🚚 Migrate Analytical Platform to Observability Platform Production #8793

jacobwoffenden · 2024-11-25T21:09:16Z

This pull request:

Is part of 🔧 Update tenant's configurations in Modernisation Platform Environments observability-platform#148
Sets OP module to observability-platform-production

Signed-off-by: Jacob Woffenden [email protected]

Signed-off-by: Jacob Woffenden <[email protected]>

github-actions · 2024-11-25T21:11:55Z

`Trivy Scan` Failed

Show Output

```hcl

Trivy will check the following folders:
terraform/environments/analytical-platform-compute
terraform/environments/analytical-platform-ingestion

Running Trivy in terraform/environments/analytical-platform-compute
2024-11-25T21:11:26Z INFO [vulndb] Need to update DB
2024-11-25T21:11:26Z INFO [vulndb] Downloading vulnerability DB...
2024-11-25T21:11:26Z INFO [vulndb] Downloading artifact... repo="public.ecr.aws/aquasecurity/trivy-db:2"
2024-11-25T21:11:28Z INFO [vulndb] Artifact successfully downloaded repo="public.ecr.aws/aquasecurity/trivy-db:2"
2024-11-25T21:11:28Z INFO [vuln] Vulnerability scanning is enabled
2024-11-25T21:11:28Z INFO [misconfig] Misconfiguration scanning is enabled
2024-11-25T21:11:28Z INFO [misconfig] Need to update the built-in checks
2024-11-25T21:11:28Z INFO [misconfig] Downloading the built-in checks...
160.25 KiB / 160.25 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2024-11-25T21:11:28Z INFO [secret] Secret scanning is enabled
2024-11-25T21:11:28Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-11-25T21:11:28Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2024-11-25T21:11:31Z INFO [terraform scanner] Scanning root module file_path="."
2024-11-25T21:11:31Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="networking"
2024-11-25T21:11:31Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.transit_gateway_routes" value="cty.NilVal"
2024-11-25T21:11:36Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.eks.aws_ec2_tag.cluster_primary_security_group" value="cty.NilVal"
2024-11-25T21:11:36Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.eks.module.kms.data.aws_iam_policy_document.this[0]" err="2 errors occurred:\n\t* invalid for-each in data.aws_iam_policy_document.this[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in data.aws_iam_policy_document.this[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:36Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.eks.module.kms.data.aws_iam_policy_document.this[0]" err="2 errors occurred:\n\t* invalid for-each in data.aws_iam_policy_document.this[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in data.aws_iam_policy_document.this[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:36Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.eks.module.kms.data.aws_iam_policy_document.this[0]" err="1 error occurred:\n\t* invalid for-each in data.aws_iam_policy_document.this[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:36Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.eks.module.kms.data.aws_iam_policy_document.this[0]" err="1 error occurred:\n\t* invalid for-each in data.aws_iam_policy_document.this[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.eks.module.eks_managed_node_group["airflow-high-memory"].aws_iam_role_policy_attachment.this" value="cty.NilVal"
2024-11-25T21:11:37Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.eks.module.eks_managed_node_group["airflow-high-memory"].aws_launch_template.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_launch_template.this[0].dynamic.block_device_mappings block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:37Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.eks.module.eks_managed_node_group["airflow-high-memory"].aws_launch_template.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_launch_template.this[0].dynamic.block_device_mappings block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.eks.module.eks_managed_node_group["general"].aws_iam_role_policy_attachment.this" value="cty.NilVal"
2024-11-25T21:11:37Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.eks.module.eks_managed_node_group["general"].aws_launch_template.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_launch_template.this[0].dynamic.block_device_mappings block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:37Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.eks.module.eks_managed_node_group["general"].aws_launch_template.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_launch_template.this[0].dynamic.block_device_mappings block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:37Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.eks_cluster_logs_kms.data.aws_iam_policy_document.this[0]" err="1 error occurred:\n\t* invalid for-each in data.aws_iam_policy_document.this[0].dynamic.statement.content.dynamic.condition block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:37Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.eks_cluster_logs_kms.data.aws_iam_policy_document.this[0]" err="1 error occurred:\n\t* invalid for-each in data.aws_iam_policy_document.this[0].dynamic.statement.content.dynamic.condition block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:37Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.eks.module.kms.data.aws_iam_policy_document.this[0]" err="1 error occurred:\n\t* invalid for-each in data.aws_iam_policy_document.this[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:37Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.eks.module.kms.data.aws_iam_policy_document.this[0]" err="1 error occurred:\n\t* invalid for-each in data.aws_iam_policy_document.this[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.eks.module.eks_managed_node_group["airflow-high-memory"].aws_iam_role_policy_attachment.this" value="cty.NilVal"
2024-11-25T21:11:37Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.eks.module.eks_managed_node_group["airflow-high-memory"].aws_launch_template.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_launch_template.this[0].dynamic.block_device_mappings block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:37Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.eks.module.eks_managed_node_group["airflow-high-memory"].aws_launch_template.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_launch_template.this[0].dynamic.block_device_mappings block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.eks.module.eks_managed_node_group["general"].aws_iam_role_policy_attachment.this" value="cty.NilVal"
2024-11-25T21:11:37Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.eks.module.eks_managed_node_group["general"].aws_launch_template.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_launch_template.this[0].dynamic.block_device_mappings block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:37Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.eks.module.eks_managed_node_group["general"].aws_launch_template.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_launch_template.this[0].dynamic.block_device_mappings block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:38Z INFO [terraform executor] Ignore finding rule="aws-eks-no-public-cluster-access-to-cidr" range="git::https:/github.com/terraform-aws-modules/terraform-aws-eks?ref=97a08c8aff5dbf51a86b4c8cd88a858336cd0208/main.tf:52"
2024-11-25T21:11:38Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-public-egress-sgr" range="git::https:/github.com/terraform-aws-modules/terraform-aws-eks?ref=97a08c8aff5dbf51a86b4c8cd88a858336cd0208/node_groups.tf:247"
2024-11-25T21:11:38Z INFO [terraform executor] Ignore finding rule="aws-eks-no-public-cluster-access" range="git::https:/github.com/terraform-aws-modules/terraform-aws-eks?ref=97a08c8aff5dbf51a86b4c8cd88a858336cd0208/main.tf:51"
2024-11-25T21:11:38Z INFO Number of language-specific files num=0
2024-11-25T21:11:38Z INFO Detected config files num=14
trivy_exitcode=0

Running Trivy in terraform/environments/analytical-platform-ingestion
2024-11-25T21:11:38Z INFO [vuln] Vulnerability scanning is enabled
2024-11-25T21:11:38Z INFO [misconfig] Misconfiguration scanning is enabled
2024-11-25T21:11:38Z INFO [secret] Secret scanning is enabled
2024-11-25T21:11:38Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-11-25T21:11:38Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2024-11-25T21:11:39Z INFO [terraform scanner] Scanning root module file_path="."
2024-11-25T21:11:39Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="networking"
2024-11-25T21:11:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.connected_vpc_transit_gateway_routes" value="cty.NilVal"
2024-11-25T21:11:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.sftp_users" value="cty.NilVal"
2024-11-25T21:11:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.sftp_users_with_egress" value="cty.NilVal"
2024-11-25T21:11:42Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.bold_egress_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:42Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.bold_egress_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:43Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datasync_bucket.aws_s3_bucket_replication_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_replication_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:43Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datasync_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:43Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datasync_bucket.aws_s3_bucket_replication_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_replication_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:43Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datasync_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:43Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datasync_bucket.aws_s3_bucket_replication_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_replication_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:43Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datasync_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:43Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datasync_bucket.aws_s3_bucket_replication_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_replication_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:43Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datasync_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:43Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.definition_upload_lambda.aws_lambda_function.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.vpc_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.logging_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:43Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.definition_upload_lambda.aws_lambda_function.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.vpc_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.logging_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:43Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.definition_upload_lambda.aws_lambda_function.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.vpc_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.logging_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:43Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.definition_upload_lambda.aws_lambda_function.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.vpc_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.logging_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:43Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.definitions_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:43Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.definitions_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:43Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.definition_upload_lambda.aws_lambda_function.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.vpc_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.logging_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:43Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.definition_upload_lambda.aws_lambda_function.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.vpc_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.logging_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:44Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-public-egress-sgr" range="terraform-aws-modules/security-group/aws/main.tf:533"
2024-11-25T21:11:44Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-public-egress-sgr" range="terraform-aws-modules/security-group/aws/main.tf:534"
2024-11-25T21:11:44Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="git::https:/github.com/terraform-aws-modules/terraform-aws-s3-bucket?ref=8a0b697adfbc673e6135c70246cff7f8052ad95a/main.tf:176-198"
2024-11-25T21:11:44Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-bucket-encryption" range="git::https:/github.com/terraform-aws-modules/terraform-aws-s3-bucket?ref=8a0b697adfbc673e6135c70246cff7f8052ad95a/main.tf:176-198"
2024-11-25T21:11:44Z INFO Number of language-specific files num=0
2024-11-25T21:11:44Z INFO Detected config files num=7

git::https:/github.com/terraform-aws-modules/terraform-aws-alb?ref=349540d1a611cd98a6383cc64ef0d9bf08d88fb7/main.tf (terraform)

Tests: 1 (SUCCESSES: 0, FAILURES: 1)
Failures: 1 (HIGH: 1, CRITICAL: 0)

AVD-AWS-0053 (HIGH): Load balancer is exposed publicly.
════════════════════════════════════════
There are many scenarios in which you would want to expose a load balancer to the wider internet, but this check exists as a warning to prevent accidental exposure of internal assets. You should ensure that this resource should be exposed publicly.

See https://avd.aquasec.com/misconfig/avd-aws-0053
────────────────────────────────────────
git::https:/github.com/terraform-aws-modules/terraform-aws-alb?ref=349540d1a611cd98a6383cc64ef0d9bf08d88fb7/main.tf:47
via git::https:/github.com/terraform-aws-modules/terraform-aws-alb?ref=349540d1a611cd98a6383cc64ef0d9bf08d88fb7/main.tf:12-81 (aws_lb.this[0])
via network-load-balancers.tf:1-37 (module.datasync_activation_nlb)
────────────────────────────────────────
12 resource "aws_lb" "this" {
..
47 [ internal = var.internal
..
81 }
────────────────────────────────────────

git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf (terraform)

Tests: 4 (SUCCESSES: 0, FAILURES: 4)
Failures: 4 (HIGH: 0, CRITICAL: 4)

AVD-AWS-0102 (CRITICAL): Network ACL rule allows access using ALL ports.
════════════════════════════════════════
Ensure access to specific required ports is allowed, and nothing else.

See https://avd.aquasec.com/misconfig/aws-vpc-no-excessive-port-access
────────────────────────────────────────
git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:340
via git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:328-343 (aws_network_acl_rule.private_outbound[0])
via vpc.tf:1-23 (module.connected_vpc)
────────────────────────────────────────
328 resource "aws_network_acl_rule" "private_outbound" {
...
340 [ protocol = var.private_outbound_acl_rules[count.index]["protocol"]
...
343 }
────────────────────────────────────────

AVD-AWS-0102 (CRITICAL): Network ACL rule allows access using ALL ports.
════════════════════════════════════════
Ensure access to specific required ports is allowed, and nothing else.

See https://avd.aquasec.com/misconfig/aws-vpc-no-excessive-port-access
────────────────────────────────────────
git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:323
via git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:311-326 (aws_network_acl_rule.private_inbound[0])
via vpc.tf:1-23 (module.connected_vpc)
────────────────────────────────────────
311 resource "aws_network_acl_rule" "private_inbound" {
...
323 [ protocol = var.private_inbound_acl_rules[count.index]["protocol"]
...
326 }
────────────────────────────────────────

AVD-AWS-0102 (CRITICAL): Network ACL rule allows access using ALL ports.
════════════════════════════════════════
Ensure access to specific required ports is allowed, and nothing else.

See https://avd.aquasec.com/misconfig/aws-vpc-no-excessive-port-access
────────────────────────────────────────
git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:221
via git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:209-224 (aws_network_acl_rule.public_outbound[0])
via vpc.tf:1-23 (module.connected_vpc)
────────────────────────────────────────
209 resource "aws_network_acl_rule" "public_outbound" {
...
221 [ protocol = var.public_outbound_acl_rules[count.index]["protocol"]
...
224 }
────────────────────────────────────────

AVD-AWS-0102 (CRITICAL): Network ACL rule allows access using ALL ports.
════════════════════════════════════════
Ensure access to specific required ports is allowed, and nothing else.

See https://avd.aquasec.com/misconfig/aws-vpc-no-excessive-port-access
────────────────────────────────────────
git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:204
via git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:192-207 (aws_network_acl_rule.public_inbound[0])
via vpc.tf:1-23 (module.connected_vpc)
────────────────────────────────────────
192 resource "aws_network_acl_rule" "public_inbound" {
...
204 [ protocol = var.public_inbound_acl_rules[count.index]["protocol"]
...
207 }
────────────────────────────────────────

trivy_exitcode=1

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/analytical-platform-compute
terraform/environments/analytical-platform-ingestion

*****************************

Running Checkov in terraform/environments/analytical-platform-compute
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2024-11-25 21:11:47,099 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/cloudwatch/aws//modules/log-group:5.6.1 (for external modules, the --download-external-modules flag is required)
2024-11-25 21:11:47,100 [MainThread  ] [WARNI]  Failed to download module ministryofjustice/observability-platform-tenant/aws:1.2.0 (for external modules, the --download-external-modules flag is required)
2024-11-25 21:11:47,100 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/eks/aws:20.29.0 (for external modules, the --download-external-modules flag is required)
2024-11-25 21:11:47,100 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/eks/aws//modules/karpenter:20.29.0 (for external modules, the --download-external-modules flag is required)
2024-11-25 21:11:47,100 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/kms/aws:3.1.1 (for external modules, the --download-external-modules flag is required)
2024-11-25 21:11:47,100 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/route53/aws//modules/zones:4.1.0 (for external modules, the --download-external-modules flag is required)
2024-11-25 21:11:47,100 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/secrets-manager/aws:1.3.1 (for external modules, the --download-external-modules flag is required)
2024-11-25 21:11:47,101 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/s3-bucket/aws:4.2.2 (for external modules, the --download-external-modules flag is required)
2024-11-25 21:11:47,101 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/rds/aws:6.10.0 (for external modules, the --download-external-modules flag is required)
2024-11-25 21:11:47,101 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/vpc/aws//modules/vpc-endpoints:5.15.0 (for external modules, the --download-external-modules flag is required)
2024-11-25 21:11:47,101 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/eks-pod-identity/aws:1.7.0 (for external modules, the --download-external-modules flag is required)
2024-11-25 21:11:47,101 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/vpc/aws:5.15.0 (for external modules, the --download-external-modules flag is required)
2024-11-25 21:11:47,101 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/managed-service-prometheus/aws:3.0.0 (for external modules, the --download-external-modules flag is required)
2024-11-25 21:11:47,102 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks:5.48.0 (for external modules, the --download-external-modules flag is required)
2024-11-25 21:11:47,102 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/iam/aws//modules/iam-github-oidc-role:5.48.0 (for external modules, the --download-external-modules flag is required)
2024-11-25 21:11:47,102 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/iam/aws//modules/iam-assumable-role:5.48.0 (for external modules, the --download-external-modules flag is required)
2024-11-25 21:11:47,102 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/security-group/aws:5.2.0 (for external modules, the --download-external-modules flag is required)
2024-11-25 21:11:47,102 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/iam/aws//modules/iam-policy:5.48.0 (for external modules, the --download-external-modules flag is required)
2024-11-25 21:11:48,982 [MainThread  ] [WARNI]  Failed updating attribute for key: zones.${local.environment_configuration.route53_zone} and value {'comment': '${trimprefix(terraform.workspace,"${var.networking[0].application}-")}_configurations[${trimprefix(terraform.workspace,"${var.networking[0].application}-")}]'} forvertex attributes {'__end_line__': 16, '__resolved__': [], '__start_line__': 1, 'source': ['terraform-aws-modules/route53/aws//modules/zones'], 'tags': ['${merge(jsondecode(data.http.environments_file.response_body).tags,{\'is-production\': ${substr(terraform.workspace,length(analytical-platform-compute),length(terraform.workspace)) == "-production"}},{\'environment-name\': \'${terraform.workspace}\'},{\'source-code\': \'https://github.com/ministryofjustice/modernisation-platform-environments\'})}'], 'version': ['4.1.0'], 'zones': {'${local.environment_configuration.route53_zone}': {'comment': '${trimprefix(terraform.workspace,"${var.networking[0].application}-")}_configurations[${trimprefix(terraform.workspace,"${var.networking[0].application}-")}]'}}, 'zones.${local.environment_configuration.route53_zone}': {'comment': '${trimprefix(terraform.workspace,"${var.networking[0].application}-")}_configurations[${trimprefix(terraform.workspace,"${var.networking[0].application}-")}]'}, 'zones.${local.environment_configuration.route53_zone}.comment': '${trimprefix(terraform.workspace,"${var.networking[0].application}-")}_configurations[${trimprefix(terraform.workspace,"${var.networking[0].application}-")}]'}. Falling back to explicitly setting it.Exception - Parse error at 1:7 near token $ ($)
2024-11-25 21:11:49,134 [MainThread  ] [WARNI]  Failed updating attribute for key: zones.${local.environment_configuration.route53_zone} and value {'comment': '${trimprefix(terraform.workspace,"${var.networking[0].application}-")}_configurations[${trimprefix(terraform.workspace,"${var.networking[0].application}-")}]'} forvertex attributes {'__end_line__': 16, '__resolved__': [], '__start_line__': 1, 'source': ['terraform-aws-modules/route53/aws//modules/zones'], 'tags': ['${merge(jsondecode(data.http.environments_file.response_body).tags,{\'is-production\': ${substr(terraform.workspace,length(analytical-platform-compute),length(terraform.workspace)) == "-production"}},{\'environment-name\': \'${terraform.workspace}\'},{\'source-code\': \'https://github.com/ministryofjustice/modernisation-platform-environments\'})}'], 'version': ['4.1.0'], 'zones': {'${local.environment_configuration.route53_zone}': {'comment': '${trimprefix(terraform.workspace,"${var.networking[0].application}-")}_configurations[${trimprefix(terraform.workspace,"${var.networking[0].application}-")}]'}}, 'zones.${local.environment_configuration.route53_zone}': {'comment': '${trimprefix(terraform.workspace,"${var.networking[0].application}-")}_configurations[${trimprefix(terraform.workspace,"${var.networking[0].application}-")}]'}, 'zones.${local.environment_configuration.route53_zone}.comment': '${trimprefix(terraform.workspace,"${var.networking[0].application}-")}_configurations[${trimprefix(terraform.workspace,"${var.networking[0].application}-")}]'}. Falling back to explicitly setting it.Exception - Parse error at 1:7 near token $ ($)
2024-11-25 21:11:49,269 [MainThread  ] [WARNI]  Failed updating attribute for key: zones.${local.environment_configuration.route53_zone} and value {'comment': '${trimprefix(terraform.workspace,"${var.networking[0].application}-")}_configurations[${trimprefix(terraform.workspace,"${var.networking[0].application}-")}]'} forvertex attributes {'__end_line__': 16, '__resolved__': [], '__start_line__': 1, 'source': ['terraform-aws-modules/route53/aws//modules/zones'], 'tags': ['${merge(jsondecode(data.http.environments_file.response_body).tags,{\'is-production\': ${substr(terraform.workspace,length(analytical-platform-compute),length(terraform.workspace)) == "-production"}},{\'environment-name\': \'${terraform.workspace}\'},{\'source-code\': \'https://github.com/ministryofjustice/modernisation-platform-environments\'})}'], 'version': ['4.1.0'], 'zones': {'${local.environment_configuration.route53_zone}': {'comment': '${trimprefix(terraform.workspace,"${var.networking[0].application}-")}_configurations[${trimprefix(terraform.workspace,"${var.networking[0].application}-")}]'}}, 'zones.${local.environment_configuration.route53_zone}': {'comment': '${trimprefix(terraform.workspace,"${var.networking[0].application}-")}_configurations[${trimprefix(terraform.workspace,"${var.networking[0].application}-")}]'}, 'zones.${local.environment_configuration.route53_zone}.comment': '${trimprefix(terraform.workspace,"${var.networking[0].application}-")}_configurations[${trimprefix(terraform.workspace,"${var.networking[0].application}-")}]'}. Falling back to explicitly setting it.Exception - Parse error at 1:7 near token $ ($)
terraform scan results:

Passed checks: 154, Failed checks: 0, Skipped checks: 153


checkov_exitcode=0

*****************************

Running Checkov in terraform/environments/analytical-platform-ingestion
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2024-11-25 21:11:51,839 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/cloudwatch/aws//modules/log-group:5.6.0 (for external modules, the --download-external-modules flag is required)
2024-11-25 21:11:51,839 [MainThread  ] [WARNI]  Failed to download module ministryofjustice/observability-platform-tenant/aws:1.2.0 (for external modules, the --download-external-modules flag is required)
2024-11-25 21:11:51,839 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/kms/aws:3.1.0 (for external modules, the --download-external-modules flag is required)
2024-11-25 21:11:51,839 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/route53/aws//modules/resolver-rule-associations:4.1.0 (for external modules, the --download-external-modules flag is required)
2024-11-25 21:11:51,840 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/secrets-manager/aws:1.3.1 (for external modules, the --download-external-modules flag is required)
2024-11-25 21:11:51,840 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/sns/aws:6.1.0 (for external modules, the --download-external-modules flag is required)
2024-11-25 21:11:51,840 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/vpc/aws//modules/vpc-endpoints:5.13.0 (for external modules, the --download-external-modules flag is required)
2024-11-25 21:11:51,840 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/route53/aws//modules/resolver-endpoints:4.1.0 (for external modules, the --download-external-modules flag is required)
2024-11-25 21:11:51,840 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/lambda/aws:7.9.0 (for external modules, the --download-external-modules flag is required)
2024-11-25 21:11:51,840 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/vpc/aws:5.13.0 (for external modules, the --download-external-modules flag is required)
2024-11-25 21:11:51,840 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/iam/aws//modules/iam-assumable-role:5.44.1 (for external modules, the --download-external-modules flag is required)
2024-11-25 21:11:51,841 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/s3-bucket/aws:4.1.2 (for external modules, the --download-external-modules flag is required)
2024-11-25 21:11:51,841 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/security-group/aws:5.2.0 (for external modules, the --download-external-modules flag is required)
2024-11-25 21:11:51,841 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/alb/aws:9.11.0 (for external modules, the --download-external-modules flag is required)
2024-11-25 21:11:51,841 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/s3-bucket/aws//modules/notification:4.1.2 (for external modules, the --download-external-modules flag is required)
2024-11-25 21:11:51,841 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/iam/aws//modules/iam-policy:5.44.1 (for external modules, the --download-external-modules flag is required)
2024-11-25 21:11:51,841 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/ec2-instance/aws:5.7.1 (for external modules, the --download-external-modules flag is required)
2024-11-25 21:11:52,855 [MainThread  ] [WARNI]  Failed updating attribute for key: statement.1.resources and value {'0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}'} forvertex attributes {'__end_line__': 31, '__start_line__': 3, 'statement': [{'actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'effect': 'Allow', 'resources': ['${var.landing_bucket_kms_key}'], 'sid': 'AllowKMS'}, {'actions': ['s3:ListBucket'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}', 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3ListBucket'}, {'actions': ['s3:PutObject'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3LandingBucketObjectActions'}], 'statement.0': {'actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'effect': 'Allow', 'resources': ['${var.landing_bucket_kms_key}'], 'sid': 'AllowKMS'}, 'statement.0.actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'statement.0.actions.0': 'kms:Decrypt', 'statement.0.actions.1': 'kms:DescribeKey', 'statement.0.actions.2': 'kms:Encrypt', 'statement.0.actions.3': 'kms:GenerateDataKey*', 'statement.0.actions.4': 'kms:ReEncrypt*', 'statement.0.effect': 'Allow', 'statement.0.resources': ['${var.landing_bucket_kms_key}'], 'statement.0.resources.0': '${var.landing_bucket_kms_key}', 'statement.0.sid': 'AllowKMS', 'statement.1': {'actions': ['s3:ListBucket'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}', 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3ListBucket'}, 'statement.1.actions': ['s3:ListBucket'], 'statement.1.actions.0': 's3:ListBucket', 'statement.1.effect': 'Allow', 'statement.1.resources': {'1': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'}, 'statement.1.resources.0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}', 'statement.1.resources.1': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*', 'statement.1.sid': 'AllowS3ListBucket', 'statement.2': {'actions': ['s3:PutObject'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3LandingBucketObjectActions'}, 'statement.2.actions': ['s3:PutObject'], 'statement.2.actions.0': 's3:PutObject', 'statement.2.effect': 'Allow', 'statement.2.resources': {'0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'}, 'statement.2.resources.0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*', 'statement.2.sid': 'AllowS3LandingBucketObjectActions'}. Falling back to explicitly setting it.Exception - Parse error at 1:14 near token resources (ID)
2024-11-25 21:11:52,872 [MainThread  ] [WARNI]  Failed updating attribute for key: statement.1.resources and value {'1': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}'} forvertex attributes {'__end_line__': 44, '__start_line__': 3, 'statement': [{'actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'effect': 'Allow', 'resources': ['${var.egress_bucket_kms_key}', '${var.landing_bucket_kms_key}'], 'sid': 'AllowKMS'}, {'actions': ['s3:ListBucket'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${each.value.egress_bucket}', 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}'], 'sid': 'AllowS3ListBucket'}, {'actions': ['s3:PutObject'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3LandingBucketObjectActions'}, {'actions': ['s3:GetObject', 's3:GetObjectAcl', 's3:GetObjectVersion'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${each.value.egress_bucket}/${each.key}/*'], 'sid': 'AllowS3EgressBucketObjectActions'}], 'statement.0': {'actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'effect': 'Allow', 'resources': ['${var.egress_bucket_kms_key}', '${var.landing_bucket_kms_key}'], 'sid': 'AllowKMS'}, 'statement.0.actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'statement.0.actions.0': 'kms:Decrypt', 'statement.0.actions.1': 'kms:DescribeKey', 'statement.0.actions.2': 'kms:Encrypt', 'statement.0.actions.3': 'kms:GenerateDataKey*', 'statement.0.actions.4': 'kms:ReEncrypt*', 'statement.0.effect': 'Allow', 'statement.0.resources': ['${var.egress_bucket_kms_key}', '${var.landing_bucket_kms_key}'], 'statement.0.resources.0': '${var.egress_bucket_kms_key}', 'statement.0.resources.1': '${var.landing_bucket_kms_key}', 'statement.0.sid': 'AllowKMS', 'statement.1': {'actions': ['s3:ListBucket'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${each.value.egress_bucket}', 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}'], 'sid': 'AllowS3ListBucket'}, 'statement.1.actions': ['s3:ListBucket'], 'statement.1.actions.0': 's3:ListBucket', 'statement.1.effect': 'Allow', 'statement.1.resources': {'0': 'arn:aws:s3:::${each.value.egress_bucket}'}, 'statement.1.resources.0': 'arn:aws:s3:::${each.value.egress_bucket}', 'statement.1.resources.1': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}', 'statement.1.sid': 'AllowS3ListBucket', 'statement.2': {'actions': ['s3:PutObject'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3LandingBucketObjectActions'}, 'statement.2.actions': ['s3:PutObject'], 'statement.2.actions.0': 's3:PutObject', 'statement.2.effect': 'Allow', 'statement.2.resources': {'0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'}, 'statement.2.resources.0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*', 'statement.2.sid': 'AllowS3LandingBucketObjectActions', 'statement.3': {'actions': ['s3:GetObject', 's3:GetObjectAcl', 's3:GetObjectVersion'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${each.value.egress_bucket}/${each.key}/*'], 'sid': 'AllowS3EgressBucketObjectActions'}, 'statement.3.actions': ['s3:GetObject', 's3:GetObjectAcl', 's3:GetObjectVersion'], 'statement.3.actions.0': 's3:GetObject', 'statement.3.actions.1': 's3:GetObjectAcl', 'statement.3.actions.2': 's3:GetObjectVersion', 'statement.3.effect': 'Allow', 'statement.3.resources': {'0': 'arn:aws:s3:::${each.value.egress_bucket}/${each.key}/*'}, 'statement.3.resources.0': 'arn:aws:s3:::${each.value.egress_bucket}/${each.key}/*', 'statement.3.sid': 'AllowS3EgressBucketObjectActions'}. Falling back to explicitly setting it.Exception - Parse error at 1:14 near token resources (ID)
2024-11-25 21:11:52,891 [MainThread  ] [WARNI]  Failed updating attribute for key: statement.0.resources and value {'1': 'module.s3_landing_kms.key_arn'} forvertex attributes {'__end_line__': 44, '__start_line__': 3, 'statement': [{'actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'effect': 'Allow', 'resources': ['each.value.egress_bucket_kms_key', 'module.s3_landing_kms.key_arn'], 'sid': 'AllowKMS'}, {'actions': ['s3:ListBucket'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${each.value.egress_bucket}', 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}'], 'sid': 'AllowS3ListBucket'}, {'actions': ['s3:PutObject'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3LandingBucketObjectActions'}, {'actions': ['s3:GetObject', 's3:GetObjectAcl', 's3:GetObjectVersion'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${each.value.egress_bucket}/${each.key}/*'], 'sid': 'AllowS3EgressBucketObjectActions'}], 'statement.0': {'actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'effect': 'Allow', 'resources': ['each.value.egress_bucket_kms_key', 'module.s3_landing_kms.key_arn'], 'sid': 'AllowKMS'}, 'statement.0.actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'statement.0.actions.0': 'kms:Decrypt', 'statement.0.actions.1': 'kms:DescribeKey', 'statement.0.actions.2': 'kms:Encrypt', 'statement.0.actions.3': 'kms:GenerateDataKey*', 'statement.0.actions.4': 'kms:ReEncrypt*', 'statement.0.effect': 'Allow', 'statement.0.resources': {'0': 'each.value.egress_bucket_kms_key'}, 'statement.0.resources.0': 'each.value.egress_bucket_kms_key', 'statement.0.resources.1': 'module.s3_landing_kms.key_arn', 'statement.0.sid': 'AllowKMS', 'statement.1': {'actions': ['s3:ListBucket'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${each.value.egress_bucket}', 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}'], 'sid': 'AllowS3ListBucket'}, 'statement.1.actions': ['s3:ListBucket'], 'statement.1.actions.0': 's3:ListBucket', 'statement.1.effect': 'Allow', 'statement.1.resources': {'1': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}'}, 'statement.1.resources.0': 'arn:aws:s3:::${each.value.egress_bucket}', 'statement.1.resources.1': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}', 'statement.1.sid': 'AllowS3ListBucket', 'statement.2': {'actions': ['s3:PutObject'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3LandingBucketObjectActions'}, 'statement.2.actions': ['s3:PutObject'], 'statement.2.actions.0': 's3:PutObject', 'statement.2.effect': 'Allow', 'statement.2.resources': {'0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'}, 'statement.2.resources.0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*', 'statement.2.sid': 'AllowS3LandingBucketObjectActions', 'statement.3': {'actions': ['s3:GetObject', 's3:GetObjectAcl', 's3:GetObjectVersion'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${each.value.egress_bucket}/${each.key}/*'], 'sid': 'AllowS3EgressBucketObjectActions'}, 'statement.3.actions': ['s3:GetObject', 's3:GetObjectAcl', 's3:GetObjectVersion'], 'statement.3.actions.0': 's3:GetObject', 'statement.3.actions.1': 's3:GetObjectAcl', 'statement.3.actions.2': 's3:GetObjectVersion', 'statement.3.effect': 'Allow', 'statement.3.resources': {'0': 'arn:aws:s3:::${each.value.egress_bucket}/${each.key}/*'}, 'statement.3.resources.0': 'arn:aws:s3:::${each.value.egress_bucket}/${each.key}/*', 'statement.3.sid': 'AllowS3EgressBucketObjectActions'}. Falling back to explicitly setting it.Exception - Parse error at 1:14 near token resources (ID)
2024-11-25 21:11:52,982 [MainThread  ] [WARNI]  Failed updating attribute for key: statement.1.resources and value {'0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}'} forvertex attributes {'__end_line__': 31, '__start_line__': 3, 'statement': [{'actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'effect': 'Allow', 'resources': ['${var.landing_bucket_kms_key}'], 'sid': 'AllowKMS'}, {'actions': ['s3:ListBucket'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}', 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3ListBucket'}, {'actions': ['s3:PutObject'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3LandingBucketObjectActions'}], 'statement.0': {'actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'effect': 'Allow', 'resources': ['${var.landing_bucket_kms_key}'], 'sid': 'AllowKMS'}, 'statement.0.actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'statement.0.actions.0': 'kms:Decrypt', 'statement.0.actions.1': 'kms:DescribeKey', 'statement.0.actions.2': 'kms:Encrypt', 'statement.0.actions.3': 'kms:GenerateDataKey*', 'statement.0.actions.4': 'kms:ReEncrypt*', 'statement.0.effect': 'Allow', 'statement.0.resources': ['${var.landing_bucket_kms_key}'], 'statement.0.resources.0': '${var.landing_bucket_kms_key}', 'statement.0.sid': 'AllowKMS', 'statement.1': {'actions': ['s3:ListBucket'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}', 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3ListBucket'}, 'statement.1.actions': ['s3:ListBucket'], 'statement.1.actions.0': 's3:ListBucket', 'statement.1.effect': 'Allow', 'statement.1.resources': {'1': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'}, 'statement.1.resources.0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}', 'statement.1.resources.1': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*', 'statement.1.sid': 'AllowS3ListBucket', 'statement.2': {'actions': ['s3:PutObject'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3LandingBucketObjectActions'}, 'statement.2.actions': ['s3:PutObject'], 'statement.2.actions.0': 's3:PutObject', 'statement.2.effect': 'Allow', 'statement.2.resources': {'0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'}, 'statement.2.resources.0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*', 'statement.2.sid': 'AllowS3LandingBucketObjectActions'}. Falling back to explicitly setting it.Exception - Parse error at 1:14 near token resources (ID)
2024-11-25 21:11:53,000 [MainThread  ] [WARNI]  Failed updating attribute for key: statement.1.resources and value {'1': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}'} forvertex attributes {'__end_line__': 44, '__start_line__': 3, 'statement': [{'actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'effect': 'Allow', 'resources': ['${var.egress_bucket_kms_key}', '${var.landing_bucket_kms_key}'], 'sid': 'AllowKMS'}, {'actions': ['s3:ListBucket'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${each.value.egress_bucket}', 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}'], 'sid': 'AllowS3ListBucket'}, {'actions': ['s3:PutObject'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3LandingBucketObjectActions'}, {'actions': ['s3:GetObject', 's3:GetObjectAcl', 's3:GetObjectVersion'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${each.value.egress_bucket}/${each.key}/*'], 'sid': 'AllowS3EgressBucketObjectActions'}], 'statement.0': {'actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'effect': 'Allow', 'resources': ['${var.egress_bucket_kms_key}', '${var.landing_bucket_kms_key}'], 'sid': 'AllowKMS'}, 'statement.0.actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'statement.0.actions.0': 'kms:Decrypt', 'statement.0.actions.1': 'kms:DescribeKey', 'statement.0.actions.2': 'kms:Encrypt', 'statement.0.actions.3': 'kms:GenerateDataKey*', 'statement.0.actions.4': 'kms:ReEncrypt*', 'statement.0.effect': 'Allow', 'statement.0.resources': ['${var.egress_bucket_kms_key}', '${var.landing_bucket_kms_key}'], 'statement.0.resources.0': '${var.egress_bucket_kms_key}', 'statement.0.resources.1': '${var.landing_bucket_kms_key}', 'statement.0.sid': 'AllowKMS', 'statement.1': {'actions': ['s3:ListBucket'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${each.value.egress_bucket}', 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}'], 'sid': 'AllowS3ListBucket'}, 'statement.1.actions': ['s3:ListBucket'], 'statement.1.actions.0': 's3:ListBucket', 'statement.1.effect': 'Allow', 'statement.1.resources': {'0': 'arn:aws:s3:::${each.value.egress_bucket}'}, 'statement.1.resources.0': 'arn:aws:s3:::${each.value.egress_bucket}', 'statement.1.resources.1': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}', 'statement.1.sid': 'AllowS3ListBucket', 'statement.2': {'actions': ['s3:PutObject'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3LandingBucketObjectActions'}, 'statement.2.actions': ['s3:PutObject'], 'statement.2.actions.0': 's3:PutObject', 'statement.2.effect': 'Allow', 'statement.2.resources': {'0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'}, 'statement.2.resources.0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*', 'statement.2.sid': 'AllowS3LandingBucketObjectActions', 'statement.3': {'actions': ['s3:GetObject', 's3:GetObjectAcl', 's3:GetObjectVersion'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${each.value.egress_bucket}/${each.key}/*'], 'sid': 'AllowS3EgressBucketObjectActions'}, 'statement.3.actions': ['s3:GetObject', 's3:GetObjectAcl', 's3:GetObjectVersion'], 'statement.3.actions.0': 's3:GetObject', 'statement.3.actions.1': 's3:GetObjectAcl', 'statement.3.actions.2': 's3:GetObjectVersion', 'statement.3.effect': 'Allow', 'statement.3.resources': {'0': 'arn:aws:s3:::${each.value.egress_bucket}/${each.key}/*'}, 'statement.3.resources.0': 'arn:aws:s3:::${each.value.egress_bucket}/${each.key}/*', 'statement.3.sid': 'AllowS3EgressBucketObjectActions'}. Falling back to explicitly setting it.Exception - Parse error at 1:14 near token resources (ID)
2024-11-25 21:11:53,018 [MainThread  ] [WARNI]  Failed updating attribute for key: statement.0.resources and value {'1': 'module.s3_landing_kms.key_arn'} forvertex attributes {'__end_line__': 44, '__start_line__': 3, 'statement': [{'actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'effect': 'Allow', 'resources': ['each.value.egress_bucket_kms_key', 'module.s3_landing_kms.key_arn'], 'sid': 'AllowKMS'}, {'actions': ['s3:ListBucket'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${each.value.egress_bucket}', 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}'], 'sid': 'AllowS3ListBucket'}, {'actions': ['s3:PutObject'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3LandingBucketObjectActions'}, {'actions': ['s3:GetObject', 's3:GetObjectAcl', 's3:GetObjectVersion'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${each.value.egress_bucket}/${each.key}/*'], 'sid': 'AllowS3EgressBucketObjectActions'}], 'statement.0': {'actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'effect': 'Allow', 'resources': ['each.value.egress_bucket_kms_key', 'module.s3_landing_kms.key_arn'], 'sid': 'AllowKMS'}, 'statement.0.actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'statement.0.actions.0': 'kms:Decrypt', 'statement.0.actions.1': 'kms:DescribeKey', 'statement.0.actions.2': 'kms:Encrypt', 'statement.0.actions.3': 'kms:GenerateDataKey*', 'statement.0.actions.4': 'kms:ReEncrypt*', 'statement.0.effect': 'Allow', 'statement.0.resources': {'0': 'each.value.egress_bucket_kms_key'}, 'statement.0.resources.0': 'each.value.egress_bucket_kms_key', 'statement.0.resources.1': 'module.s3_landing_kms.key_arn', 'statement.0.sid': 'AllowKMS', 'statement.1': {'actions': ['s3:ListBucket'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${each.value.egress_bucket}', 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}'], 'sid': 'AllowS3ListBucket'}, 'statement.1.actions': ['s3:ListBucket'], 'statement.1.actions.0': 's3:ListBucket', 'statement.1.effect': 'Allow', 'statement.1.resources': {'1': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}'}, 'statement.1.resources.0': 'arn:aws:s3:::${each.value.egress_bucket}', 'statement.1.resources.1': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}', 'statement.1.sid': 'AllowS3ListBucket', 'statement.2': {'actions': ['s3:PutObject'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3LandingBucketObjectActions'}, 'statement.2.actions': ['s3:PutObject'], 'statement.2.actions.0': 's3:PutObject', 'statement.2.effect': 'Allow', 'statement.2.resources': {'0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'}, 'statement.2.resources.0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*', 'statement.2.sid': 'AllowS3LandingBucketObjectActions', 'statement.3': {'actions': ['s3:GetObject', 's3:GetObjectAcl', 's3:GetObjectVersion'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${each.value.egress_bucket}/${each.key}/*'], 'sid': 'AllowS3EgressBucketObjectActions'}, 'statement.3.actions': ['s3:GetObject', 's3:GetObjectAcl', 's3:GetObjectVersion'], 'statement.3.actions.0': 's3:GetObject', 'statement.3.actions.1': 's3:GetObjectAcl', 'statement.3.actions.2': 's3:GetObjectVersion', 'statement.3.effect': 'Allow', 'statement.3.resources': {'0': 'arn:aws:s3:::${each.value.egress_bucket}/${each.key}/*'}, 'statement.3.resources.0': 'arn:aws:s3:::${each.value.egress_bucket}/${each.key}/*', 'statement.3.sid': 'AllowS3EgressBucketObjectActions'}. Falling back to explicitly setting it.Exception - Parse error at 1:14 near token resources (ID)
2024-11-25 21:11:53,103 [MainThread  ] [WARNI]  Failed updating attribute for key: statement.1.resources and value {'0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}'} forvertex attributes {'__end_line__': 31, '__start_line__': 3, 'statement': [{'actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'effect': 'Allow', 'resources': ['${var.landing_bucket_kms_key}'], 'sid': 'AllowKMS'}, {'actions': ['s3:ListBucket'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}', 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3ListBucket'}, {'actions': ['s3:PutObject'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3LandingBucketObjectActions'}], 'statement.0': {'actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'effect': 'Allow', 'resources': ['${var.landing_bucket_kms_key}'], 'sid': 'AllowKMS'}, 'statement.0.actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'statement.0.actions.0': 'kms:Decrypt', 'statement.0.actions.1': 'kms:DescribeKey', 'statement.0.actions.2': 'kms:Encrypt', 'statement.0.actions.3': 'kms:GenerateDataKey*', 'statement.0.actions.4': 'kms:ReEncrypt*', 'statement.0.effect': 'Allow', 'statement.0.resources': ['${var.landing_bucket_kms_key}'], 'statement.0.resources.0': '${var.landing_bucket_kms_key}', 'statement.0.sid': 'AllowKMS', 'statement.1': {'actions': ['s3:ListBucket'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}', 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3ListBucket'}, 'statement.1.actions': ['s3:ListBucket'], 'statement.1.actions.0': 's3:ListBucket', 'statement.1.effect': 'Allow', 'statement.1.resources': {'1': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'}, 'statement.1.resources.0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}', 'statement.1.resources.1': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*', 'statement.1.sid': 'AllowS3ListBucket', 'statement.2': {'actions': ['s3:PutObject'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3LandingBucketObjectActions'}, 'statement.2.actions': ['s3:PutObject'], 'statement.2.actions.0': 's3:PutObject', 'statement.2.effect': 'Allow', 'statement.2.resources': {'0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'}, 'statement.2.resources.0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*', 'statement.2.sid': 'AllowS3LandingBucketObjectActions'}. Falling back to explicitly setting it.Exception - Parse error at 1:14 near token resources (ID)
2024-11-25 21:11:53,120 [MainThread  ] [WARNI]  Failed updating attribute for key: statement.1.resources and value {'1': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}'} forvertex attributes {'__end_line__': 44, '__start_line__': 3, 'statement': [{'actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'effect': 'Allow', 'resources': ['${var.egress_bucket_kms_key}', '${var.landing_bucket_kms_key}'], 'sid': 'AllowKMS'}, {'actions': ['s3:ListBucket'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${each.value.egress_bucket}', 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}'], 'sid': 'AllowS3ListBucket'}, {'actions': ['s3:PutObject'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3LandingBucketObjectActions'}, {'actions': ['s3:GetObject', 's3:GetObjectAcl', 's3:GetObjectVersion'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${each.value.egress_bucket}/${each.key}/*'], 'sid': 'AllowS3EgressBucketObjectActions'}], 'statement.0': {'actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'effect': 'Allow', 'resources': ['${var.egress_bucket_kms_key}', '${var.landing_bucket_kms_key}'], 'sid': 'AllowKMS'}, 'statement.0.actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'statement.0.actions.0': 'kms:Decrypt', 'statement.0.actions.1': 'kms:DescribeKey', 'statement.0.actions.2': 'kms:Encrypt', 'statement.0.actions.3': 'kms:GenerateDataKey*', 'statement.0.actions.4': 'kms:ReEncrypt*', 'statement.0.effect': 'Allow', 'statement.0.resources': ['${var.egress_bucket_kms_key}', '${var.landing_bucket_kms_key}'], 'statement.0.resources.0': '${var.egress_bucket_kms_key}', 'statement.0.resources.1': '${var.landing_bucket_kms_key}', 'statement.0.sid': 'AllowKMS', 'statement.1': {'actions': ['s3:ListBucket'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${each.value.egress_bucket}', 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}'], 'sid': 'AllowS3ListBucket'}, 'statement.1.actions': ['s3:ListBucket'], 'statement.1.actions.0': 's3:ListBucket', 'statement.1.effect': 'Allow', 'statement.1.resources': {'0': 'arn:aws:s3:::${each.value.egress_bucket}'}, 'statement.1.resources.0': 'arn:aws:s3:::${each.value.egress_bucket}', 'statement.1.resources.1': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}', 'statement.1.sid': 'AllowS3ListBucket', 'statement.2': {'actions': ['s3:PutObject'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3LandingBucketObjectActions'}, 'statement.2.actions': ['s3:PutObject'], 'statement.2.actions.0': 's3:PutObject', 'statement.2.effect': 'Allow', 'statement.2.resources': {'0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'}, 'statement.2.resources.0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*', 'statement.2.sid': 'AllowS3LandingBucketObjectActions', 'statement.3': {'actions': ['s3:GetObject', 's3:GetObjectAcl', 's3:GetObjectVersion'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${each.value.egress_bucket}/${each.key}/*'], 'sid': 'AllowS3EgressBucketObjectActions'}, 'statement.3.actions': ['s3:GetObject', 's3:GetObjectAcl', 's3:GetObjectVersion'], 'statement.3.actions.0': 's3:GetObject', 'statement.3.actions.1': 's3:GetObjectAcl', 'statement.3.actions.2': 's3:GetObjectVersion', 'statement.3.effect': 'Allow', 'statement.3.resources': {'0': 'arn:aws:s3:::${each.value.egress_bucket}/${each.key}/*'}, 'statement.3.resources.0': 'arn:aws:s3:::${each.value.egress_bucket}/${each.key}/*', 'statement.3.sid': 'AllowS3EgressBucketObjectActions'}. Falling back to explicitly setting it.Exception - Parse error at 1:14 near token resources (ID)
2024-11-25 21:11:53,139 [MainThread  ] [WARNI]  Failed updating attribute for key: statement.0.resources and value {'1': 'module.s3_landing_kms.key_arn'} forvertex attributes {'__end_line__': 44, '__start_line__': 3, 'statement': [{'actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'effect': 'Allow', 'resources': ['each.value.egress_bucket_kms_key', 'module.s3_landing_kms.key_arn'], 'sid': 'AllowKMS'}, {'actions': ['s3:ListBucket'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${each.value.egress_bucket}', 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}'], 'sid': 'AllowS3ListBucket'}, {'actions': ['s3:PutObject'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3LandingBucketObjectActions'}, {'actions': ['s3:GetObject', 's3:GetObjectAcl', 's3:GetObjectVersion'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${each.value.egress_bucket}/${each.key}/*'], 'sid': 'AllowS3EgressBucketObjectActions'}], 'statement.0': {'actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'effect': 'Allow', 'resources': ['each.value.egress_bucket_kms_key', 'module.s3_landing_kms.key_arn'], 'sid': 'AllowKMS'}, 'statement.0.actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'statement.0.actions.0': 'kms:Decrypt', 'statement.0.actions.1': 'kms:DescribeKey', 'statement.0.actions.2': 'kms:Encrypt', 'statement.0.actions.3': 'kms:GenerateDataKey*', 'statement.0.actions.4': 'kms:ReEncrypt*', 'statement.0.effect': 'Allow', 'statement.0.resources': {'0': 'each.value.egress_bucket_kms_key'}, 'statement.0.resources.0': 'each.value.egress_bucket_kms_key', 'statement.0.resources.1': 'module.s3_landing_kms.key_arn', 'statement.0.sid': 'AllowKMS', 'statement.1': {'actions': ['s3:ListBucket'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${each.value.egress_bucket}', 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}'], 'sid': 'AllowS3ListBucket'}, 'statement.1.actions': ['s3:ListBucket'], 'statement.1.actions.0': 's3:ListBucket', 'statement.1.effect': 'Allow', 'statement.1.resources': {'1': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}'}, 'statement.1.resources.0': 'arn:aws:s3:::${each.value.egress_bucket}', 'statement.1.resources.1': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}', 'statement.1.sid': 'AllowS3ListBucket', 'statement.2': {'actions': ['s3:PutObject'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3LandingBucketObjectActions'}, 'statement.2.actions': ['s3:PutObject'], 'statement.2.actions.0': 's3:PutObject', 'statement.2.effect': 'Allow', 'statement.2.resources': {'0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'}, 'statement.2.resources.0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*', 'statement.2.sid': 'AllowS3LandingBucketObjectActions', 'statement.3': {'actions': ['s3:GetObject', 's3:GetObjectAcl', 's3:GetObjectVersion'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${each.value.egress_bucket}/${each.key}/*'], 'sid': 'AllowS3EgressBucketObjectActions'}, 'statement.3.actions': ['s3:GetObject', 's3:GetObjectAcl', 's3:GetObjectVersion'], 'statement.3.actions.0': 's3:GetObject', 'statement.3.actions.1': 's3:GetObjectAcl', 'statement.3.actions.2': 's3:GetObjectVersion', 'statement.3.effect': 'Allow', 'statement.3.resources': {'0': 'arn:aws:s3:::${each.value.egress_bucket}/${each.key}/*'}, 'statement.3.resources.0': 'arn:aws:s3:::${each.value.egress_bucket}/${each.key}/*', 'statement.3.sid': 'AllowS3EgressBucketObjectActions'}. Falling back to explicitly setting it.Exception - Parse error at 1:14 near token resources (ID)
2024-11-25 21:11:53,249 [MainThread  ] [WARNI]  Failed updating attribute for key: statement.1.resources and value {'0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}'} forvertex attributes {'__end_line__': 31, '__start_line__': 3, 'statement': [{'actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'effect': 'Allow', 'resources': ['${var.landing_bucket_kms_key}'], 'sid': 'AllowKMS'}, {'actions': ['s3:ListBucket'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}', 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3ListBucket'}, {'actions': ['s3:PutObject'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3LandingBucketObjectActions'}], 'statement.0': {'actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'effect': 'Allow', 'resources': ['${var.landing_bucket_kms_key}'], 'sid': 'AllowKMS'}, 'statement.0.actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'statement.0.actions.0': 'kms:Decrypt', 'statement.0.actions.1': 'kms:DescribeKey', 'statement.0.actions.2': 'kms:Encrypt', 'statement.0.actions.3': 'kms:GenerateDataKey*', 'statement.0.actions.4': 'kms:ReEncrypt*', 'statement.0.effect': 'Allow', 'statement.0.resources': ['${var.landing_bucket_kms_key}'], 'statement.0.resources.0': '${var.landing_bucket_kms_key}', 'statement.0.sid': 'AllowKMS', 'statement.1': {'actions': ['s3:ListBucket'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}', 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3ListBucket'}, 'statement.1.actions': ['s3:ListBucket'], 'statement.1.actions.0': 's3:ListBucket', 'statement.1.effect': 'Allow', 'statement.1.resources': {'1': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'}, 'statement.1.resources.0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}', 'statement.1.resources.1': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*', 'statement.1.sid': 'AllowS3ListBucket', 'statement.2': {'actions': ['s3:PutObject'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3LandingBucketObjectActions'}, 'statement.2.actions': ['s3:PutObject'], 'statement.2.actions.0': 's3:PutObject', 'statement.2.effect': 'Allow', 'statement.2.resources': {'0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'}, 'statement.2.resources.0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*', 'statement.2.sid': 'AllowS3LandingBucketObjectActions'}. Falling back to explicitly setting it.Exception - Parse error at 1:14 near token resources (ID)
2024-11-25 21:11:53,266 [MainThread  ] [WARNI]  Failed updating attribute for key: statement.1.resources and value {'1': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}'} forvertex attributes {'__end_line__': 44, '__start_line__': 3, 'statement': [{'actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'effect': 'Allow', 'resources': ['${var.egress_bucket_kms_key}', '${var.landing_bucket_kms_key}'], 'sid': 'AllowKMS'}, {'actions': ['s3:ListBucket'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${each.value.egress_bucket}', 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}'], 'sid': 'AllowS3ListBucket'}, {'actions': ['s3:PutObject'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3LandingBucketObjectActions'}, {'actions': ['s3:GetObject', 's3:GetObjectAcl', 's3:GetObjectVersion'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${each.value.egress_bucket}/${each.key}/*'], 'sid': 'AllowS3EgressBucketObjectActions'}], 'statement.0': {'actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'effect': 'Allow', 'resources': ['${var.egress_bucket_kms_key}', '${var.landing_bucket_kms_key}'], 'sid': 'AllowKMS'}, 'statement.0.actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'statement.0.actions.0': 'kms:Decrypt', 'statement.0.actions.1': 'kms:DescribeKey', 'statement.0.actions.2': 'kms:Encrypt', 'statement.0.actions.3': 'kms:GenerateDataKey*', 'statement.0.actions.4': 'kms:ReEncrypt*', 'statement.0.effect': 'Allow', 'statement.0.resources': ['${var.egress_bucket_kms_key}', '${var.landing_bucket_kms_key}'], 'statement.0.resources.0': '${var.egress_bucket_kms_key}', 'statement.0.resources.1': '${var.landing_bucket_kms_key}', 'statement.0.sid': 'AllowKMS', 'statement.1': {'actions': ['s3:ListBucket'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${each.value.egress_bucket}', 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}'], 'sid': 'AllowS3ListBucket'}, 'statement.1.actions': ['s3:ListBucket'], 'statement.1.actions.0': 's3:ListBucket', 'statement.1.effect': 'Allow', 'statement.1.resources': {'0': 'arn:aws:s3:::${each.value.egress_bucket}'}, 'statement.1.resources.0': 'arn:aws:s3:::${each.value.egress_bucket}', 'statement.1.resources.1': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}', 'statement.1.sid': 'AllowS3ListBucket', 'statement.2': {'actions': ['s3:PutObject'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3LandingBucketObjectActions'}, 'statement.2.actions': ['s3:PutObject'], 'statement.2.actions.0': 's3:PutObject', 'statement.2.effect': 'Allow', 'statement.2.resources': {'0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'}, 'statement.2.resources.0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*', 'statement.2.sid': 'AllowS3LandingBucketObjectActions', 'statement.3': {'actions': ['s3:GetObject', 's3:GetObjectAcl', 's3:GetObjectVersion'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${each.value.egress_bucket}/${each.key}/*'], 'sid': 'AllowS3EgressBucketObjectActions'}, 'statement.3.actions': ['s3:GetObject', 's3:GetObjectAcl', 's3:GetObjectVersion'], 'statement.3.actions.0': 's3:GetObject', 'statement.3.actions.1': 's3:GetObjectAcl', 'statement.3.actions.2': 's3:GetObjectVersion', 'statement.3.effect': 'Allow', 'statement.3.resources': {'0': 'arn:aws:s3:::${each.value.egress_bucket}/${each.key}/*'}, 'statement.3.resources.0': 'arn:aws:s3:::${each.value.egress_bucket}/${each.key}/*', 'statement.3.sid': 'AllowS3EgressBucketObjectActions'}. Falling back to explicitly setting it.Exception - Parse error at 1:14 near token resources (ID)
2024-11-25 21:11:53,304 [MainThread  ] [WARNI]  Failed updating attribute for key: statement.0.resources and value {'1': 'module.s3_landing_kms.key_arn'} forvertex attributes {'__end_line__': 44, '__start_line__': 3, 'statement': [{'actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'effect': 'Allow', 'resources': ['each.value.egress_bucket_kms_key', 'module.s3_landing_kms.key_arn'], 'sid': 'AllowKMS'}, {'actions': ['s3:ListBucket'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${each.value.egress_bucket}', 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}'], 'sid': 'AllowS3ListBucket'}, {'actions': ['s3:PutObject'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3LandingBucketObjectActions'}, {'actions': ['s3:GetObject', 's3:GetObjectAcl', 's3:GetObjectVersion'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${each.value.egress_bucket}/${each.key}/*'], 'sid': 'AllowS3EgressBucketObjectActions'}], 'statement.0': {'actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'effect': 'Allow', 'resources': ['each.value.egress_bucket_kms_key', 'module.s3_landing_kms.key_arn'], 'sid': 'AllowKMS'}, 'statement.0.actions': ['kms:Decrypt', 'kms:DescribeKey', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'], 'statement.0.actions.0': 'kms:Decrypt', 'statement.0.actions.1': 'kms:DescribeKey', 'statement.0.actions.2': 'kms:Encrypt', 'statement.0.actions.3': 'kms:GenerateDataKey*', 'statement.0.actions.4': 'kms:ReEncrypt*', 'statement.0.effect': 'Allow', 'statement.0.resources': {'0': 'each.value.egress_bucket_kms_key'}, 'statement.0.resources.0': 'each.value.egress_bucket_kms_key', 'statement.0.resources.1': 'module.s3_landing_kms.key_arn', 'statement.0.sid': 'AllowKMS', 'statement.1': {'actions': ['s3:ListBucket'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${each.value.egress_bucket}', 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}'], 'sid': 'AllowS3ListBucket'}, 'statement.1.actions': ['s3:ListBucket'], 'statement.1.actions.0': 's3:ListBucket', 'statement.1.effect': 'Allow', 'statement.1.resources': {'1': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}'}, 'statement.1.resources.0': 'arn:aws:s3:::${each.value.egress_bucket}', 'statement.1.resources.1': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}', 'statement.1.sid': 'AllowS3ListBucket', 'statement.2': {'actions': ['s3:PutObject'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'], 'sid': 'AllowS3LandingBucketObjectActions'}, 'statement.2.actions': ['s3:PutObject'], 'statement.2.actions.0': 's3:PutObject', 'statement.2.effect': 'Allow', 'statement.2.resources': {'0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*'}, 'statement.2.resources.0': 'arn:aws:s3:::${module.landing_bucket.s3_bucket_id}/${each.key}/*', 'statement.2.sid': 'AllowS3LandingBucketObjectActions', 'statement.3': {'actions': ['s3:GetObject', 's3:GetObjectAcl', 's3:GetObjectVersion'], 'effect': 'Allow', 'resources': ['arn:aws:s3:::${each.value.egress_bucket}/${each.key}/*'], 'sid': 'AllowS3EgressBucketObjectActions'}, 'statement.3.actions': ['s3:GetObject', 's3:GetObjectAcl', 's3:GetObjectVersion'], 'statement.3.actions.0': 's3:GetObject', 'statement.3.actions.1': 's3:GetObjectAcl', 'statement.3.actions.2': 's3:GetObjectVersion', 'statement.3.effect': 'Allow', 'statement.3.resources': {'0': 'arn:aws:s3:::${each.value.egress_bucket}/${each.key}/*'}, 'statement.3.resources.0': 'arn:aws:s3:::${each.value.egress_bucket}/${each.key}/*', 'statement.3.sid': 'AllowS3EgressBucketObjectActions'}. Falling back to explicitly setting it.Exception - Parse error at 1:14 near token resources (ID)
terraform scan results:

Passed checks: 198, Failed checks: 2, Skipped checks: 74

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: connected_vpc_route53_resolver_associations
	File: /route53-resolver-associations.tf:1-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		1  | module "connected_vpc_route53_resolver_associations" {
		2  | 
		3  |   source  = "terraform-aws-modules/route53/aws//modules/resolver-rule-associations"
		4  |   version = "4.1.0"
		5  | 
		6  |   vpc_id = module.connected_vpc.vpc_id
		7  | 
		8  |   resolver_rule_associations = {
		9  |     mojo-dns-resolver-dom1-infra-int = {
		10 |       resolver_rule_id = aws_route53_resolver_rule.mojo_dns_resolver_dom1_infra_int.id
		11 |     }
		12 |   }
		13 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: connected_vpc_outbound_route53_resolver_endpoint
	File: /route53-resolver-endpoints.tf:1-27
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		1  | module "connected_vpc_outbound_route53_resolver_endpoint" {
		2  |   source  = "terraform-aws-modules/route53/aws//modules/resolver-endpoints"
		3  |   version = "4.1.0"
		4  | 
		5  |   name      = "connected-vpc-outbound"
		6  |   vpc_id    = module.connected_vpc.vpc_id
		7  |   direction = "OUTBOUND"
		8  |   protocols = ["Do53"]
		9  | 
		10 |   ip_address = [
		11 |     {
		12 |       subnet_id = module.connected_vpc.private_subnets[0]
		13 |     },
		14 |     {
		15 |       subnet_id = module.connected_vpc.private_subnets[1]
		16 |     }
		17 |   ]
		18 | 
		19 |   security_group_ingress_cidr_blocks = [module.connected_vpc.vpc_cidr_block]
		20 |   security_group_egress_cidr_blocks = [
		21 |     /* MoJO DNS Resolver Service */
		22 |     "10.180.80.5/32",
		23 |     "10.180.81.5/32"
		24 |   ]
		25 | 
		26 |   tags = local.tags
		27 | }

checkov_exitcode=1

`CTFLint Scan` Success

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
terraform/environments/analytical-platform-compute
terraform/environments/analytical-platform-ingestion

*****************************

Running tflint in terraform/environments/analytical-platform-compute
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=0

*****************************

Running tflint in terraform/environments/analytical-platform-ingestion
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=0

`Trivy Scan` Failed

Show Output

*****************************

Trivy will check the following folders:
terraform/environments/analytical-platform-compute
terraform/environments/analytical-platform-ingestion

*****************************

Running Trivy in terraform/environments/analytical-platform-compute
2024-11-25T21:11:26Z	INFO	[vulndb] Need to update DB
2024-11-25T21:11:26Z	INFO	[vulndb] Downloading vulnerability DB...
2024-11-25T21:11:26Z	INFO	[vulndb] Downloading artifact...	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2024-11-25T21:11:28Z	INFO	[vulndb] Artifact successfully downloaded	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2024-11-25T21:11:28Z	INFO	[vuln] Vulnerability scanning is enabled
2024-11-25T21:11:28Z	INFO	[misconfig] Misconfiguration scanning is enabled
2024-11-25T21:11:28Z	INFO	[misconfig] Need to update the built-in checks
2024-11-25T21:11:28Z	INFO	[misconfig] Downloading the built-in checks...
160.25 KiB / 160.25 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2024-11-25T21:11:28Z	INFO	[secret] Secret scanning is enabled
2024-11-25T21:11:28Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-11-25T21:11:28Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2024-11-25T21:11:31Z	INFO	[terraform scanner] Scanning root module	file_path="."
2024-11-25T21:11:31Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="networking"
2024-11-25T21:11:31Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.transit_gateway_routes" value="cty.NilVal"
2024-11-25T21:11:36Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.eks.aws_ec2_tag.cluster_primary_security_group" value="cty.NilVal"
2024-11-25T21:11:36Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.eks.module.kms.data.aws_iam_policy_document.this[0]" err="2 errors occurred:\n\t* invalid for-each in data.aws_iam_policy_document.this[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in data.aws_iam_policy_document.this[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:36Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.eks.module.kms.data.aws_iam_policy_document.this[0]" err="2 errors occurred:\n\t* invalid for-each in data.aws_iam_policy_document.this[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in data.aws_iam_policy_document.this[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:36Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.eks.module.kms.data.aws_iam_policy_document.this[0]" err="1 error occurred:\n\t* invalid for-each in data.aws_iam_policy_document.this[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:36Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.eks.module.kms.data.aws_iam_policy_document.this[0]" err="1 error occurred:\n\t* invalid for-each in data.aws_iam_policy_document.this[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.eks.module.eks_managed_node_group[\"airflow-high-memory\"].aws_iam_role_policy_attachment.this" value="cty.NilVal"
2024-11-25T21:11:37Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.eks.module.eks_managed_node_group[\"airflow-high-memory\"].aws_launch_template.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_launch_template.this[0].dynamic.block_device_mappings block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:37Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.eks.module.eks_managed_node_group[\"airflow-high-memory\"].aws_launch_template.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_launch_template.this[0].dynamic.block_device_mappings block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.eks.module.eks_managed_node_group[\"general\"].aws_iam_role_policy_attachment.this" value="cty.NilVal"
2024-11-25T21:11:37Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.eks.module.eks_managed_node_group[\"general\"].aws_launch_template.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_launch_template.this[0].dynamic.block_device_mappings block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:37Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.eks.module.eks_managed_node_group[\"general\"].aws_launch_template.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_launch_template.this[0].dynamic.block_device_mappings block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:37Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.eks_cluster_logs_kms.data.aws_iam_policy_document.this[0]" err="1 error occurred:\n\t* invalid for-each in data.aws_iam_policy_document.this[0].dynamic.statement.content.dynamic.condition block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:37Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.eks_cluster_logs_kms.data.aws_iam_policy_document.this[0]" err="1 error occurred:\n\t* invalid for-each in data.aws_iam_policy_document.this[0].dynamic.statement.content.dynamic.condition block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:37Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.eks.module.kms.data.aws_iam_policy_document.this[0]" err="1 error occurred:\n\t* invalid for-each in data.aws_iam_policy_document.this[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:37Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.eks.module.kms.data.aws_iam_policy_document.this[0]" err="1 error occurred:\n\t* invalid for-each in data.aws_iam_policy_document.this[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.eks.module.eks_managed_node_group[\"airflow-high-memory\"].aws_iam_role_policy_attachment.this" value="cty.NilVal"
2024-11-25T21:11:37Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.eks.module.eks_managed_node_group[\"airflow-high-memory\"].aws_launch_template.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_launch_template.this[0].dynamic.block_device_mappings block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:37Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.eks.module.eks_managed_node_group[\"airflow-high-memory\"].aws_launch_template.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_launch_template.this[0].dynamic.block_device_mappings block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.eks.module.eks_managed_node_group[\"general\"].aws_iam_role_policy_attachment.this" value="cty.NilVal"
2024-11-25T21:11:37Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.eks.module.eks_managed_node_group[\"general\"].aws_launch_template.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_launch_template.this[0].dynamic.block_device_mappings block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:37Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.eks.module.eks_managed_node_group[\"general\"].aws_launch_template.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_launch_template.this[0].dynamic.block_device_mappings block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:38Z	INFO	[terraform executor] Ignore finding	rule="aws-eks-no-public-cluster-access-to-cidr" range="git::https:/github.com/terraform-aws-modules/terraform-aws-eks?ref=97a08c8aff5dbf51a86b4c8cd88a858336cd0208/main.tf:52"
2024-11-25T21:11:38Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-public-egress-sgr" range="git::https:/github.com/terraform-aws-modules/terraform-aws-eks?ref=97a08c8aff5dbf51a86b4c8cd88a858336cd0208/node_groups.tf:247"
2024-11-25T21:11:38Z	INFO	[terraform executor] Ignore finding	rule="aws-eks-no-public-cluster-access" range="git::https:/github.com/terraform-aws-modules/terraform-aws-eks?ref=97a08c8aff5dbf51a86b4c8cd88a858336cd0208/main.tf:51"
2024-11-25T21:11:38Z	INFO	Number of language-specific files	num=0
2024-11-25T21:11:38Z	INFO	Detected config files	num=14
trivy_exitcode=0

*****************************

Running Trivy in terraform/environments/analytical-platform-ingestion
2024-11-25T21:11:38Z	INFO	[vuln] Vulnerability scanning is enabled
2024-11-25T21:11:38Z	INFO	[misconfig] Misconfiguration scanning is enabled
2024-11-25T21:11:38Z	INFO	[secret] Secret scanning is enabled
2024-11-25T21:11:38Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-11-25T21:11:38Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2024-11-25T21:11:39Z	INFO	[terraform scanner] Scanning root module	file_path="."
2024-11-25T21:11:39Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="networking"
2024-11-25T21:11:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.connected_vpc_transit_gateway_routes" value="cty.NilVal"
2024-11-25T21:11:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.sftp_users" value="cty.NilVal"
2024-11-25T21:11:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.sftp_users_with_egress" value="cty.NilVal"
2024-11-25T21:11:42Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.bold_egress_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:42Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.bold_egress_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:43Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datasync_bucket.aws_s3_bucket_replication_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_replication_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:43Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datasync_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:43Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datasync_bucket.aws_s3_bucket_replication_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_replication_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:43Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datasync_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:43Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datasync_bucket.aws_s3_bucket_replication_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_replication_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:43Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datasync_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:43Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datasync_bucket.aws_s3_bucket_replication_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_replication_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:43Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datasync_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:43Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.definition_upload_lambda.aws_lambda_function.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.vpc_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.logging_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:43Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.definition_upload_lambda.aws_lambda_function.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.vpc_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.logging_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:43Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.definition_upload_lambda.aws_lambda_function.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.vpc_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.logging_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:43Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.definition_upload_lambda.aws_lambda_function.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.vpc_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.logging_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:43Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.definitions_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:43Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.definitions_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:43Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.definition_upload_lambda.aws_lambda_function.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.vpc_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.logging_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:43Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.definition_upload_lambda.aws_lambda_function.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.vpc_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.logging_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:11:44Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-public-egress-sgr" range="terraform-aws-modules/security-group/aws/main.tf:533"
2024-11-25T21:11:44Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-public-egress-sgr" range="terraform-aws-modules/security-group/aws/main.tf:534"
2024-11-25T21:11:44Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="git::https:/github.com/terraform-aws-modules/terraform-aws-s3-bucket?ref=8a0b697adfbc673e6135c70246cff7f8052ad95a/main.tf:176-198"
2024-11-25T21:11:44Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-bucket-encryption" range="git::https:/github.com/terraform-aws-modules/terraform-aws-s3-bucket?ref=8a0b697adfbc673e6135c70246cff7f8052ad95a/main.tf:176-198"
2024-11-25T21:11:44Z	INFO	Number of language-specific files	num=0
2024-11-25T21:11:44Z	INFO	Detected config files	num=7

git::https:/github.com/terraform-aws-modules/terraform-aws-alb?ref=349540d1a611cd98a6383cc64ef0d9bf08d88fb7/main.tf (terraform)
===============================================================================================================================
Tests: 1 (SUCCESSES: 0, FAILURES: 1)
Failures: 1 (HIGH: 1, CRITICAL: 0)

AVD-AWS-0053 (HIGH): Load balancer is exposed publicly.
════════════════════════════════════════
There are many scenarios in which you would want to expose a load balancer to the wider internet, but this check exists as a warning to prevent accidental exposure of internal assets. You should ensure that this resource should be exposed publicly.


See https://avd.aquasec.com/misconfig/avd-aws-0053
────────────────────────────────────────
 git::https:/github.com/terraform-aws-modules/terraform-aws-alb?ref=349540d1a611cd98a6383cc64ef0d9bf08d88fb7/main.tf:47
   via git::https:/github.com/terraform-aws-modules/terraform-aws-alb?ref=349540d1a611cd98a6383cc64ef0d9bf08d88fb7/main.tf:12-81 (aws_lb.this[0])
    via network-load-balancers.tf:1-37 (module.datasync_activation_nlb)
────────────────────────────────────────
  12   resource "aws_lb" "this" {
  ..   
  47 [   internal                                                     = var.internal
  ..   
  81   }
────────────────────────────────────────



git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf (terraform)
===============================================================================================================================
Tests: 4 (SUCCESSES: 0, FAILURES: 4)
Failures: 4 (HIGH: 0, CRITICAL: 4)

AVD-AWS-0102 (CRITICAL): Network ACL rule allows access using ALL ports.
════════════════════════════════════════
Ensure access to specific required ports is allowed, and nothing else.


See https://avd.aquasec.com/misconfig/aws-vpc-no-excessive-port-access
────────────────────────────────────────
 git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:340
   via git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:328-343 (aws_network_acl_rule.private_outbound[0])
    via vpc.tf:1-23 (module.connected_vpc)
────────────────────────────────────────
 328   resource "aws_network_acl_rule" "private_outbound" {
 ...   
 340 [   protocol        = var.private_outbound_acl_rules[count.index]["protocol"]
 ...   
 343   }
────────────────────────────────────────


AVD-AWS-0102 (CRITICAL): Network ACL rule allows access using ALL ports.
════════════════════════════════════════
Ensure access to specific required ports is allowed, and nothing else.


See https://avd.aquasec.com/misconfig/aws-vpc-no-excessive-port-access
────────────────────────────────────────
 git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:323
   via git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:311-326 (aws_network_acl_rule.private_inbound[0])
    via vpc.tf:1-23 (module.connected_vpc)
────────────────────────────────────────
 311   resource "aws_network_acl_rule" "private_inbound" {
 ...   
 323 [   protocol        = var.private_inbound_acl_rules[count.index]["protocol"]
 ...   
 326   }
────────────────────────────────────────


AVD-AWS-0102 (CRITICAL): Network ACL rule allows access using ALL ports.
════════════════════════════════════════
Ensure access to specific required ports is allowed, and nothing else.


See https://avd.aquasec.com/misconfig/aws-vpc-no-excessive-port-access
────────────────────────────────────────
 git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:221
   via git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:209-224 (aws_network_acl_rule.public_outbound[0])
    via vpc.tf:1-23 (module.connected_vpc)
────────────────────────────────────────
 209   resource "aws_network_acl_rule" "public_outbound" {
 ...   
 221 [   protocol        = var.public_outbound_acl_rules[count.index]["protocol"]
 ...   
 224   }
────────────────────────────────────────


AVD-AWS-0102 (CRITICAL): Network ACL rule allows access using ALL ports.
════════════════════════════════════════
Ensure access to specific required ports is allowed, and nothing else.


See https://avd.aquasec.com/misconfig/aws-vpc-no-excessive-port-access
────────────────────────────────────────
 git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:204
   via git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:192-207 (aws_network_acl_rule.public_inbound[0])
    via vpc.tf:1-23 (module.connected_vpc)
────────────────────────────────────────
 192   resource "aws_network_acl_rule" "public_inbound" {
 ...   
 204 [   protocol        = var.public_inbound_acl_rules[count.index]["protocol"]
 ...   
 207   }
────────────────────────────────────────


trivy_exitcode=1

Signed-off-by: Jacob Woffenden <[email protected]>

github-actions · 2024-11-25T21:17:32Z

`Trivy Scan` Failed

Show Output

```hcl

Trivy will check the following folders:
terraform/environments/analytical-platform-compute
terraform/environments/analytical-platform-ingestion

Running Trivy in terraform/environments/analytical-platform-compute
2024-11-25T21:17:04Z INFO [vulndb] Need to update DB
2024-11-25T21:17:04Z INFO [vulndb] Downloading vulnerability DB...
2024-11-25T21:17:04Z INFO [vulndb] Downloading artifact... repo="public.ecr.aws/aquasecurity/trivy-db:2"
2024-11-25T21:17:06Z INFO [vulndb] Artifact successfully downloaded repo="public.ecr.aws/aquasecurity/trivy-db:2"
2024-11-25T21:17:06Z INFO [vuln] Vulnerability scanning is enabled
2024-11-25T21:17:06Z INFO [misconfig] Misconfiguration scanning is enabled
2024-11-25T21:17:06Z INFO [misconfig] Need to update the built-in checks
2024-11-25T21:17:06Z INFO [misconfig] Downloading the built-in checks...
2024-11-25T21:17:07Z ERROR [misconfig] Falling back to embedded checks err="failed to download built-in policies: download error: oci download error: failed to fetch the layer: GET https://ghcr.io/v2/aquasecurity/trivy-checks/blobs/sha256:16442a4593a0395452e678ef699a880eec94d9211dfc887d52574beb78b95030: TOOMANYREQUESTS: retry-after: 417.441µs, allowed: 44000/minute"
2024-11-25T21:17:07Z INFO [secret] Secret scanning is enabled
2024-11-25T21:17:07Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-11-25T21:17:07Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2024-11-25T21:17:08Z INFO [terraform scanner] Scanning root module file_path="."
2024-11-25T21:17:08Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="networking"
2024-11-25T21:17:08Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.transit_gateway_routes" value="cty.NilVal"
2024-11-25T21:17:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.eks.aws_ec2_tag.cluster_primary_security_group" value="cty.NilVal"
2024-11-25T21:17:13Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.eks.module.kms.data.aws_iam_policy_document.this[0]" err="2 errors occurred:\n\t* invalid for-each in data.aws_iam_policy_document.this[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in data.aws_iam_policy_document.this[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:17:13Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.eks.module.kms.data.aws_iam_policy_document.this[0]" err="2 errors occurred:\n\t* invalid for-each in data.aws_iam_policy_document.this[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in data.aws_iam_policy_document.this[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:17:13Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.eks.module.kms.data.aws_iam_policy_document.this[0]" err="1 error occurred:\n\t* invalid for-each in data.aws_iam_policy_document.this[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:17:13Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.eks.module.kms.data.aws_iam_policy_document.this[0]" err="1 error occurred:\n\t* invalid for-each in data.aws_iam_policy_document.this[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:17:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.eks.module.eks_managed_node_group["airflow-high-memory"].aws_iam_role_policy_attachment.this" value="cty.NilVal"
2024-11-25T21:17:13Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.eks.module.eks_managed_node_group["airflow-high-memory"].aws_launch_template.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_launch_template.this[0].dynamic.block_device_mappings block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:17:13Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.eks.module.eks_managed_node_group["airflow-high-memory"].aws_launch_template.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_launch_template.this[0].dynamic.block_device_mappings block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:17:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.eks.module.eks_managed_node_group["general"].aws_iam_role_policy_attachment.this" value="cty.NilVal"
2024-11-25T21:17:13Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.eks.module.eks_managed_node_group["general"].aws_launch_template.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_launch_template.this[0].dynamic.block_device_mappings block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:17:13Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.eks.module.eks_managed_node_group["general"].aws_launch_template.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_launch_template.this[0].dynamic.block_device_mappings block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:17:14Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.eks_cluster_logs_kms.data.aws_iam_policy_document.this[0]" err="1 error occurred:\n\t* invalid for-each in data.aws_iam_policy_document.this[0].dynamic.statement.content.dynamic.condition block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:17:14Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.eks_cluster_logs_kms.data.aws_iam_policy_document.this[0]" err="1 error occurred:\n\t* invalid for-each in data.aws_iam_policy_document.this[0].dynamic.statement.content.dynamic.condition block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:17:14Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.eks.module.kms.data.aws_iam_policy_document.this[0]" err="1 error occurred:\n\t* invalid for-each in data.aws_iam_policy_document.this[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:17:14Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.eks.module.kms.data.aws_iam_policy_document.this[0]" err="1 error occurred:\n\t* invalid for-each in data.aws_iam_policy_document.this[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:17:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.eks.module.eks_managed_node_group["airflow-high-memory"].aws_iam_role_policy_attachment.this" value="cty.NilVal"
2024-11-25T21:17:14Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.eks.module.eks_managed_node_group["airflow-high-memory"].aws_launch_template.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_launch_template.this[0].dynamic.block_device_mappings block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:17:14Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.eks.module.eks_managed_node_group["airflow-high-memory"].aws_launch_template.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_launch_template.this[0].dynamic.block_device_mappings block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:17:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.eks.module.eks_managed_node_group["general"].aws_iam_role_policy_attachment.this" value="cty.NilVal"
2024-11-25T21:17:14Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.eks.module.eks_managed_node_group["general"].aws_launch_template.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_launch_template.this[0].dynamic.block_device_mappings block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:17:14Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.eks.module.eks_managed_node_group["general"].aws_launch_template.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_launch_template.this[0].dynamic.block_device_mappings block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:17:15Z INFO [terraform executor] Ignore finding rule="aws-eks-no-public-cluster-access-to-cidr" range="git::https:/github.com/terraform-aws-modules/terraform-aws-eks?ref=97a08c8aff5dbf51a86b4c8cd88a858336cd0208/main.tf:52"
2024-11-25T21:17:15Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-public-egress-sgr" range="git::https:/github.com/terraform-aws-modules/terraform-aws-eks?ref=97a08c8aff5dbf51a86b4c8cd88a858336cd0208/node_groups.tf:247"
2024-11-25T21:17:15Z INFO [terraform executor] Ignore finding rule="aws-eks-no-public-cluster-access" range="git::https:/github.com/terraform-aws-modules/terraform-aws-eks?ref=97a08c8aff5dbf51a86b4c8cd88a858336cd0208/main.tf:51"
2024-11-25T21:17:15Z INFO Number of language-specific files num=0
2024-11-25T21:17:15Z INFO Detected config files num=14
trivy_exitcode=0

Running Trivy in terraform/environments/analytical-platform-ingestion
2024-11-25T21:17:15Z INFO [vuln] Vulnerability scanning is enabled
2024-11-25T21:17:15Z INFO [misconfig] Misconfiguration scanning is enabled
2024-11-25T21:17:15Z INFO [misconfig] Need to update the built-in checks
2024-11-25T21:17:15Z INFO [misconfig] Downloading the built-in checks...
160.25 KiB / 160.25 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2024-11-25T21:17:16Z INFO [secret] Secret scanning is enabled
2024-11-25T21:17:16Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-11-25T21:17:16Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2024-11-25T21:17:17Z INFO [terraform scanner] Scanning root module file_path="."
2024-11-25T21:17:17Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="networking"
2024-11-25T21:17:17Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.connected_vpc_transit_gateway_routes" value="cty.NilVal"
2024-11-25T21:17:17Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.sftp_users" value="cty.NilVal"
2024-11-25T21:17:17Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.sftp_users_with_egress" value="cty.NilVal"
2024-11-25T21:17:20Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.bold_egress_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:17:20Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.bold_egress_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:17:20Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datasync_bucket.aws_s3_bucket_replication_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_replication_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:17:20Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datasync_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:17:20Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datasync_bucket.aws_s3_bucket_replication_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_replication_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:17:20Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datasync_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:17:21Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datasync_bucket.aws_s3_bucket_replication_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_replication_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:17:21Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datasync_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:17:21Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datasync_bucket.aws_s3_bucket_replication_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_replication_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:17:21Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datasync_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:17:21Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.definition_upload_lambda.aws_lambda_function.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.vpc_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.logging_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:17:21Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.definition_upload_lambda.aws_lambda_function.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.vpc_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.logging_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:17:21Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.definition_upload_lambda.aws_lambda_function.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.vpc_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.logging_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:17:21Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.definition_upload_lambda.aws_lambda_function.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.vpc_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.logging_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:17:21Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.definitions_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:17:21Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.definitions_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:17:21Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.definition_upload_lambda.aws_lambda_function.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.vpc_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.logging_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:17:21Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.definition_upload_lambda.aws_lambda_function.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.vpc_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.logging_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T21:17:22Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-bucket-encryption" range="git::https:/github.com/terraform-aws-modules/terraform-aws-s3-bucket?ref=8a0b697adfbc673e6135c70246cff7f8052ad95a/main.tf:176-198"
2024-11-25T21:17:22Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-public-egress-sgr" range="terraform-aws-modules/security-group/aws/main.tf:533"
2024-11-25T21:17:22Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-public-egress-sgr" range="terraform-aws-modules/security-group/aws/main.tf:534"
2024-11-25T21:17:22Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="git::https:/github.com/terraform-aws-modules/terraform-aws-s3-bucket?ref=8a0b697adfbc673e6135c70246cff7f8052ad95a/main.tf:176-198"
2024-11-25T21:17:22Z INFO Number of language-specific files num=0
2024-11-25T21:17:22Z INFO Detected config files num=7