', 's3:GetObjectVersion'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${var.egress_bucket}/${var.name}/*'], 'sid': 'AllowS3EgressBucketObjectActions'}, 'statement.3.actions': ['s3:GetObject', 's3:GetObjectAcl', 's3:GetObjectVersion'], 'statement.3.actions.0': 's3:GetObject', 'statement.3.actions.1': 's3:GetObjectAcl', 'statement.3.actions.2': 's3:GetObjectVersion', 'statement.3.effect': 'Allow', 'statement.3.resources': ['arn:aws:s3:::${var.egress_bucket}/${var.name}/*'], 'statement.3.resources.0': 'arn:aws:s3:::${var.egress_bucket}/${var.name}/*', 'statement.3.sid': 'AllowS3EgressBucketObjectActions'}. Falling back to explicitly setting it.Exception - Parse error at 1:14 near token resources (ID)
2024-11-25 09:43:51,388 [MainThread  ] [WARNI]  Failed updating attribute for key: statement.0.resources and value {'0': 'each.value.egress_bucket_kms_key'} forvertex attributes {'__end_line__': 44, '__start_line__': 3, 'statement': [{'actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'effect': 'Allow', 'resources': ['each.value.egress_bucket_kms_key', 'module.s3_landing_kms.key_arn'], 'sid': 'AllowKMS'}, {'actions': ['s3:ListBucket'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${each.value.egress_bucket}', 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}'], 'sid': 'AllowS3ListBucket'}, {'actions': ['s3:PutObject'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3LandingBucketObjectActions'}, {'actions': ['s3:GetObject', 's3:GetObjectAcl', 's3:GetObjectVersion'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${var.egress_bucket}/${var.name}/*'], 'sid': 'AllowS3EgressBucketObjectActions'}], 'statement.0': {'actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'effect': 'Allow', 'resources': ['each.value.egress_bucket_kms_key', 'module.s3_landing_kms.key_arn'], 'sid': 'AllowKMS'}, 'statement.0.actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'statement.0.actions.0': 'kms:Decrypt', 'statement.0.actions.1': 'kms:DescribeKey', 'statement.0.actions.2': 'kms:Encrypt', 'statement.0.actions.3': 'kms:GenerateDataKey*', 'statement.0.actions.4': 'kms:ReEncrypt*', 'statement.0.effect': 'Allow', 'statement.0.resources': {'1': 'module.s3_landing_kms.key_arn'}, 'statement.0.resources.0': 'each.value.egress_bucket_kms_key', 'statement.0.resources.1': 'module.s3_landing_kms.key_arn', 'statement.0.sid': 'AllowKMS', 'statement.1': {'actions': ['s3:ListBucket'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${each.value.egress_bucket}', 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}'], 'sid': 'AllowS3ListBucket'}, 'statement.1.actions': ['s3:ListBucket'], 'statement.1.actions.0': 's3:ListBucket', 'statement.1.effect': 'Allow', 'statement.1.resources': {'0': 'arn:aws:s3:::${each.value.egress_bucket}'}, 'statement.1.resources.0': 'arn:aws:s3:::${each.value.egress_bucket}', 'statement.1.resources.1': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}', 'statement.1.sid': 'AllowS3ListBucket', 'statement.2': {'actions': ['s3:PutObject'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3LandingBucketObjectActions'}, 'statement.2.actions': ['s3:PutObject'], 'statement.2.actions.0': 's3:PutObject', 'statement.2.effect': 'Allow', 'statement.2.resources': {'0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'}, 'statement.2.resources.0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*', 'statement.2.sid': 'AllowS3LandingBucketObjectActions', 'statement.3': {'actions': ['s3:GetObject', 's3:GetObjectAcl', 's3:GetObjectVersion'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${var.egress_bucket}/${var.name}/*'], 'sid': 'AllowS3EgressBucketObjectActions'}, 'statement.3.actions': ['s3:GetObject', 's3:GetObjectAcl', 's3:GetObjectVersion'], 'statement.3.actions.0': 's3:GetObject', 'statement.3.actions.1': 's3:GetObjectAcl', 'statement.3.actions.2': 's3:GetObjectVersion', 'statement.3.effect': 'Allow', 'statement.3.resources': ['arn:aws:s3:::${var.egress_bucket}/${var.name}/*'], 'statement.3.resources.0': 'arn:aws:s3:::${var.egress_bucket}/${var.name}/*', 'statement.3.sid': 'AllowS3EgressBucketObjectActions'}. Falling back to explicitly setting it.Exception - Parse error at 1:14 near token resources (ID)
2024-11-25 09:43:51,473 [MainThread  ] [WARNI]  Failed updating attribute for key: statement.1.resources and value {'1': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'} forvertex attributes {'__end_line__': 31, '__start_line__': 3, 'statement': [{'actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'effect': 'Allow', 'resources': ['module.s3_landing_kms.key_arn'], 'sid': 'AllowKMS'}, {'actions': ['s3:ListBucket'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}', 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3ListBucket'}, {'actions': ['s3:PutObject'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3LandingBucketObjectActions'}], 'statement.0': {'actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'effect': 'Allow', 'resources': ['module.s3_landing_kms.key_arn'], 'sid': 'AllowKMS'}, 'statement.0.actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'statement.0.actions.0': 'kms:Decrypt', 'statement.0.actions.1': 'kms:DescribeKey', 'statement.0.actions.2': 'kms:Encrypt', 'statement.0.actions.3': 'kms:GenerateDataKey*', 'statement.0.actions.4': 'kms:ReEncrypt*', 'statement.0.effect': 'Allow', 'statement.0.resources': {'0': 'module.s3_landing_kms.key_arn'}, 'statement.0.resources.0': 'module.s3_landing_kms.key_arn', 'statement.0.sid': 'AllowKMS', 'statement.1': {'actions': ['s3:ListBucket'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}', 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3ListBucket'}, 'statement.1.actions': ['s3:ListBucket'], 'statement.1.actions.0': 's3:ListBucket', 'statement.1.effect': 'Allow', 'statement.1.resources': {'0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}'}, 'statement.1.resources.0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}', 'statement.1.resources.1': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*', 'statement.1.sid': 'AllowS3ListBucket', 'statement.2': {'actions': ['s3:PutObject'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3LandingBucketObjectActions'}, 'statement.2.actions': ['s3:PutObject'], 'statement.2.actions.0': 's3:PutObject', 'statement.2.effect': 'Allow', 'statement.2.resources': {'0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'}, 'statement.2.resources.0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*', 'statement.2.sid': 'AllowS3LandingBucketObjectActions'}. Falling back to explicitly setting it.Exception - Parse error at 1:14 near token resources (ID)
2024-11-25 09:43:51,491 [MainThread  ] [WARNI]  Failed updating attribute for key: statement.1.resources and value {'0': 'arn:aws:s3:::${each.value.egress_bucket}'} forvertex attributes {'__end_line__': 44, '__start_line__': 3, 'statement': [{'actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'effect': 'Allow', 'resources': ['${var.egress_bucket_kms_key}', 'module.s3_landing_kms.key_arn'], 'sid': 'AllowKMS'}, {'actions': ['s3:ListBucket'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${each.value.egress_bucket}', 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}'], 'sid': 'AllowS3ListBucket'}, {'actions': ['s3:PutObject'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3LandingBucketObjectActions'}, {'actions': ['s3:GetObject', 's3:GetObjectAcl', 's3:GetObjectVersion'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${var.egress_bucket}/${var.name}/*'], 'sid': 'AllowS3EgressBucketObjectActions'}], 'statement.0': {'actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'effect': 'Allow', 'resources': ['${var.egress_bucket_kms_key}', 'module.s3_landing_kms.key_arn'], 'sid': 'AllowKMS'}, 'statement.0.actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'statement.0.actions.0': 'kms:Decrypt', 'statement.0.actions.1': 'kms:DescribeKey', 'statement.0.actions.2': 'kms:Encrypt', 'statement.0.actions.3': 'kms:GenerateDataKey*', 'statement.0.actions.4': 'kms:ReEncrypt*', 'statement.0.effect': 'Allow', 'statement.0.resources': {'1': 'module.s3_landing_kms.key_arn'}, 'statement.0.resources.0': '${var.egress_bucket_kms_key}', 'statement.0.resources.1': 'module.s3_landing_kms.key_arn', 'statement.0.sid': 'AllowKMS', 'statement.1': {'actions': ['s3:ListBucket'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${each.value.egress_bucket}', 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}'], 'sid': 'AllowS3ListBucket'}, 'statement.1.actions': ['s3:ListBucket'], 'statement.1.actions.0': 's3:ListBucket', 'statement.1.effect': 'Allow', 'statement.1.resources': {'1': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}'}, 'statement.1.resources.0': 'arn:aws:s3:::${each.value.egress_bucket}', 'statement.1.resources.1': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}', 'statement.1.sid': 'AllowS3ListBucket', 'statement.2': {'actions': ['s3:PutObject'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3LandingBucketObjectActions'}, 'statement.2.actions': ['s3:PutObject'], 'statement.2.actions.0': 's3:PutObject', 'statement.2.effect': 'Allow', 'statement.2.resources': {'0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'}, 'statement.2.resources.0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*', 'statement.2.sid': 'AllowS3LandingBucketObjectActions', 'statement.3': {'actions': ['s3:GetObject', 's3:GetObjectAcl', 's3:GetObjectVersion'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${var.egress_bucket}/${var.name}/*'], 'sid': 'AllowS3EgressBucketObjectActions'}, 'statement.3.actions': ['s3:GetObject', 's3:GetObjectAcl', 's3:GetObjectVersion'], 'statement.3.actions.0': 's3:GetObject', 'statement.3.actions.1': 's3:GetObjectAcl', 'statement.3.actions.2': 's3:GetObjectVersion', 'statement.3.effect': 'Allow', 'statement.3.resources': ['arn:aws:s3:::${var.egress_bucket}/${var.name}/*'], 'statement.3.resources.0': 'arn:aws:s3:::${var.egress_bucket}/${var.name}/*', 'statement.3.sid': 'AllowS3EgressBucketObjectActions'}. Falling back to explicitly setting it.Exception - Parse error at 1:14 near token resources (ID)
2024-11-25 09:43:51,508 [MainThread  ] [WARNI]  Failed updating attribute for key: statement.0.resources and value {'0': 'each.value.egress_bucket_kms_key'} forvertex attributes {'__end_line__': 44, '__start_line__': 3, 'statement': [{'actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'effect': 'Allow', 'resources': ['each.value.egress_bucket_kms_key', 'module.s3_landing_kms.key_arn'], 'sid': 'AllowKMS'}, {'actions': ['s3:ListBucket'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${each.value.egress_bucket}', 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}'], 'sid': 'AllowS3ListBucket'}, {'actions': ['s3:PutObject'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3LandingBucketObjectActions'}, {'actions': ['s3:GetObject', 's3:GetObjectAcl', 's3:GetObjectVersion'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${var.egress_bucket}/${var.name}/*'], 'sid': 'AllowS3EgressBucketObjectActions'}], 'statement.0': {'actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'effect': 'Allow', 'resources': ['each.value.egress_bucket_kms_key', 'module.s3_landing_kms.key_arn'], 'sid': 'AllowKMS'}, 'statement.0.actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'statement.0.actions.0': 'kms:Decrypt', 'statement.0.actions.1': 'kms:DescribeKey', 'statement.0.actions.2': 'kms:Encrypt', 'statement.0.actions.3': 'kms:GenerateDataKey*', 'statement.0.actions.4': 'kms:ReEncrypt*', 'statement.0.effect': 'Allow', 'statement.0.resources': {'1': 'module.s3_landing_kms.key_arn'}, 'statement.0.resources.0': 'each.value.egress_bucket_kms_key', 'statement.0.resources.1': 'module.s3_landing_kms.key_arn', 'statement.0.sid': 'AllowKMS', 'statement.1': {'actions': ['s3:ListBucket'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${each.value.egress_bucket}', 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}'], 'sid': 'AllowS3ListBucket'}, 'statement.1.actions': ['s3:ListBucket'], 'statement.1.actions.0': 's3:ListBucket', 'statement.1.effect': 'Allow', 'statement.1.resources': {'0': 'arn:aws:s3:::${each.value.egress_bucket}'}, 'statement.1.resources.0': 'arn:aws:s3:::${each.value.egress_bucket}', 'statement.1.resources.1': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}', 'statement.1.sid': 'AllowS3ListBucket', 'statement.2': {'actions': ['s3:PutObject'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3LandingBucketObjectActions'}, 'statement.2.actions': ['s3:PutObject'], 'statement.2.actions.0': 's3:PutObject', 'statement.2.effect': 'Allow', 'statement.2.resources': {'0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'}, 'statement.2.resources.0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*', 'statement.2.sid': 'AllowS3LandingBucketObjectActions', 'statement.3': {'actions': ['s3:GetObject', 's3:GetObjectAcl', 's3:GetObjectVersion'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${var.egress_bucket}/${var.name}/*'], 'sid': 'AllowS3EgressBucketObjectActions'}, 'statement.3.actions': ['s3:GetObject', 's3:GetObjectAcl', 's3:GetObjectVersion'], 'statement.3.actions.0': 's3:GetObject', 'statement.3.actions.1': 's3:GetObjectAcl', 'statement.3.actions.2': 's3:GetObjectVersion', 'statement.3.effect': 'Allow', 'statement.3.resources': ['arn:aws:s3:::${var.egress_bucket}/${var.name}/*'], 'statement.3.resources.0': 'arn:aws:s3:::${var.egress_bucket}/${var.name}/*', 'statement.3.sid': 'AllowS3EgressBucketObjectActions'}. Falling back to explicitly setting it.Exception - Parse error at 1:14 near token resources (ID)
2024-11-25 09:43:51,630 [MainThread  ] [WARNI]  Failed updating attribute for key: statement.1.resources and value {'1': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'} forvertex attributes {'__end_line__': 31, '__start_line__': 3, 'statement': [{'actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'effect': 'Allow', 'resources': ['module.s3_landing_kms.key_arn'], 'sid': 'AllowKMS'}, {'actions': ['s3:ListBucket'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}', 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3ListBucket'}, {'actions': ['s3:PutObject'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3LandingBucketObjectActions'}], 'statement.0': {'actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'effect': 'Allow', 'resources': ['module.s3_landing_kms.key_arn'], 'sid': 'AllowKMS'}, 'statement.0.actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'statement.0.actions.0': 'kms:Decrypt', 'statement.0.actions.1': 'kms:DescribeKey', 'statement.0.actions.2': 'kms:Encrypt', 'statement.0.actions.3': 'kms:GenerateDataKey*', 'statement.0.actions.4': 'kms:ReEncrypt*', 'statement.0.effect': 'Allow', 'statement.0.resources': {'0': 'module.s3_landing_kms.key_arn'}, 'statement.0.resources.0': 'module.s3_landing_kms.key_arn', 'statement.0.sid': 'AllowKMS', 'statement.1': {'actions': ['s3:ListBucket'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}', 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3ListBucket'}, 'statement.1.actions': ['s3:ListBucket'], 'statement.1.actions.0': 's3:ListBucket', 'statement.1.effect': 'Allow', 'statement.1.resources': {'0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}'}, 'statement.1.resources.0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}', 'statement.1.resources.1': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*', 'statement.1.sid': 'AllowS3ListBucket', 'statement.2': {'actions': ['s3:PutObject'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3LandingBucketObjectActions'}, 'statement.2.actions': ['s3:PutObject'], 'statement.2.actions.0': 's3:PutObject', 'statement.2.effect': 'Allow', 'statement.2.resources': {'0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'}, 'statement.2.resources.0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*', 'statement.2.sid': 'AllowS3LandingBucketObjectActions'}. Falling back to explicitly setting it.Exception - Parse error at 1:14 near token resources (ID)
2024-11-25 09:43:51,650 [MainThread  ] [WARNI]  Failed updating attribute for key: statement.1.resources and value {'0': 'arn:aws:s3:::${each.value.egress_bucket}'} forvertex attributes {'__end_line__': 44, '__start_line__': 3, 'statement': [{'actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'effect': 'Allow', 'resources': ['${var.egress_bucket_kms_key}', 'module.s3_landing_kms.key_arn'], 'sid': 'AllowKMS'}, {'actions': ['s3:ListBucket'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${each.value.egress_bucket}', 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}'], 'sid': 'AllowS3ListBucket'}, {'actions': ['s3:PutObject'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3LandingBucketObjectActions'}, {'actions': ['s3:GetObject', 's3:GetObjectAcl', 's3:GetObjectVersion'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${var.egress_bucket}/${var.name}/*'], 'sid': 'AllowS3EgressBucketObjectActions'}], 'statement.0': {'actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'effect': 'Allow', 'resources': ['${var.egress_bucket_kms_key}', 'module.s3_landing_kms.key_arn'], 'sid': 'AllowKMS'}, 'statement.0.actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'statement.0.actions.0': 'kms:Decrypt', 'statement.0.actions.1': 'kms:DescribeKey', 'statement.0.actions.2': 'kms:Encrypt', 'statement.0.actions.3': 'kms:GenerateDataKey*', 'statement.0.actions.4': 'kms:ReEncrypt*', 'statement.0.effect': 'Allow', 'statement.0.resources': {'1': 'module.s3_landing_kms.key_arn'}, 'statement.0.resources.0': '${var.egress_bucket_kms_key}', 'statement.0.resources.1': 'module.s3_landing_kms.key_arn', 'statement.0.sid': 'AllowKMS', 'statement.1': {'actions': ['s3:ListBucket'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${each.value.egress_bucket}', 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}'], 'sid': 'AllowS3ListBucket'}, 'statement.1.actions': ['s3:ListBucket'], 'statement.1.actions.0': 's3:ListBucket', 'statement.1.effect': 'Allow', 'statement.1.resources': {'1': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}'}, 'statement.1.resources.0': 'arn:aws:s3:::${each.value.egress_bucket}', 'statement.1.resources.1': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}', 'statement.1.sid': 'AllowS3ListBucket', 'statement.2': {'actions': ['s3:PutObject'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3LandingBucketObjectActions'}, 'statement.2.actions': ['s3:PutObject'], 'statement.2.actions.0': 's3:PutObject', 'statement.2.effect': 'Allow', 'statement.2.resources': {'0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'}, 'statement.2.resources.0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*', 'statement.2.sid': 'AllowS3LandingBucketObjectActions', 'statement.3': {'actions': ['s3:GetObject', 's3:GetObjectAcl', 's3:GetObjectVersion'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${var.egress_bucket}/${var.name}/*'], 'sid': 'AllowS3EgressBucketObjectActions'}, 'statement.3.actions': ['s3:GetObject', 's3:GetObjectAcl', 's3:GetObjectVersion'], 'statement.3.actions.0': 's3:GetObject', 'statement.3.actions.1': 's3:GetObjectAcl', 'statement.3.actions.2': 's3:GetObjectVersion', 'statement.3.effect': 'Allow', 'statement.3.resources': ['arn:aws:s3:::${var.egress_bucket}/${var.name}/*'], 'statement.3.resources.0': 'arn:aws:s3:::${var.egress_bucket}/${var.name}/*', 'statement.3.sid': 'AllowS3EgressBucketObjectActions'}. Falling back to explicitly setting it.Exception - Parse error at 1:14 near token resources (ID)
2024-11-25 09:43:51,667 [MainThread  ] [WARNI]  Failed updating attribute for key: statement.0.resources and value {'0': 'each.value.egress_bucket_kms_key'} forvertex attributes {'__end_line__': 44, '__start_line__': 3, 'statement': [{'actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'effect': 'Allow', 'resources': ['each.value.egress_bucket_kms_key', 'module.s3_landing_kms.key_arn'], 'sid': 'AllowKMS'}, {'actions': ['s3:ListBucket'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${each.value.egress_bucket}', 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}'], 'sid': 'AllowS3ListBucket'}, {'actions': ['s3:PutObject'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3LandingBucketObjectActions'}, {'actions': ['s3:GetObject', 's3:GetObjectAcl', 's3:GetObjectVersion'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${var.egress_bucket}/${var.name}/*'], 'sid': 'AllowS3EgressBucketObjectActions'}], 'statement.0': {'actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'effect': 'Allow', 'resources': ['each.value.egress_bucket_kms_key', 'module.s3_landing_kms.key_arn'], 'sid': 'AllowKMS'}, 'statement.0.actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'statement.0.actions.0': 'kms:Decrypt', 'statement.0.actions.1': 'kms:DescribeKey', 'statement.0.actions.2': 'kms:Encrypt', 'statement.0.actions.3': 'kms:GenerateDataKey*', 'statement.0.actions.4': 'kms:ReEncrypt*', 'statement.0.effect': 'Allow', 'statement.0.resources': {'1': 'module.s3_landing_kms.key_arn'}, 'statement.0.resources.0': 'each.value.egress_bucket_kms_key', 'statement.0.resources.1': 'module.s3_landing_kms.key_arn', 'statement.0.sid': 'AllowKMS', 'statement.1': {'actions': ['s3:ListBucket'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${each.value.egress_bucket}', 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}'], 'sid': 'AllowS3ListBucket'}, 'statement.1.actions': ['s3:ListBucket'], 'statement.1.actions.0': 's3:ListBucket', 'statement.1.effect': 'Allow', 'statement.1.resources': {'0': 'arn:aws:s3:::${each.value.egress_bucket}'}, 'statement.1.resources.0': 'arn:aws:s3:::${each.value.egress_bucket}', 'statement.1.resources.1': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}', 'statement.1.sid': 'AllowS3ListBucket', 'statement.2': {'actions': ['s3:PutObject'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3LandingBucketObjectActions'}, 'statement.2.actions': ['s3:PutObject'], 'statement.2.actions.0': 's3:PutObject', 'statement.2.effect': 'Allow', 'statement.2.resources': {'0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'}, 'statement.2.resources.0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*', 'statement.2.sid': 'AllowS3LandingBucketObjectActions', 'statement.3': {'actions': ['s3:GetObject', 's3:GetObjectAcl', 's3:GetObjectVersion'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${var.egress_bucket}/${var.name}/*'], 'sid': 'AllowS3EgressBucketObjectActions'}, 'statement.3.actions': ['s3:GetObject', 's3:GetObjectAcl', 's3:GetObjectVersion'], 'statement.3.actions.0': 's3:GetObject', 'statement.3.actions.1': 's3:GetObjectAcl', 'statement.3.actions.2': 's3:GetObjectVersion', 'statement.3.effect': 'Allow', 'statement.3.resources': ['arn:aws:s3:::${var.egress_bucket}/${var.name}/*'], 'statement.3.resources.0': 'arn:aws:s3:::${var.egress_bucket}/${var.name}/*', 'statement.3.sid': 'AllowS3EgressBucketObjectActions'}. Falling back to explicitly setting it.Exception - Parse error at 1:14 near token resources (ID)
terraform scan results:

Passed checks: 198, Failed checks: 2, Skipped checks: 74

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: connected_vpc_route53_resolver_associations
	File: /route53-resolver-associations.tf:1-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		1  | module "connected_vpc_route53_resolver_associations" {
		2  | 
		3  |   source  = "terraform-aws-modules/route53/aws//modules/resolver-rule-associations"
		4  |   version = "4.1.0"
		5  | 
		6  |   vpc_id = module.connected_vpc.vpc_id
		7  | 
		8  |   resolver_rule_associations = {
		9  |     mojo-dns-resolver-dom1-infra-int = {
		10 |       resolver_rule_id = aws_route53_resolver_rule.mojo_dns_resolver_dom1_infra_int.id
		11 |     }
		12 |   }
		13 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: connected_vpc_outbound_route53_resolver_endpoint
	File: /route53-resolver-endpoints.tf:1-27
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		1  | module "connected_vpc_outbound_route53_resolver_endpoint" {
		2  |   source  = "terraform-aws-modules/route53/aws//modules/resolver-endpoints"
		3  |   version = "4.1.0"
		4  | 
		5  |   name      = "connected-vpc-outbound"
		6  |   vpc_id    = module.connected_vpc.vpc_id
		7  |   direction = "OUTBOUND"
		8  |   protocols = ["Do53"]
		9  | 
		10 |   ip_address = [
		11 |     {
		12 |       subnet_id = module.connected_vpc.private_subnets[0]
		13 |     },
		14 |     {
		15 |       subnet_id = module.connected_vpc.private_subnets[1]
		16 |     }
		17 |   ]
		18 | 
		19 |   security_group_ingress_cidr_blocks = [module.connected_vpc.vpc_cidr_block]
		20 |   security_group_egress_cidr_blocks = [
		21 |     /* MoJO DNS Resolver Service */
		22 |     "10.180.80.5/32",
		23 |     "10.180.81.5/32"
		24 |   ]
		25 | 
		26 |   tags = local.tags
		27 | }

checkov_exitcode=1

`CTFLint Scan` Success

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
terraform/environments/analytical-platform-ingestion

*****************************

Running tflint in terraform/environments/analytical-platform-ingestion
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=0

`Trivy Scan` Failed

Show Output

*****************************

Trivy will check the following folders:
terraform/environments/analytical-platform-ingestion

*****************************

Running Trivy in terraform/environments/analytical-platform-ingestion
2024-11-25T09:43:33Z	INFO	[vulndb] Need to update DB
2024-11-25T09:43:33Z	INFO	[vulndb] Downloading vulnerability DB...
2024-11-25T09:43:33Z	INFO	[vulndb] Downloading artifact...	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2024-11-25T09:43:35Z	INFO	[vulndb] Artifact successfully downloaded	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2024-11-25T09:43:35Z	INFO	[vuln] Vulnerability scanning is enabled
2024-11-25T09:43:35Z	INFO	[misconfig] Misconfiguration scanning is enabled
2024-11-25T09:43:35Z	INFO	[misconfig] Need to update the built-in checks
2024-11-25T09:43:35Z	INFO	[misconfig] Downloading the built-in checks...
160.25 KiB / 160.25 KiB [---------------------------------------------------------] 100.00% ? p/s 0s2024-11-25T09:43:35Z	INFO	[secret] Secret scanning is enabled
2024-11-25T09:43:35Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-11-25T09:43:35Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2024-11-25T09:43:36Z	INFO	[terraform scanner] Scanning root module	file_path="."
2024-11-25T09:43:36Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="networking"
2024-11-25T09:43:36Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.connected_vpc_transit_gateway_routes" value="cty.NilVal"
2024-11-25T09:43:36Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.sftp_users" value="cty.NilVal"
2024-11-25T09:43:36Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.sftp_users_with_egress" value="cty.NilVal"
2024-11-25T09:43:45Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.bold_egress_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T09:43:45Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.bold_egress_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T09:43:45Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datasync_bucket.aws_s3_bucket_replication_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_replication_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T09:43:45Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datasync_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T09:43:45Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datasync_bucket.aws_s3_bucket_replication_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_replication_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T09:43:45Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datasync_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T09:43:45Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datasync_bucket.aws_s3_bucket_replication_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_replication_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T09:43:45Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datasync_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T09:43:45Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datasync_bucket.aws_s3_bucket_replication_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_replication_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T09:43:45Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datasync_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T09:43:46Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.definition_upload_lambda.aws_lambda_function.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.vpc_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.logging_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T09:43:46Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.definition_upload_lambda.aws_lambda_function.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.vpc_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.logging_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T09:43:46Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.definition_upload_lambda.aws_lambda_function.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.vpc_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.logging_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T09:43:46Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.definition_upload_lambda.aws_lambda_function.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.vpc_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.logging_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T09:43:46Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.definitions_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T09:43:46Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.definitions_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T09:43:46Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.definition_upload_lambda.aws_lambda_function.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.vpc_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.logging_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T09:43:46Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.definition_upload_lambda.aws_lambda_function.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.vpc_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.logging_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T09:43:47Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-bucket-encryption" range="git::https:/github.com/terraform-aws-modules/terraform-aws-s3-bucket?ref=8a0b697adfbc673e6135c70246cff7f8052ad95a/main.tf:176-198"
2024-11-25T09:43:47Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-public-egress-sgr" range="terraform-aws-modules/security-group/aws/main.tf:533"
2024-11-25T09:43:47Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-public-egress-sgr" range="terraform-aws-modules/security-group/aws/main.tf:534"
2024-11-25T09:43:47Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="git::https:/github.com/terraform-aws-modules/terraform-aws-s3-bucket?ref=8a0b697adfbc673e6135c70246cff7f8052ad95a/main.tf:176-198"
2024-11-25T09:43:47Z	INFO	Number of language-specific files	num=0
2024-11-25T09:43:47Z	INFO	Detected config files	num=8

git::https:/github.com/terraform-aws-modules/terraform-aws-alb?ref=349540d1a611cd98a6383cc64ef0d9bf08d88fb7/main.tf (terraform)
===============================================================================================================================
Tests: 1 (SUCCESSES: 0, FAILURES: 1)
Failures: 1 (HIGH: 1, CRITICAL: 0)

AVD-AWS-0053 (HIGH): Load balancer is exposed publicly.
════════════════════════════════════════
There are many scenarios in which you would want to expose a load balancer to the wider internet, but this check exists as a warning to prevent accidental exposure of internal assets. You should ensure that this resource should be exposed publicly.


See https://avd.aquasec.com/misconfig/avd-aws-0053
────────────────────────────────────────
 git::https:/github.com/terraform-aws-modules/terraform-aws-alb?ref=349540d1a611cd98a6383cc64ef0d9bf08d88fb7/main.tf:47
   via git::https:/github.com/terraform-aws-modules/terraform-aws-alb?ref=349540d1a611cd98a6383cc64ef0d9bf08d88fb7/main.tf:12-81 (aws_lb.this[0])
    via network-load-balancers.tf:1-37 (module.datasync_activation_nlb)
────────────────────────────────────────
  12   resource "aws_lb" "this" {
  ..   
  47 [   internal                                                     = var.internal
  ..   
  81   }
────────────────────────────────────────



git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf (terraform)
===============================================================================================================================
Tests: 4 (SUCCESSES: 0, FAILURES: 4)
Failures: 4 (HIGH: 0, CRITICAL: 4)

AVD-AWS-0102 (CRITICAL): Network ACL rule allows access using ALL ports.
════════════════════════════════════════
Ensure access to specific required ports is allowed, and nothing else.


See https://avd.aquasec.com/misconfig/aws-vpc-no-excessive-port-access
────────────────────────────────────────
 git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:340
   via git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:328-343 (aws_network_acl_rule.private_outbound[0])
    via vpc.tf:1-23 (module.connected_vpc)
────────────────────────────────────────
 328   resource "aws_network_acl_rule" "private_outbound" {
 ...   
 340 [   protocol        = var.private_outbound_acl_rules[count.index]["protocol"]
 ...   
 343   }
────────────────────────────────────────


AVD-AWS-0102 (CRITICAL): Network ACL rule allows access using ALL ports.
════════════════════════════════════════
Ensure access to specific required ports is allowed, and nothing else.


See https://avd.aquasec.com/misconfig/aws-vpc-no-excessive-port-access
────────────────────────────────────────
 git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:323
   via git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:311-326 (aws_network_acl_rule.private_inbound[0])
    via vpc.tf:1-23 (module.connected_vpc)
────────────────────────────────────────
 311   resource "aws_network_acl_rule" "private_inbound" {
 ...   
 323 [   protocol        = var.private_inbound_acl_rules[count.index]["protocol"]
 ...   
 326   }
────────────────────────────────────────


AVD-AWS-0102 (CRITICAL): Network ACL rule allows access using ALL ports.
════════════════════════════════════════
Ensure access to specific required ports is allowed, and nothing else.


See https://avd.aquasec.com/misconfig/aws-vpc-no-excessive-port-access
────────────────────────────────────────
 git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:221
   via git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:209-224 (aws_network_acl_rule.public_outbound[0])
    via vpc.tf:1-23 (module.connected_vpc)
────────────────────────────────────────
 209   resource "aws_network_acl_rule" "public_outbound" {
 ...   
 221 [   protocol        = var.public_outbound_acl_rules[count.index]["protocol"]
 ...   
 224   }
────────────────────────────────────────


AVD-AWS-0102 (CRITICAL): Network ACL rule allows access using ALL ports.
════════════════════════════════════════
Ensure access to specific required ports is allowed, and nothing else.


See https://avd.aquasec.com/misconfig/aws-vpc-no-excessive-port-access
────────────────────────────────────────
 git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:204
   via git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:192-207 (aws_network_acl_rule.public_inbound[0])
    via vpc.tf:1-23 (module.connected_vpc)
────────────────────────────────────────
 192   resource "aws_network_acl_rule" "public_inbound" {
 ...   
 204 [   protocol        = var.public_inbound_acl_rules[count.index]["protocol"]
 ...   
 207   }
────────────────────────────────────────


trivy_exitcode=1

Removing external collaborators. Trying in one PR

2bce6cc

julialawrence requested review from a team as code owners November 25, 2024 09:41

github-actions bot added the environments-repository Used to exclude PRs from this repo in our Slack PR update label Nov 25, 2024

julialawrence had a problem deploying to analytical-platform-ingestion-development November 25, 2024 09:43 — with GitHub Actions Failure

jacobwoffenden approved these changes Nov 25, 2024

View reviewed changes

julialawrence merged commit 08a2d0d into main Nov 25, 2024
10 of 12 checks passed

julialawrence deleted the chore/removing-external-collaborators branch November 25, 2024 09:55

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

🔪 Removing external collaborators. Trying in one PR #8774

🔪 Removing external collaborators. Trying in one PR #8774

julialawrence commented Nov 25, 2024

github-actions bot commented Nov 25, 2024

git::https:/github.com/terraform-aws-modules/terraform-aws-alb?ref=349540d1a611cd98a6383cc64ef0d9bf08d88fb7/main.tf (terraform)

git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf (terraform)

🔪 Removing external collaborators. Trying in one PR #8774

🔪 Removing external collaborators. Trying in one PR #8774

Conversation

julialawrence commented Nov 25, 2024

github-actions bot commented Nov 25, 2024

Trivy Scan Failed

git::https:/github.com/terraform-aws-modules/terraform-aws-alb?ref=349540d1a611cd98a6383cc64ef0d9bf08d88fb7/main.tf (terraform)

git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf (terraform)

CTFLint Scan Success

Trivy Scan Failed

`Trivy Scan` Failed

`CTFLint Scan` Success

`Trivy Scan` Failed