Update_091224_2

[nbuckingham72]

New lambda function, updates to python scripts, some IAM permission changes

[github-actions]

Trivy Scan Success

Show Output

```hcl

---

Trivy will check the following folders:
terraform/environments/ppud

---

Running Trivy in terraform/environments/ppud
2024-12-09T14:40:59Z INFO [vulndb] Need to update DB
2024-12-09T14:40:59Z INFO [vulndb] Downloading vulnerability DB...
2024-12-09T14:40:59Z INFO [vulndb] Downloading artifact... repo="public.ecr.aws/aquasecurity/trivy-db:2"
2024-12-09T14:41:01Z INFO [vulndb] Artifact successfully downloaded repo="public.ecr.aws/aquasecurity/trivy-db:2"
2024-12-09T14:41:01Z INFO [vuln] Vulnerability scanning is enabled
2024-12-09T14:41:01Z INFO [misconfig] Misconfiguration scanning is enabled
2024-12-09T14:41:01Z INFO [misconfig] Need to update the built-in checks
2024-12-09T14:41:01Z INFO [misconfig] Downloading the built-in checks...
160.80 KiB / 160.80 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2024-12-09T14:41:03Z INFO [secret] Secret scanning is enabled
2024-12-09T14:41:03Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-12-09T14:41:03Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.58/docs/scanner/secret#recommendation for faster secret detection
2024-12-09T14:41:04Z INFO [terraform scanner] Scanning root module file_path="."
2024-12-09T14:41:05Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="networking"
2024-12-09T14:41:06Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="s3.tf:119-132"
2024-12-09T14:41:06Z INFO [terraform executor] Ignore finding rule="aws-elb-alb-not-public" range="alb_external.tf:89"
2024-12-09T14:41:06Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-bucket-encryption" range="s3.tf:119-132"
2024-12-09T14:41:06Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="iam.tf:924-931"
2024-12-09T14:41:06Z INFO Number of language-specific files num=0
2024-12-09T14:41:06Z INFO Detected config files num=6
trivy_exitcode=0

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/ppud

*****************************

Running Checkov in terraform/environments/ppud
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
terraform scan results:

Passed checks: 1262, Failed checks: 7, Skipped checks: 172

Check: CKV_AWS_272: "Ensure AWS Lambda function is configured to validate code-signing"
	FAILED for resource: aws_lambda_function.terraform_lambda_func_send_cpu_graph_dev
	File: /lambda.tf:399-422
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-272

		399 | resource "aws_lambda_function" "terraform_lambda_func_send_cpu_graph_dev" {
		400 |   # checkov:skip=CKV_AWS_117: "PPUD Lambda functions do not require VPC access and can run in no-VPC mode"
		401 |   count                          = local.is-development == true ? 1 : 0
		402 |   filename                       = "${path.module}/lambda_scripts/send_cpu_graph_dev.zip"
		403 |   function_name                  = "send_cpu_graph"
		404 |   role                           = aws_iam_role.lambda_role_cloudwatch_get_metric_data_dev[0].arn
		405 |   handler                        = "send_cpu_graph_dev.lambda_handler"
		406 |   runtime                        = "python3.12"
		407 |   timeout                        = 300
		408 |   depends_on                     = [aws_iam_role_policy_attachment.attach_lambda_policy_cloudwatch_get_metric_data_to_lambda_role_cloudwatch_get_metric_data_dev]
		409 |   reserved_concurrent_executions = 5
		410 |   # code_signing_config_arn        = "arn:aws:lambda:eu-west-2:${local.environment_management.account_ids["ppud-development"]}:code-signing-config:csc-0c7136ccff2de748f"
		411 |   dead_letter_config {
		412 |      target_arn = aws_sqs_queue.lambda_queue_dev[0].arn
		413 |   }
		414 |   tracing_config {
		415 |     mode = "Active"
		416 |   }
		417 |   layers = [
		418 |     "arn:aws:lambda:eu-west-2:${data.aws_ssm_parameter.klayers_account_dev[0].value}:layer:Klayers-p312-numpy:8",
		419 |     "arn:aws:lambda:eu-west-2:${data.aws_ssm_parameter.klayers_account_dev[0].value}:layer:Klayers-p312-pillow:1",
		420 |     aws_lambda_layer_version.lambda_layer_matplotlib_dev[0].arn
		421 |   ]
		422 | }

Check: CKV_AWS_272: "Ensure AWS Lambda function is configured to validate code-signing"
	FAILED for resource: aws_lambda_function.terraform_lambda_func_send_cpu_graph_prod
	File: /lambda.tf:457-484
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-272

		457 | resource "aws_lambda_function" "terraform_lambda_func_send_cpu_graph_prod" {
		458 |   count                          = local.is-production == true ? 1 : 0
		459 |   filename                       = "${path.module}/lambda_scripts/send_cpu_graph_prod.zip"
		460 |   function_name                  = "send_cpu_graph"
		461 |   role                           = aws_iam_role.lambda_role_cloudwatch_get_metric_data_prod[0].arn
		462 |   handler                        = "send_cpu_graph_prod.lambda_handler"
		463 |   runtime                        = "python3.12"
		464 |   timeout                        = 300
		465 |   depends_on                     = [aws_iam_role_policy_attachment.attach_lambda_policy_cloudwatch_get_metric_data_to_lambda_role_cloudwatch_get_metric_data_prod]
		466 |   reserved_concurrent_executions = 5
		467 |   # code_signing_config_arn        = "arn:aws:lambda:eu-west-2:${local.environment_management.account_ids["ppud-production"]}:code-signing-config:csc-0bafee04a642a41c1"
		468 |   dead_letter_config {
		469 |      target_arn = aws_sqs_queue.lambda_queue_prod[0].arn
		470 |   }
		471 |   tracing_config {
		472 |     mode = "Active"
		473 |   }
		474 |   layers = [
		475 |     "arn:aws:lambda:eu-west-2:${data.aws_ssm_parameter.klayers_account_prod[0].value}:layer:Klayers-p312-numpy:8",
		476 |     "arn:aws:lambda:eu-west-2:${data.aws_ssm_parameter.klayers_account_prod[0].value}:layer:Klayers-p312-pillow:1",
		477 |     aws_lambda_layer_version.lambda_layer_matplotlib_prod[0].arn
		478 |   ]
		479 |   # VPC configuration
		480 |   vpc_config {
		481 |     subnet_ids         = [data.aws_subnet.private_subnets_b.id]
		482 |     security_group_ids = [aws_security_group.PPUD-Mail-Server[0].id]
		483 |   }
		484 | }

Check: CKV_AWS_272: "Ensure AWS Lambda function is configured to validate code-signing"
	FAILED for resource: aws_lambda_function.terraform_lambda_func_ppud_email_report_prod
	File: /lambda.tf:519-547
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-272

		519 | resource "aws_lambda_function" "terraform_lambda_func_ppud_email_report_prod" {
		520 |   # checkov:skip=CKV_AWS_117: "PPUD Lambda functions do not require VPC access and can run in no-VPC mode"
		521 |   count                          = local.is-production == true ? 1 : 0
		522 |   filename                       = "${path.module}/lambda_scripts/ppud_email_report_prod.zip"
		523 |   function_name                  = "ppud_email_report"
		524 |   role                           = aws_iam_role.lambda_role_cloudwatch_get_metric_data_prod[0].arn
		525 |   handler                        = "ppud_email_report_prod.lambda_handler"
		526 |   runtime                        = "python3.12"
		527 |   timeout                        = 300
		528 |   depends_on                     = [aws_iam_role_policy_attachment.attach_lambda_policy_cloudwatch_get_metric_data_to_lambda_role_cloudwatch_get_metric_data_prod]
		529 |   reserved_concurrent_executions = 5
		530 |   # code_signing_config_arn        = "arn:aws:lambda:eu-west-2:${local.environment_management.account_ids["ppud-production"]}:code-signing-config:csc-0bafee04a642a41c1"
		531 |   dead_letter_config {
		532 |      target_arn = aws_sqs_queue.lambda_queue_prod[0].arn
		533 |   }
		534 |   tracing_config {
		535 |     mode = "Active"
		536 |   }
		537 |   layers = [
		538 |     "arn:aws:lambda:eu-west-2:${data.aws_ssm_parameter.klayers_account_prod[0].value}:layer:Klayers-p312-numpy:8",
		539 |     "arn:aws:lambda:eu-west-2:${data.aws_ssm_parameter.klayers_account_prod[0].value}:layer:Klayers-p312-pillow:1",
		540 |     aws_lambda_layer_version.lambda_layer_matplotlib_prod[0].arn
		541 |   ]
		542 |   # VPC configuration
		543 |   vpc_config {
		544 |     subnet_ids         = [data.aws_subnet.private_subnets_b.id]
		545 |     security_group_ids = [aws_security_group.PPUD-Mail-Server[0].id]
		546 |   }
		547 | }

Check: CKV_AWS_272: "Ensure AWS Lambda function is configured to validate code-signing"
	FAILED for resource: aws_lambda_function.terraform_lambda_func_ppud_elb_report_prod
	File: /lambda.tf:571-599
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-272

		571 | resource "aws_lambda_function" "terraform_lambda_func_ppud_elb_report_prod" {
		572 |   # checkov:skip=CKV_AWS_117: "PPUD Lambda functions do not require VPC access and can run in no-VPC mode"
		573 |   count                          = local.is-production == true ? 1 : 0
		574 |   filename                       = "${path.module}/lambda_scripts/ppud_elb_report_prod.zip"
		575 |   function_name                  = "ppud_elb_report"
		576 |   role                           = aws_iam_role.lambda_role_cloudwatch_get_metric_data_prod[0].arn
		577 |   handler                        = "ppud_elb_report_prod.lambda_handler"
		578 |   runtime                        = "python3.12"
		579 |   timeout                        = 300
		580 |   depends_on                     = [aws_iam_role_policy_attachment.attach_lambda_policy_cloudwatch_get_metric_data_to_lambda_role_cloudwatch_get_metric_data_prod]
		581 |   reserved_concurrent_executions = 5
		582 |   # code_signing_config_arn        = "arn:aws:lambda:eu-west-2:${local.environment_management.account_ids["ppud-production"]}:code-signing-config:csc-0bafee04a642a41c1"
		583 |   dead_letter_config {
		584 |     target_arn = aws_sqs_queue.lambda_queue_prod[0].arn
		585 |   }
		586 |   tracing_config {
		587 |     mode = "Active"
		588 |   }
		589 |   layers = [
		590 |     "arn:aws:lambda:eu-west-2:${data.aws_ssm_parameter.klayers_account_prod[0].value}:layer:Klayers-p312-numpy:8",
		591 |     "arn:aws:lambda:eu-west-2:${data.aws_ssm_parameter.klayers_account_prod[0].value}:layer:Klayers-p312-pillow:1",
		592 |     aws_lambda_layer_version.lambda_layer_matplotlib_prod[0].arn
		593 |   ]
		594 |   # VPC configuration
		595 |   vpc_config {
		596 |     subnet_ids         = [data.aws_subnet.private_subnets_b.id]
		597 |     security_group_ids = [aws_security_group.PPUD-Mail-Server[0].id]
		598 |   }
		599 | }

Check: CKV_AWS_272: "Ensure AWS Lambda function is configured to validate code-signing"
	FAILED for resource: aws_lambda_function.terraform_lambda_func_send_memory_graph_prod
	File: /lambda.tf:623-650
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-272

		623 | resource "aws_lambda_function" "terraform_lambda_func_send_memory_graph_prod" {
		624 |   count                          = local.is-production == true ? 1 : 0
		625 |   filename                       = "${path.module}/lambda_scripts/send_memory_graph_prod.zip"
		626 |   function_name                  = "send_memory_graph"
		627 |   role                           = aws_iam_role.lambda_role_cloudwatch_get_metric_data_prod[0].arn
		628 |   handler                        = "send_memory_graph_prod.lambda_handler"
		629 |   runtime                        = "python3.12"
		630 |   timeout                        = 300
		631 |   depends_on                     = [aws_iam_role_policy_attachment.attach_lambda_policy_cloudwatch_get_metric_data_to_lambda_role_cloudwatch_get_metric_data_prod]
		632 |   reserved_concurrent_executions = 5
		633 |   # code_signing_config_arn        = "arn:aws:lambda:eu-west-2:${local.environment_management.account_ids["ppud-production"]}:code-signing-config:csc-0bafee04a642a41c1"
		634 |   dead_letter_config {
		635 |      target_arn = aws_sqs_queue.lambda_queue_prod[0].arn
		636 |   }
		637 |   tracing_config {
		638 |     mode = "Active"
		639 |   }
		640 |   layers = [
		641 |     "arn:aws:lambda:eu-west-2:${data.aws_ssm_parameter.klayers_account_prod[0].value}:layer:Klayers-p312-numpy:8",
		642 |     "arn:aws:lambda:eu-west-2:${data.aws_ssm_parameter.klayers_account_prod[0].value}:layer:Klayers-p312-pillow:1",
		643 |     aws_lambda_layer_version.lambda_layer_matplotlib_prod[0].arn
		644 |   ]
		645 |   # VPC configuration
		646 |   vpc_config {
		647 |     subnet_ids         = [data.aws_subnet.private_subnets_b.id]
		648 |     security_group_ids = [aws_security_group.PPUD-Mail-Server[0].id]
		649 |   }
		650 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: aws_security_group.Live-DOC-Server
	File: /security_group.tf:419-428
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		419 | resource "aws_security_group" "Live-DOC-Server" {
		420 |   count       = local.is-preproduction == false ? 1 : 0
		421 |   vpc_id      = data.aws_vpc.shared.id
		422 |   name        = "Live-DOC-Server"
		423 |   description = "Live-DOC-Server for DEV & PROD"
		424 | 
		425 |   tags = {
		426 |     Name = "${var.networking[0].business-unit}-${local.environment}"
		427 |   }
		428 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: aws_security_group.Archive-DOC-Server
	File: /security_group.tf:574-583
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		574 | resource "aws_security_group" "Archive-DOC-Server" {
		575 |   count       = local.is-preproduction == false ? 1 : 0
		576 |   vpc_id      = data.aws_vpc.shared.id
		577 |   name        = "Archive-DOC-Server"
		578 |   description = "Archive-DOC-Server for DEV & PROD"
		579 | 
		580 |   tags = {
		581 |     Name = "${var.networking[0].business-unit}-${local.environment}"
		582 |   }
		583 | }


checkov_exitcode=1

CTFLint Scan Failed

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
terraform/environments/ppud

*****************************

Running tflint in terraform/environments/ppud
Excluding the following checks: terraform_unused_declarations
2 issue(s) found:

Warning: Missing version constraint for provider "archive" in `required_providers` (terraform_required_providers)

  on terraform/environments/ppud/lambda.tf line 654:
 654: data "archive_file" "zip_the_send_memory_graph_code_prod" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

Warning: Missing version constraint for provider "random" in `required_providers` (terraform_required_providers)

  on terraform/environments/ppud/secrets.tf line 7:
   7: resource "random_password" "password" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

tflint_exitcode=2

Trivy Scan Success

Show Output

*****************************

Trivy will check the following folders:
terraform/environments/ppud

*****************************

Running Trivy in terraform/environments/ppud
2024-12-09T14:40:59Z	INFO	[vulndb] Need to update DB
2024-12-09T14:40:59Z	INFO	[vulndb] Downloading vulnerability DB...
2024-12-09T14:40:59Z	INFO	[vulndb] Downloading artifact...	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2024-12-09T14:41:01Z	INFO	[vulndb] Artifact successfully downloaded	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2024-12-09T14:41:01Z	INFO	[vuln] Vulnerability scanning is enabled
2024-12-09T14:41:01Z	INFO	[misconfig] Misconfiguration scanning is enabled
2024-12-09T14:41:01Z	INFO	[misconfig] Need to update the built-in checks
2024-12-09T14:41:01Z	INFO	[misconfig] Downloading the built-in checks...
160.80 KiB / 160.80 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2024-12-09T14:41:03Z	INFO	[secret] Secret scanning is enabled
2024-12-09T14:41:03Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-12-09T14:41:03Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.58/docs/scanner/secret#recommendation for faster secret detection
2024-12-09T14:41:04Z	INFO	[terraform scanner] Scanning root module	file_path="."
2024-12-09T14:41:05Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="networking"
2024-12-09T14:41:06Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="s3.tf:119-132"
2024-12-09T14:41:06Z	INFO	[terraform executor] Ignore finding	rule="aws-elb-alb-not-public" range="alb_external.tf:89"
2024-12-09T14:41:06Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-bucket-encryption" range="s3.tf:119-132"
2024-12-09T14:41:06Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-user-attached-policies" range="iam.tf:924-931"
2024-12-09T14:41:06Z	INFO	Number of language-specific files	num=0
2024-12-09T14:41:06Z	INFO	Detected config files	num=6
trivy_exitcode=0