add public dns record for oracle databases #9254

sobostion · 2025-01-08T13:14:15Z

No description provided.

github-actions · 2025-01-08T13:16:47Z

`Trivy Scan` Success

Show Output

```hcl

Trivy will check the following folders:
terraform/environments/delius-core/modules/components/oracle_db_instance

Running Trivy in terraform/environments/delius-core/modules/components/oracle_db_instance
2025-01-08T13:16:35Z INFO [vulndb] Need to update DB
2025-01-08T13:16:35Z INFO [vulndb] Downloading vulnerability DB...
2025-01-08T13:16:35Z INFO [vulndb] Downloading artifact... repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-08T13:16:37Z INFO [vulndb] Artifact successfully downloaded repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-08T13:16:37Z INFO [vuln] Vulnerability scanning is enabled
2025-01-08T13:16:37Z INFO [misconfig] Misconfiguration scanning is enabled
2025-01-08T13:16:37Z INFO [misconfig] Need to update the built-in checks
2025-01-08T13:16:37Z INFO [misconfig] Downloading the built-in checks...
160.80 KiB / 160.80 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2025-01-08T13:16:38Z INFO [secret] Secret scanning is enabled
2025-01-08T13:16:38Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-08T13:16:38Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-08T13:16:39Z INFO [terraform scanner] Scanning root module file_path="."
2025-01-08T13:16:39Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="account_config, account_info, availability_zone, db_ami, ebs_volume_config, ebs_volumes, ec2_key_pair_name, env_name, environment_config, instance_profile_policies, security_group_ids, sns_topic_arn, ssh_keys_bucket_name, subnet_id, tags, user_data"
2025-01-08T13:16:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.instance.aws_ebs_volume.this" value="cty.NilVal"
2025-01-08T13:16:39Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.instance.aws_instance.this" err="2 errors occurred:\n\t* invalid for-each in aws_instance.this.dynamic.ephemeral_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_instance.this.dynamic.ebs_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-08T13:16:39Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.instance.aws_instance.this" err="2 errors occurred:\n\t* invalid for-each in aws_instance.this.dynamic.ephemeral_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_instance.this.dynamic.ebs_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-08T13:16:39Z INFO [terraform executor] Ignore finding rule="aws-ec2-enforce-http-token-imds" range="github.com/ministryofjustice/modernisation-platform-terraform-ec2-instance?ref=20622418aa13871c279c12d9ae5e98f29c9a46f0/main.tf:22"
2025-01-08T13:16:40Z INFO Number of language-specific files num=0
2025-01-08T13:16:40Z INFO Detected config files num=2
trivy_exitcode=0

</details> #### `Checkov Scan` Success
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/delius-core/modules/components/oracle_db_instance

*****************************

Running Checkov in terraform/environments/delius-core/modules/components/oracle_db_instance
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2025-01-08 13:16:42,871 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-ec2-instance?ref=20622418aa13871c279c12d9ae5e98f29c9a46f0:None (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 0, Failed checks: 0, Skipped checks: 2


checkov_exitcode=0

`CTFLint Scan` Failed

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
terraform/environments/delius-core/modules/components/oracle_db_instance

*****************************

Running tflint in terraform/environments/delius-core/modules/components/oracle_db_instance
Excluding the following checks: terraform_unused_declarations
4 issue(s) found:

Warning: Duplicate key: "datapoints_to_alarm", first defined at terraform/environments/delius-core/modules/components/oracle_db_instance/locals.tf:49,9-28 (terraform_map_duplicate_keys)

  on terraform/environments/delius-core/modules/components/oracle_db_instance/locals.tf line 55:
  55:         datapoints_to_alarm = "10"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_map_duplicate_keys.md

Warning: Duplicate key: "evaluation_periods", first defined at terraform/environments/delius-core/modules/components/oracle_db_instance/locals.tf:48,9-27 (terraform_map_duplicate_keys)

  on terraform/environments/delius-core/modules/components/oracle_db_instance/locals.tf line 56:
  56:         evaluation_periods  = "10"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_map_duplicate_keys.md

Warning: `server_type_tag` variable has no type (terraform_typed_variables)

  on terraform/environments/delius-core/modules/components/oracle_db_instance/variables.tf line 36:
  36: variable "server_type_tag" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_typed_variables.md

Warning: `database_tag_prefix` variable has no type (terraform_typed_variables)

  on terraform/environments/delius-core/modules/components/oracle_db_instance/variables.tf line 41:
  41: variable "database_tag_prefix" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_typed_variables.md

tflint_exitcode=2

`Trivy Scan` Success

Show Output

*****************************

Trivy will check the following folders:
terraform/environments/delius-core/modules/components/oracle_db_instance

*****************************

Running Trivy in terraform/environments/delius-core/modules/components/oracle_db_instance
2025-01-08T13:16:35Z	INFO	[vulndb] Need to update DB
2025-01-08T13:16:35Z	INFO	[vulndb] Downloading vulnerability DB...
2025-01-08T13:16:35Z	INFO	[vulndb] Downloading artifact...	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-08T13:16:37Z	INFO	[vulndb] Artifact successfully downloaded	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-08T13:16:37Z	INFO	[vuln] Vulnerability scanning is enabled
2025-01-08T13:16:37Z	INFO	[misconfig] Misconfiguration scanning is enabled
2025-01-08T13:16:37Z	INFO	[misconfig] Need to update the built-in checks
2025-01-08T13:16:37Z	INFO	[misconfig] Downloading the built-in checks...
160.80 KiB / 160.80 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2025-01-08T13:16:38Z	INFO	[secret] Secret scanning is enabled
2025-01-08T13:16:38Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-08T13:16:38Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-08T13:16:39Z	INFO	[terraform scanner] Scanning root module	file_path="."
2025-01-08T13:16:39Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="account_config, account_info, availability_zone, db_ami, ebs_volume_config, ebs_volumes, ec2_key_pair_name, env_name, environment_config, instance_profile_policies, security_group_ids, sns_topic_arn, ssh_keys_bucket_name, subnet_id, tags, user_data"
2025-01-08T13:16:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.instance.aws_ebs_volume.this" value="cty.NilVal"
2025-01-08T13:16:39Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.instance.aws_instance.this" err="2 errors occurred:\n\t* invalid for-each in aws_instance.this.dynamic.ephemeral_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_instance.this.dynamic.ebs_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-08T13:16:39Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.instance.aws_instance.this" err="2 errors occurred:\n\t* invalid for-each in aws_instance.this.dynamic.ephemeral_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_instance.this.dynamic.ebs_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-08T13:16:39Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-enforce-http-token-imds" range="github.com/ministryofjustice/modernisation-platform-terraform-ec2-instance?ref=20622418aa13871c279c12d9ae5e98f29c9a46f0/main.tf:22"
2025-01-08T13:16:40Z	INFO	Number of language-specific files	num=0
2025-01-08T13:16:40Z	INFO	Detected config files	num=2
trivy_exitcode=0

github-actions · 2025-01-08T13:28:31Z

`Trivy Scan` Success

Show Output

```hcl

Trivy will check the following folders:
terraform/environments/delius-core/modules/components/oracle_db_instance
terraform/environments/delius-core/modules/components/oracle_db_shared

Running Trivy in terraform/environments/delius-core/modules/components/oracle_db_instance
2025-01-08T13:28:17Z INFO [vulndb] Need to update DB
2025-01-08T13:28:17Z INFO [vulndb] Downloading vulnerability DB...
2025-01-08T13:28:17Z INFO [vulndb] Downloading artifact... repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-08T13:28:19Z INFO [vulndb] Artifact successfully downloaded repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-08T13:28:19Z INFO [vuln] Vulnerability scanning is enabled
2025-01-08T13:28:19Z INFO [misconfig] Misconfiguration scanning is enabled
2025-01-08T13:28:19Z INFO [misconfig] Need to update the built-in checks
2025-01-08T13:28:19Z INFO [misconfig] Downloading the built-in checks...
160.80 KiB / 160.80 KiB [---------------------------------------------------------] 100.00% ? p/s 0s2025-01-08T13:28:19Z INFO [secret] Secret scanning is enabled
2025-01-08T13:28:19Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-08T13:28:19Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-08T13:28:20Z INFO [terraform scanner] Scanning root module file_path="."
2025-01-08T13:28:20Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="account_config, account_info, availability_zone, db_ami, ebs_volume_config, ebs_volumes, ec2_key_pair_name, env_name, environment_config, instance_profile_policies, security_group_ids, sns_topic_arn, ssh_keys_bucket_name, subnet_id, tags, user_data"
2025-01-08T13:28:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.instance.aws_ebs_volume.this" value="cty.NilVal"
2025-01-08T13:28:20Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.instance.aws_instance.this" err="2 errors occurred:\n\t* invalid for-each in aws_instance.this.dynamic.ephemeral_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_instance.this.dynamic.ebs_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-08T13:28:20Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.instance.aws_instance.this" err="2 errors occurred:\n\t* invalid for-each in aws_instance.this.dynamic.ephemeral_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_instance.this.dynamic.ebs_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-08T13:28:20Z INFO [terraform executor] Ignore finding rule="aws-ec2-enforce-http-token-imds" range="github.com/ministryofjustice/modernisation-platform-terraform-ec2-instance?ref=20622418aa13871c279c12d9ae5e98f29c9a46f0/main.tf:22"
2025-01-08T13:28:20Z INFO Number of language-specific files num=0
2025-01-08T13:28:20Z INFO Detected config files num=2
trivy_exitcode=0

Running Trivy in terraform/environments/delius-core/modules/components/oracle_db_shared
2025-01-08T13:28:21Z INFO [vuln] Vulnerability scanning is enabled
2025-01-08T13:28:21Z INFO [misconfig] Misconfiguration scanning is enabled
2025-01-08T13:28:21Z INFO [secret] Secret scanning is enabled
2025-01-08T13:28:21Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-08T13:28:21Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-08T13:28:22Z INFO [terraform scanner] Scanning root module file_path="."
2025-01-08T13:28:22Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="account_config, account_info, bastion_sg_id, env_name, environment_config, instance_roles, platform_vars, public_keys, tags"
2025-01-08T13:28:22Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_s3_object.user_public_keys" value="cty.NilVal"
2025-01-08T13:28:23Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-public-egress-sgr" range="sg.tf:16"
2025-01-08T13:28:23Z INFO Number of language-specific files num=0
2025-01-08T13:28:23Z INFO Detected config files num=4
trivy_exitcode=0

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/delius-core/modules/components/oracle_db_instance
terraform/environments/delius-core/modules/components/oracle_db_shared

*****************************

Running Checkov in terraform/environments/delius-core/modules/components/oracle_db_instance
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2025-01-08 13:28:25,772 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-ec2-instance?ref=20622418aa13871c279c12d9ae5e98f29c9a46f0:None (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 0, Failed checks: 0, Skipped checks: 2


checkov_exitcode=0

*****************************

Running Checkov in terraform/environments/delius-core/modules/components/oracle_db_shared
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2025-01-08 13:28:28,795 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.1.0:None (for external modules, the --download-external-modules flag is required)
2025-01-08 13:28:28,795 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0:None (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 247, Failed checks: 3, Skipped checks: 19

Check: CKV_AWS_290: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy.oracle_ec2_snapshot_backup_role_policy
	File: /backup_vault.tf:18-40
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-290

		18 | resource "aws_iam_policy" "oracle_ec2_snapshot_backup_role_policy" {
		19 |   name        = "oracle-ec2-snapshot-backup-role-policy"
		20 |   description = "Allow iam:PassRole for AWSBackupDefaultServiceRole"
		21 | 
		22 |   policy = jsonencode({
		23 |     Version = "2012-10-17",
		24 |     Statement = [
		25 |       {
		26 |         Effect   = "Allow",
		27 |         Action   = "iam:PassRole",
		28 |         Resource = "arn:aws:iam::${var.account_info.id}:role/service-role/AWSBackupDefaultServiceRole"
		29 |       },
		30 |       {
		31 |         Effect = "Allow"
		32 |         Action = ["backup:ListBackupVaults",
		33 |           "backup:StartBackupJob",
		34 |           "backup:DescribeBackupJob",
		35 |         "ec2:DescribeSnapshots"],
		36 |         Resource = "*"
		37 |       }
		38 |     ]
		39 |   })
		40 | }

Check: CKV_AWS_355: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy.oracle_ec2_snapshot_backup_role_policy
	File: /backup_vault.tf:18-40
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-355

		18 | resource "aws_iam_policy" "oracle_ec2_snapshot_backup_role_policy" {
		19 |   name        = "oracle-ec2-snapshot-backup-role-policy"
		20 |   description = "Allow iam:PassRole for AWSBackupDefaultServiceRole"
		21 | 
		22 |   policy = jsonencode({
		23 |     Version = "2012-10-17",
		24 |     Statement = [
		25 |       {
		26 |         Effect   = "Allow",
		27 |         Action   = "iam:PassRole",
		28 |         Resource = "arn:aws:iam::${var.account_info.id}:role/service-role/AWSBackupDefaultServiceRole"
		29 |       },
		30 |       {
		31 |         Effect = "Allow"
		32 |         Action = ["backup:ListBackupVaults",
		33 |           "backup:StartBackupJob",
		34 |           "backup:DescribeBackupJob",
		35 |         "ec2:DescribeSnapshots"],
		36 |         Resource = "*"
		37 |       }
		38 |     ]
		39 |   })
		40 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: s3_bucket_oracledb_backups_inventory
	File: /s3.tf:189-227
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		189 | module "s3_bucket_oracledb_backups_inventory" {
		190 |   source              = "github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.1.0"
		191 |   bucket_name         = "${local.oracle_backup_bucket_prefix}-inventory"
		192 |   versioning_enabled  = false
		193 |   ownership_controls  = "BucketOwnerEnforced"
		194 |   replication_enabled = false
		195 |   custom_kms_key      = var.account_config.kms_keys.general_shared
		196 |   bucket_policy       = [data.aws_iam_policy_document.oracledb_backups_inventory.json]
		197 | 
		198 |   providers = {
		199 |     aws.bucket-replication = aws.bucket-replication
		200 |   }
		201 | 
		202 |   lifecycle_rule = [
		203 |     {
		204 |       id      = "main"
		205 |       enabled = "Enabled"
		206 |       prefix  = ""
		207 | 
		208 |       tags = {
		209 |         rule      = "log"
		210 |         autoclean = "true"
		211 |       }
		212 | 
		213 |       transition = [
		214 |         {
		215 |           days          = 90
		216 |           storage_class = "STANDARD_IA"
		217 |         }
		218 |       ]
		219 | 
		220 |       expiration = {
		221 |         days = 365
		222 |       }
		223 |     }
		224 |   ]
		225 | 
		226 |   tags = var.tags
		227 | }


checkov_exitcode=1

`CTFLint Scan` Failed

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
terraform/environments/delius-core/modules/components/oracle_db_instance
terraform/environments/delius-core/modules/components/oracle_db_shared

*****************************

Running tflint in terraform/environments/delius-core/modules/components/oracle_db_instance
Excluding the following checks: terraform_unused_declarations
4 issue(s) found:

Warning: Duplicate key: "datapoints_to_alarm", first defined at terraform/environments/delius-core/modules/components/oracle_db_instance/locals.tf:49,9-28 (terraform_map_duplicate_keys)

  on terraform/environments/delius-core/modules/components/oracle_db_instance/locals.tf line 55:
  55:         datapoints_to_alarm = "10"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_map_duplicate_keys.md

Warning: Duplicate key: "evaluation_periods", first defined at terraform/environments/delius-core/modules/components/oracle_db_instance/locals.tf:48,9-27 (terraform_map_duplicate_keys)

  on terraform/environments/delius-core/modules/components/oracle_db_instance/locals.tf line 56:
  56:         evaluation_periods  = "10"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_map_duplicate_keys.md

Warning: `server_type_tag` variable has no type (terraform_typed_variables)

  on terraform/environments/delius-core/modules/components/oracle_db_instance/variables.tf line 36:
  36: variable "server_type_tag" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_typed_variables.md

Warning: `database_tag_prefix` variable has no type (terraform_typed_variables)

  on terraform/environments/delius-core/modules/components/oracle_db_instance/variables.tf line 41:
  41: variable "database_tag_prefix" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_typed_variables.md

tflint_exitcode=2

*****************************

Running tflint in terraform/environments/delius-core/modules/components/oracle_db_shared
Excluding the following checks: terraform_unused_declarations
7 issue(s) found:

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/delius-core/modules/components/oracle_db_shared/s3.tf line 10:
  10:       "${module.s3_bucket_oracledb_backups.bucket.arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/delius-core/modules/components/oracle_db_shared/s3.tf line 74:
  74:       "${module.s3_bucket_oracledb_backups.bucket.arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/delius-core/modules/components/oracle_db_shared/s3.tf line 87:
  87:       "${module.s3_bucket_oracledb_backups_inventory.bucket.arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/delius-core/modules/components/oracle_db_shared/s3.tf line 126:
 126:         "${module.s3_bucket_oracle_statistics[0].bucket.arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/delius-core/modules/components/oracle_db_shared/s3.tf line 241:
 241:       values   = ["${var.account_info.id}"]

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/delius-core/modules/components/oracle_db_shared/s3.tf line 253:
 253:       values   = ["${module.s3_bucket_oracledb_backups.bucket.arn}"]

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/delius-core/modules/components/oracle_db_shared/s3.tf line 294:
 294:     resources = ["${module.s3_bucket_oracle_statistics[0].bucket.arn}"]

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

tflint_exitcode=4

`Trivy Scan` Success

Show Output

*****************************

Trivy will check the following folders:
terraform/environments/delius-core/modules/components/oracle_db_instance
terraform/environments/delius-core/modules/components/oracle_db_shared

*****************************

Running Trivy in terraform/environments/delius-core/modules/components/oracle_db_instance
2025-01-08T13:28:17Z	INFO	[vulndb] Need to update DB
2025-01-08T13:28:17Z	INFO	[vulndb] Downloading vulnerability DB...
2025-01-08T13:28:17Z	INFO	[vulndb] Downloading artifact...	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-08T13:28:19Z	INFO	[vulndb] Artifact successfully downloaded	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-08T13:28:19Z	INFO	[vuln] Vulnerability scanning is enabled
2025-01-08T13:28:19Z	INFO	[misconfig] Misconfiguration scanning is enabled
2025-01-08T13:28:19Z	INFO	[misconfig] Need to update the built-in checks
2025-01-08T13:28:19Z	INFO	[misconfig] Downloading the built-in checks...
160.80 KiB / 160.80 KiB [---------------------------------------------------------] 100.00% ? p/s 0s2025-01-08T13:28:19Z	INFO	[secret] Secret scanning is enabled
2025-01-08T13:28:19Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-08T13:28:19Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-08T13:28:20Z	INFO	[terraform scanner] Scanning root module	file_path="."
2025-01-08T13:28:20Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="account_config, account_info, availability_zone, db_ami, ebs_volume_config, ebs_volumes, ec2_key_pair_name, env_name, environment_config, instance_profile_policies, security_group_ids, sns_topic_arn, ssh_keys_bucket_name, subnet_id, tags, user_data"
2025-01-08T13:28:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.instance.aws_ebs_volume.this" value="cty.NilVal"
2025-01-08T13:28:20Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.instance.aws_instance.this" err="2 errors occurred:\n\t* invalid for-each in aws_instance.this.dynamic.ephemeral_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_instance.this.dynamic.ebs_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-08T13:28:20Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.instance.aws_instance.this" err="2 errors occurred:\n\t* invalid for-each in aws_instance.this.dynamic.ephemeral_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_instance.this.dynamic.ebs_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-08T13:28:20Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-enforce-http-token-imds" range="github.com/ministryofjustice/modernisation-platform-terraform-ec2-instance?ref=20622418aa13871c279c12d9ae5e98f29c9a46f0/main.tf:22"
2025-01-08T13:28:20Z	INFO	Number of language-specific files	num=0
2025-01-08T13:28:20Z	INFO	Detected config files	num=2
trivy_exitcode=0

*****************************

Running Trivy in terraform/environments/delius-core/modules/components/oracle_db_shared
2025-01-08T13:28:21Z	INFO	[vuln] Vulnerability scanning is enabled
2025-01-08T13:28:21Z	INFO	[misconfig] Misconfiguration scanning is enabled
2025-01-08T13:28:21Z	INFO	[secret] Secret scanning is enabled
2025-01-08T13:28:21Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-08T13:28:21Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-08T13:28:22Z	INFO	[terraform scanner] Scanning root module	file_path="."
2025-01-08T13:28:22Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="account_config, account_info, bastion_sg_id, env_name, environment_config, instance_roles, platform_vars, public_keys, tags"
2025-01-08T13:28:22Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_s3_object.user_public_keys" value="cty.NilVal"
2025-01-08T13:28:23Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-public-egress-sgr" range="sg.tf:16"
2025-01-08T13:28:23Z	INFO	Number of language-specific files	num=0
2025-01-08T13:28:23Z	INFO	Detected config files	num=4
trivy_exitcode=0

github-actions · 2025-01-08T14:03:23Z

`Trivy Scan` Success

Show Output

```hcl

Trivy will check the following folders:
terraform/environments/delius-core/modules/components/oracle_db_instance

Running Trivy in terraform/environments/delius-core/modules/components/oracle_db_instance
2025-01-08T14:03:12Z INFO [vulndb] Need to update DB
2025-01-08T14:03:12Z INFO [vulndb] Downloading vulnerability DB...
2025-01-08T14:03:12Z INFO [vulndb] Downloading artifact... repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-08T14:03:14Z INFO [vulndb] Artifact successfully downloaded repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-08T14:03:14Z INFO [vuln] Vulnerability scanning is enabled
2025-01-08T14:03:14Z INFO [misconfig] Misconfiguration scanning is enabled
2025-01-08T14:03:14Z INFO [misconfig] Need to update the built-in checks
2025-01-08T14:03:14Z INFO [misconfig] Downloading the built-in checks...
160.80 KiB / 160.80 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2025-01-08T14:03:16Z INFO [secret] Secret scanning is enabled
2025-01-08T14:03:16Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-08T14:03:16Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-08T14:03:17Z INFO [terraform scanner] Scanning root module file_path="."
2025-01-08T14:03:17Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="account_config, account_info, availability_zone, db_ami, ebs_volume_config, ebs_volumes, ec2_key_pair_name, env_name, environment_config, instance_profile_policies, security_group_ids, sns_topic_arn, ssh_keys_bucket_name, subnet_id, tags, user_data"
2025-01-08T14:03:17Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.instance.aws_ebs_volume.this" value="cty.NilVal"
2025-01-08T14:03:17Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.instance.aws_instance.this" err="2 errors occurred:\n\t* invalid for-each in aws_instance.this.dynamic.ephemeral_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_instance.this.dynamic.ebs_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-08T14:03:17Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.instance.aws_instance.this" err="2 errors occurred:\n\t* invalid for-each in aws_instance.this.dynamic.ephemeral_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_instance.this.dynamic.ebs_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-08T14:03:17Z INFO [terraform executor] Ignore finding rule="aws-ec2-enforce-http-token-imds" range="github.com/ministryofjustice/modernisation-platform-terraform-ec2-instance?ref=20622418aa13871c279c12d9ae5e98f29c9a46f0/main.tf:22"
2025-01-08T14:03:17Z INFO Number of language-specific files num=0
2025-01-08T14:03:17Z INFO Detected config files num=2
trivy_exitcode=0

</details> #### `Checkov Scan` Success
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/delius-core/modules/components/oracle_db_instance

*****************************

Running Checkov in terraform/environments/delius-core/modules/components/oracle_db_instance
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2025-01-08 14:03:20,259 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-ec2-instance?ref=20622418aa13871c279c12d9ae5e98f29c9a46f0:None (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 0, Failed checks: 0, Skipped checks: 2


checkov_exitcode=0

`CTFLint Scan` Failed

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
terraform/environments/delius-core/modules/components/oracle_db_instance

*****************************

Running tflint in terraform/environments/delius-core/modules/components/oracle_db_instance
Excluding the following checks: terraform_unused_declarations
4 issue(s) found:

Warning: Duplicate key: "datapoints_to_alarm", first defined at terraform/environments/delius-core/modules/components/oracle_db_instance/locals.tf:49,9-28 (terraform_map_duplicate_keys)

  on terraform/environments/delius-core/modules/components/oracle_db_instance/locals.tf line 55:
  55:         datapoints_to_alarm = "10"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_map_duplicate_keys.md

Warning: Duplicate key: "evaluation_periods", first defined at terraform/environments/delius-core/modules/components/oracle_db_instance/locals.tf:48,9-27 (terraform_map_duplicate_keys)

  on terraform/environments/delius-core/modules/components/oracle_db_instance/locals.tf line 56:
  56:         evaluation_periods  = "10"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_map_duplicate_keys.md

Warning: `server_type_tag` variable has no type (terraform_typed_variables)

  on terraform/environments/delius-core/modules/components/oracle_db_instance/variables.tf line 36:
  36: variable "server_type_tag" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_typed_variables.md

Warning: `database_tag_prefix` variable has no type (terraform_typed_variables)

  on terraform/environments/delius-core/modules/components/oracle_db_instance/variables.tf line 41:
  41: variable "database_tag_prefix" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_typed_variables.md

tflint_exitcode=2

`Trivy Scan` Success

Show Output

*****************************

Trivy will check the following folders:
terraform/environments/delius-core/modules/components/oracle_db_instance

*****************************

Running Trivy in terraform/environments/delius-core/modules/components/oracle_db_instance
2025-01-08T14:03:12Z	INFO	[vulndb] Need to update DB
2025-01-08T14:03:12Z	INFO	[vulndb] Downloading vulnerability DB...
2025-01-08T14:03:12Z	INFO	[vulndb] Downloading artifact...	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-08T14:03:14Z	INFO	[vulndb] Artifact successfully downloaded	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-08T14:03:14Z	INFO	[vuln] Vulnerability scanning is enabled
2025-01-08T14:03:14Z	INFO	[misconfig] Misconfiguration scanning is enabled
2025-01-08T14:03:14Z	INFO	[misconfig] Need to update the built-in checks
2025-01-08T14:03:14Z	INFO	[misconfig] Downloading the built-in checks...
160.80 KiB / 160.80 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2025-01-08T14:03:16Z	INFO	[secret] Secret scanning is enabled
2025-01-08T14:03:16Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-08T14:03:16Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-08T14:03:17Z	INFO	[terraform scanner] Scanning root module	file_path="."
2025-01-08T14:03:17Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="account_config, account_info, availability_zone, db_ami, ebs_volume_config, ebs_volumes, ec2_key_pair_name, env_name, environment_config, instance_profile_policies, security_group_ids, sns_topic_arn, ssh_keys_bucket_name, subnet_id, tags, user_data"
2025-01-08T14:03:17Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.instance.aws_ebs_volume.this" value="cty.NilVal"
2025-01-08T14:03:17Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.instance.aws_instance.this" err="2 errors occurred:\n\t* invalid for-each in aws_instance.this.dynamic.ephemeral_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_instance.this.dynamic.ebs_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-08T14:03:17Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.instance.aws_instance.this" err="2 errors occurred:\n\t* invalid for-each in aws_instance.this.dynamic.ephemeral_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_instance.this.dynamic.ebs_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-08T14:03:17Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-enforce-http-token-imds" range="github.com/ministryofjustice/modernisation-platform-terraform-ec2-instance?ref=20622418aa13871c279c12d9ae5e98f29c9a46f0/main.tf:22"
2025-01-08T14:03:17Z	INFO	Number of language-specific files	num=0
2025-01-08T14:03:17Z	INFO	Detected config files	num=2
trivy_exitcode=0

github-actions · 2025-01-09T09:29:29Z

`Trivy Scan` Success

Show Output

```hcl

Trivy will check the following folders:
terraform/environments/delius-core/modules/components/oracle_db_instance

Running Trivy in terraform/environments/delius-core/modules/components/oracle_db_instance
2025-01-09T09:29:18Z INFO [vulndb] Need to update DB
2025-01-09T09:29:18Z INFO [vulndb] Downloading vulnerability DB...
2025-01-09T09:29:18Z INFO [vulndb] Downloading artifact... repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-09T09:29:20Z INFO [vulndb] Artifact successfully downloaded repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-09T09:29:20Z INFO [vuln] Vulnerability scanning is enabled
2025-01-09T09:29:20Z INFO [misconfig] Misconfiguration scanning is enabled
2025-01-09T09:29:20Z INFO [misconfig] Need to update the built-in checks
2025-01-09T09:29:20Z INFO [misconfig] Downloading the built-in checks...
160.80 KiB / 160.80 KiB [---------------------------------------------------------] 100.00% ? p/s 0s2025-01-09T09:29:21Z INFO [secret] Secret scanning is enabled
2025-01-09T09:29:21Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-09T09:29:21Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-09T09:29:22Z INFO [terraform scanner] Scanning root module file_path="."
2025-01-09T09:29:22Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="account_config, account_info, availability_zone, db_ami, ebs_volume_config, ebs_volumes, ec2_key_pair_name, env_name, environment_config, instance_profile_policies, security_group_ids, sns_topic_arn, ssh_keys_bucket_name, subnet_id, tags, user_data"
2025-01-09T09:29:22Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.instance.aws_ebs_volume.this" value="cty.NilVal"
2025-01-09T09:29:22Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.instance.aws_instance.this" err="2 errors occurred:\n\t* invalid for-each in aws_instance.this.dynamic.ephemeral_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_instance.this.dynamic.ebs_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-09T09:29:22Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.instance.aws_instance.this" err="2 errors occurred:\n\t* invalid for-each in aws_instance.this.dynamic.ephemeral_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_instance.this.dynamic.ebs_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-09T09:29:23Z INFO [terraform executor] Ignore finding rule="aws-ec2-enforce-http-token-imds" range="github.com/ministryofjustice/modernisation-platform-terraform-ec2-instance?ref=20622418aa13871c279c12d9ae5e98f29c9a46f0/main.tf:22"
2025-01-09T09:29:23Z INFO Number of language-specific files num=0
2025-01-09T09:29:23Z INFO Detected config files num=2
trivy_exitcode=0

</details> #### `Checkov Scan` Success
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/delius-core/modules/components/oracle_db_instance

*****************************

Running Checkov in terraform/environments/delius-core/modules/components/oracle_db_instance
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2025-01-09 09:29:25,878 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-ec2-instance?ref=20622418aa13871c279c12d9ae5e98f29c9a46f0:None (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 0, Failed checks: 0, Skipped checks: 2


checkov_exitcode=0

`CTFLint Scan` Failed

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
terraform/environments/delius-core/modules/components/oracle_db_instance

*****************************

Running tflint in terraform/environments/delius-core/modules/components/oracle_db_instance
Excluding the following checks: terraform_unused_declarations
4 issue(s) found:

Warning: Duplicate key: "datapoints_to_alarm", first defined at terraform/environments/delius-core/modules/components/oracle_db_instance/locals.tf:49,9-28 (terraform_map_duplicate_keys)

  on terraform/environments/delius-core/modules/components/oracle_db_instance/locals.tf line 55:
  55:         datapoints_to_alarm = "10"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_map_duplicate_keys.md

Warning: Duplicate key: "evaluation_periods", first defined at terraform/environments/delius-core/modules/components/oracle_db_instance/locals.tf:48,9-27 (terraform_map_duplicate_keys)

  on terraform/environments/delius-core/modules/components/oracle_db_instance/locals.tf line 56:
  56:         evaluation_periods  = "10"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_map_duplicate_keys.md

Warning: `server_type_tag` variable has no type (terraform_typed_variables)

  on terraform/environments/delius-core/modules/components/oracle_db_instance/variables.tf line 36:
  36: variable "server_type_tag" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_typed_variables.md

Warning: `database_tag_prefix` variable has no type (terraform_typed_variables)

  on terraform/environments/delius-core/modules/components/oracle_db_instance/variables.tf line 41:
  41: variable "database_tag_prefix" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_typed_variables.md

tflint_exitcode=2

`Trivy Scan` Success

Show Output

*****************************

Trivy will check the following folders:
terraform/environments/delius-core/modules/components/oracle_db_instance

*****************************

Running Trivy in terraform/environments/delius-core/modules/components/oracle_db_instance
2025-01-09T09:29:18Z	INFO	[vulndb] Need to update DB
2025-01-09T09:29:18Z	INFO	[vulndb] Downloading vulnerability DB...
2025-01-09T09:29:18Z	INFO	[vulndb] Downloading artifact...	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-09T09:29:20Z	INFO	[vulndb] Artifact successfully downloaded	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-09T09:29:20Z	INFO	[vuln] Vulnerability scanning is enabled
2025-01-09T09:29:20Z	INFO	[misconfig] Misconfiguration scanning is enabled
2025-01-09T09:29:20Z	INFO	[misconfig] Need to update the built-in checks
2025-01-09T09:29:20Z	INFO	[misconfig] Downloading the built-in checks...
160.80 KiB / 160.80 KiB [---------------------------------------------------------] 100.00% ? p/s 0s2025-01-09T09:29:21Z	INFO	[secret] Secret scanning is enabled
2025-01-09T09:29:21Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-09T09:29:21Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-09T09:29:22Z	INFO	[terraform scanner] Scanning root module	file_path="."
2025-01-09T09:29:22Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="account_config, account_info, availability_zone, db_ami, ebs_volume_config, ebs_volumes, ec2_key_pair_name, env_name, environment_config, instance_profile_policies, security_group_ids, sns_topic_arn, ssh_keys_bucket_name, subnet_id, tags, user_data"
2025-01-09T09:29:22Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.instance.aws_ebs_volume.this" value="cty.NilVal"
2025-01-09T09:29:22Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.instance.aws_instance.this" err="2 errors occurred:\n\t* invalid for-each in aws_instance.this.dynamic.ephemeral_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_instance.this.dynamic.ebs_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-09T09:29:22Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.instance.aws_instance.this" err="2 errors occurred:\n\t* invalid for-each in aws_instance.this.dynamic.ephemeral_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_instance.this.dynamic.ebs_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-09T09:29:23Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-enforce-http-token-imds" range="github.com/ministryofjustice/modernisation-platform-terraform-ec2-instance?ref=20622418aa13871c279c12d9ae5e98f29c9a46f0/main.tf:22"
2025-01-09T09:29:23Z	INFO	Number of language-specific files	num=0
2025-01-09T09:29:23Z	INFO	Detected config files	num=2
trivy_exitcode=0

github-actions · 2025-01-09T09:31:46Z

`Trivy Scan` Success

Show Output

```hcl

Trivy will check the following folders:
terraform/environments/delius-core/modules/components/oracle_db_instance

Running Trivy in terraform/environments/delius-core/modules/components/oracle_db_instance
2025-01-09T09:31:35Z INFO [vulndb] Need to update DB
2025-01-09T09:31:35Z INFO [vulndb] Downloading vulnerability DB...
2025-01-09T09:31:35Z INFO [vulndb] Downloading artifact... repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-09T09:31:37Z INFO [vulndb] Artifact successfully downloaded repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-09T09:31:37Z INFO [vuln] Vulnerability scanning is enabled
2025-01-09T09:31:37Z INFO [misconfig] Misconfiguration scanning is enabled
2025-01-09T09:31:37Z INFO [misconfig] Need to update the built-in checks
2025-01-09T09:31:37Z INFO [misconfig] Downloading the built-in checks...
160.80 KiB / 160.80 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2025-01-09T09:31:38Z INFO [secret] Secret scanning is enabled
2025-01-09T09:31:38Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-09T09:31:38Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-09T09:31:39Z INFO [terraform scanner] Scanning root module file_path="."
2025-01-09T09:31:39Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="account_config, account_info, availability_zone, db_ami, ebs_volume_config, ebs_volumes, ec2_key_pair_name, env_name, environment_config, instance_profile_policies, security_group_ids, sns_topic_arn, ssh_keys_bucket_name, subnet_id, tags, user_data"
2025-01-09T09:31:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.instance.aws_ebs_volume.this" value="cty.NilVal"
2025-01-09T09:31:39Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.instance.aws_instance.this" err="2 errors occurred:\n\t* invalid for-each in aws_instance.this.dynamic.ephemeral_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_instance.this.dynamic.ebs_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-09T09:31:39Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.instance.aws_instance.this" err="2 errors occurred:\n\t* invalid for-each in aws_instance.this.dynamic.ephemeral_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_instance.this.dynamic.ebs_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-09T09:31:39Z INFO [terraform executor] Ignore finding rule="aws-ec2-enforce-http-token-imds" range="github.com/ministryofjustice/modernisation-platform-terraform-ec2-instance?ref=20622418aa13871c279c12d9ae5e98f29c9a46f0/main.tf:22"
2025-01-09T09:31:39Z INFO Number of language-specific files num=0
2025-01-09T09:31:39Z INFO Detected config files num=2
trivy_exitcode=0

</details> #### `Checkov Scan` Success
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/delius-core/modules/components/oracle_db_instance

*****************************

Running Checkov in terraform/environments/delius-core/modules/components/oracle_db_instance
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2025-01-09 09:31:42,751 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-ec2-instance?ref=20622418aa13871c279c12d9ae5e98f29c9a46f0:None (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 0, Failed checks: 0, Skipped checks: 2


checkov_exitcode=0

`CTFLint Scan` Failed

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
terraform/environments/delius-core/modules/components/oracle_db_instance

*****************************

Running tflint in terraform/environments/delius-core/modules/components/oracle_db_instance
Excluding the following checks: terraform_unused_declarations
4 issue(s) found:

Warning: Duplicate key: "datapoints_to_alarm", first defined at terraform/environments/delius-core/modules/components/oracle_db_instance/locals.tf:49,9-28 (terraform_map_duplicate_keys)

  on terraform/environments/delius-core/modules/components/oracle_db_instance/locals.tf line 55:
  55:         datapoints_to_alarm = "10"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_map_duplicate_keys.md

Warning: Duplicate key: "evaluation_periods", first defined at terraform/environments/delius-core/modules/components/oracle_db_instance/locals.tf:48,9-27 (terraform_map_duplicate_keys)

  on terraform/environments/delius-core/modules/components/oracle_db_instance/locals.tf line 56:
  56:         evaluation_periods  = "10"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_map_duplicate_keys.md

Warning: `server_type_tag` variable has no type (terraform_typed_variables)

  on terraform/environments/delius-core/modules/components/oracle_db_instance/variables.tf line 36:
  36: variable "server_type_tag" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_typed_variables.md

Warning: `database_tag_prefix` variable has no type (terraform_typed_variables)

  on terraform/environments/delius-core/modules/components/oracle_db_instance/variables.tf line 41:
  41: variable "database_tag_prefix" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_typed_variables.md

tflint_exitcode=2

`Trivy Scan` Success

Show Output

*****************************

Trivy will check the following folders:
terraform/environments/delius-core/modules/components/oracle_db_instance

*****************************

Running Trivy in terraform/environments/delius-core/modules/components/oracle_db_instance
2025-01-09T09:31:35Z	INFO	[vulndb] Need to update DB
2025-01-09T09:31:35Z	INFO	[vulndb] Downloading vulnerability DB...
2025-01-09T09:31:35Z	INFO	[vulndb] Downloading artifact...	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-09T09:31:37Z	INFO	[vulndb] Artifact successfully downloaded	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-09T09:31:37Z	INFO	[vuln] Vulnerability scanning is enabled
2025-01-09T09:31:37Z	INFO	[misconfig] Misconfiguration scanning is enabled
2025-01-09T09:31:37Z	INFO	[misconfig] Need to update the built-in checks
2025-01-09T09:31:37Z	INFO	[misconfig] Downloading the built-in checks...
160.80 KiB / 160.80 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2025-01-09T09:31:38Z	INFO	[secret] Secret scanning is enabled
2025-01-09T09:31:38Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-09T09:31:38Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-09T09:31:39Z	INFO	[terraform scanner] Scanning root module	file_path="."
2025-01-09T09:31:39Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="account_config, account_info, availability_zone, db_ami, ebs_volume_config, ebs_volumes, ec2_key_pair_name, env_name, environment_config, instance_profile_policies, security_group_ids, sns_topic_arn, ssh_keys_bucket_name, subnet_id, tags, user_data"
2025-01-09T09:31:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.instance.aws_ebs_volume.this" value="cty.NilVal"
2025-01-09T09:31:39Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.instance.aws_instance.this" err="2 errors occurred:\n\t* invalid for-each in aws_instance.this.dynamic.ephemeral_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_instance.this.dynamic.ebs_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-09T09:31:39Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.instance.aws_instance.this" err="2 errors occurred:\n\t* invalid for-each in aws_instance.this.dynamic.ephemeral_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_instance.this.dynamic.ebs_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-09T09:31:39Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-enforce-http-token-imds" range="github.com/ministryofjustice/modernisation-platform-terraform-ec2-instance?ref=20622418aa13871c279c12d9ae5e98f29c9a46f0/main.tf:22"
2025-01-09T09:31:39Z	INFO	Number of language-specific files	num=0
2025-01-09T09:31:39Z	INFO	Detected config files	num=2
trivy_exitcode=0

github-actions · 2025-01-09T10:00:15Z

`Trivy Scan` Success

Show Output

```hcl

Trivy will check the following folders:
terraform/environments/delius-core/modules/components/oracle_db_instance

Running Trivy in terraform/environments/delius-core/modules/components/oracle_db_instance
2025-01-09T10:00:02Z INFO [vulndb] Need to update DB
2025-01-09T10:00:02Z INFO [vulndb] Downloading vulnerability DB...
2025-01-09T10:00:02Z INFO [vulndb] Downloading artifact... repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-09T10:00:05Z INFO [vulndb] Artifact successfully downloaded repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-09T10:00:05Z INFO [vuln] Vulnerability scanning is enabled
2025-01-09T10:00:05Z INFO [misconfig] Misconfiguration scanning is enabled
2025-01-09T10:00:05Z INFO [misconfig] Need to update the built-in checks
2025-01-09T10:00:05Z INFO [misconfig] Downloading the built-in checks...
160.80 KiB / 160.80 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2025-01-09T10:00:09Z INFO [secret] Secret scanning is enabled
2025-01-09T10:00:09Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-09T10:00:09Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-09T10:00:10Z INFO [terraform scanner] Scanning root module file_path="."
2025-01-09T10:00:10Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="account_config, account_info, availability_zone, db_ami, ebs_volume_config, ebs_volumes, ec2_key_pair_name, env_name, environment_config, instance_profile_policies, security_group_ids, sns_topic_arn, ssh_keys_bucket_name, subnet_id, tags, user_data"
2025-01-09T10:00:10Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.instance.aws_ebs_volume.this" value="cty.NilVal"
2025-01-09T10:00:10Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.instance.aws_instance.this" err="2 errors occurred:\n\t* invalid for-each in aws_instance.this.dynamic.ephemeral_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_instance.this.dynamic.ebs_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-09T10:00:10Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.instance.aws_instance.this" err="2 errors occurred:\n\t* invalid for-each in aws_instance.this.dynamic.ephemeral_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_instance.this.dynamic.ebs_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-09T10:00:10Z INFO [terraform executor] Ignore finding rule="aws-ec2-enforce-http-token-imds" range="github.com/ministryofjustice/modernisation-platform-terraform-ec2-instance?ref=20622418aa13871c279c12d9ae5e98f29c9a46f0/main.tf:22"
2025-01-09T10:00:10Z INFO Number of language-specific files num=0
2025-01-09T10:00:10Z INFO Detected config files num=2
trivy_exitcode=0

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/delius-core/modules/components/oracle_db_instance

*****************************

Running Checkov in terraform/environments/delius-core/modules/components/oracle_db_instance
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2025-01-09 10:00:12,921 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-ec2-instance?ref=20622418aa13871c279c12d9ae5e98f29c9a46f0:None (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 0, Failed checks: 1, Skipped checks: 2

Check: CKV2_AWS_23: "Route53 A Record has Attached Resource"
	FAILED for resource: aws_route53_record.db_ec2_instance_public
	File: /dns.tf:10-17
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-route53-a-record-has-an-attached-resource

		10 | resource "aws_route53_record" "db_ec2_instance_public" {
		11 |   provider = aws.core-vpc
		12 |   zone_id = var.account_config.route53_external_zone.zone_id
		13 |   name     = var.db_type == "primary" ? "${var.account_info.application_name}-${var.env_name}-${var.db_suffix}-${var.db_count_index}.${var.account_config.dns_suffix}" : "${var.account_info.application_name}-${var.env_name}-${var.db_suffix}-${var.db_count_index + 1}.${var.account_config.dns_suffix}"
		14 |   type     = "A"
		15 |   ttl      = 60
		16 |   records  = [module.instance.aws_instance.private_ip]
		17 | }


checkov_exitcode=1

`CTFLint Scan` Failed

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
terraform/environments/delius-core/modules/components/oracle_db_instance

*****************************

Running tflint in terraform/environments/delius-core/modules/components/oracle_db_instance
Excluding the following checks: terraform_unused_declarations
4 issue(s) found:

Warning: Duplicate key: "datapoints_to_alarm", first defined at terraform/environments/delius-core/modules/components/oracle_db_instance/locals.tf:49,9-28 (terraform_map_duplicate_keys)

  on terraform/environments/delius-core/modules/components/oracle_db_instance/locals.tf line 55:
  55:         datapoints_to_alarm = "10"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_map_duplicate_keys.md

Warning: Duplicate key: "evaluation_periods", first defined at terraform/environments/delius-core/modules/components/oracle_db_instance/locals.tf:48,9-27 (terraform_map_duplicate_keys)

  on terraform/environments/delius-core/modules/components/oracle_db_instance/locals.tf line 56:
  56:         evaluation_periods  = "10"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_map_duplicate_keys.md

Warning: `server_type_tag` variable has no type (terraform_typed_variables)

  on terraform/environments/delius-core/modules/components/oracle_db_instance/variables.tf line 36:
  36: variable "server_type_tag" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_typed_variables.md

Warning: `database_tag_prefix` variable has no type (terraform_typed_variables)

  on terraform/environments/delius-core/modules/components/oracle_db_instance/variables.tf line 41:
  41: variable "database_tag_prefix" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_typed_variables.md

tflint_exitcode=2

`Trivy Scan` Success

Show Output

*****************************

Trivy will check the following folders:
terraform/environments/delius-core/modules/components/oracle_db_instance

*****************************

Running Trivy in terraform/environments/delius-core/modules/components/oracle_db_instance
2025-01-09T10:00:02Z	INFO	[vulndb] Need to update DB
2025-01-09T10:00:02Z	INFO	[vulndb] Downloading vulnerability DB...
2025-01-09T10:00:02Z	INFO	[vulndb] Downloading artifact...	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-09T10:00:05Z	INFO	[vulndb] Artifact successfully downloaded	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-09T10:00:05Z	INFO	[vuln] Vulnerability scanning is enabled
2025-01-09T10:00:05Z	INFO	[misconfig] Misconfiguration scanning is enabled
2025-01-09T10:00:05Z	INFO	[misconfig] Need to update the built-in checks
2025-01-09T10:00:05Z	INFO	[misconfig] Downloading the built-in checks...
160.80 KiB / 160.80 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2025-01-09T10:00:09Z	INFO	[secret] Secret scanning is enabled
2025-01-09T10:00:09Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-09T10:00:09Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-09T10:00:10Z	INFO	[terraform scanner] Scanning root module	file_path="."
2025-01-09T10:00:10Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="account_config, account_info, availability_zone, db_ami, ebs_volume_config, ebs_volumes, ec2_key_pair_name, env_name, environment_config, instance_profile_policies, security_group_ids, sns_topic_arn, ssh_keys_bucket_name, subnet_id, tags, user_data"
2025-01-09T10:00:10Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.instance.aws_ebs_volume.this" value="cty.NilVal"
2025-01-09T10:00:10Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.instance.aws_instance.this" err="2 errors occurred:\n\t* invalid for-each in aws_instance.this.dynamic.ephemeral_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_instance.this.dynamic.ebs_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-09T10:00:10Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.instance.aws_instance.this" err="2 errors occurred:\n\t* invalid for-each in aws_instance.this.dynamic.ephemeral_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_instance.this.dynamic.ebs_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-09T10:00:10Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-enforce-http-token-imds" range="github.com/ministryofjustice/modernisation-platform-terraform-ec2-instance?ref=20622418aa13871c279c12d9ae5e98f29c9a46f0/main.tf:22"
2025-01-09T10:00:10Z	INFO	Number of language-specific files	num=0
2025-01-09T10:00:10Z	INFO	Detected config files	num=2
trivy_exitcode=0

github-actions · 2025-01-09T16:21:26Z

`Trivy Scan` Success

Show Output

```hcl

Trivy will check the following folders:
terraform/environments/delius-core/modules/components/oracle_db_instance
terraform/environments/delius-core/modules/components/oracle_db_shared

Running Trivy in terraform/environments/delius-core/modules/components/oracle_db_instance
2025-01-09T16:21:07Z INFO [vulndb] Need to update DB
2025-01-09T16:21:07Z INFO [vulndb] Downloading vulnerability DB...
2025-01-09T16:21:07Z INFO [vulndb] Downloading artifact... repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-09T16:21:09Z INFO [vulndb] Artifact successfully downloaded repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-09T16:21:09Z INFO [vuln] Vulnerability scanning is enabled
2025-01-09T16:21:09Z INFO [misconfig] Misconfiguration scanning is enabled
2025-01-09T16:21:09Z INFO [misconfig] Need to update the built-in checks
2025-01-09T16:21:09Z INFO [misconfig] Downloading the built-in checks...
160.80 KiB / 160.80 KiB [---------------------------------------------------------] 100.00% ? p/s 0s2025-01-09T16:21:10Z INFO [secret] Secret scanning is enabled
2025-01-09T16:21:10Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-09T16:21:10Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-09T16:21:11Z INFO [terraform scanner] Scanning root module file_path="."
2025-01-09T16:21:11Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="account_config, account_info, availability_zone, db_ami, ebs_volume_config, ebs_volumes, ec2_key_pair_name, env_name, environment_config, instance_profile_policies, security_group_ids, sns_topic_arn, ssh_keys_bucket_name, subnet_id, tags, user_data"
2025-01-09T16:21:11Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.instance.aws_ebs_volume.this" value="cty.NilVal"
2025-01-09T16:21:11Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.instance.aws_instance.this" err="2 errors occurred:\n\t* invalid for-each in aws_instance.this.dynamic.ephemeral_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_instance.this.dynamic.ebs_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-09T16:21:11Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.instance.aws_instance.this" err="2 errors occurred:\n\t* invalid for-each in aws_instance.this.dynamic.ephemeral_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_instance.this.dynamic.ebs_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-09T16:21:11Z INFO [terraform executor] Ignore finding rule="aws-ec2-enforce-http-token-imds" range="github.com/ministryofjustice/modernisation-platform-terraform-ec2-instance?ref=20622418aa13871c279c12d9ae5e98f29c9a46f0/main.tf:22"
2025-01-09T16:21:11Z INFO Number of language-specific files num=0
2025-01-09T16:21:11Z INFO Detected config files num=2
trivy_exitcode=0

Running Trivy in terraform/environments/delius-core/modules/components/oracle_db_shared
2025-01-09T16:21:12Z INFO [vuln] Vulnerability scanning is enabled
2025-01-09T16:21:12Z INFO [misconfig] Misconfiguration scanning is enabled
2025-01-09T16:21:12Z INFO [secret] Secret scanning is enabled
2025-01-09T16:21:12Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-09T16:21:12Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-09T16:21:13Z INFO [terraform scanner] Scanning root module file_path="."
2025-01-09T16:21:13Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="account_config, account_info, bastion_sg_id, env_name, environment_config, instance_roles, platform_vars, public_keys, tags"
2025-01-09T16:21:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_s3_object.user_public_keys" value="cty.NilVal"
2025-01-09T16:21:15Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-public-egress-sgr" range="sg.tf:16"
2025-01-09T16:21:15Z INFO Number of language-specific files num=0
2025-01-09T16:21:15Z INFO Detected config files num=4
trivy_exitcode=0

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/delius-core/modules/components/oracle_db_instance
terraform/environments/delius-core/modules/components/oracle_db_shared

*****************************

Running Checkov in terraform/environments/delius-core/modules/components/oracle_db_instance
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2025-01-09 16:21:17,879 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-ec2-instance?ref=20622418aa13871c279c12d9ae5e98f29c9a46f0:None (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 0, Failed checks: 1, Skipped checks: 2

Check: CKV2_AWS_23: "Route53 A Record has Attached Resource"
	FAILED for resource: aws_route53_record.db_ec2_instance_public
	File: /dns.tf:10-17
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-route53-a-record-has-an-attached-resource

		10 | resource "aws_route53_record" "db_ec2_instance_public" {
		11 |   provider = aws.core-vpc
		12 |   zone_id = var.account_config.route53_external_zone.zone_id
		13 |   name     = var.db_type == "primary" ? "${var.account_info.application_name}-${var.env_name}-${var.db_suffix}-${var.db_count_index}.${var.account_config.dns_suffix}" : "${var.account_info.application_name}-${var.env_name}-${var.db_suffix}-${var.db_count_index + 1}.${var.account_config.dns_suffix}"
		14 |   type     = "A"
		15 |   ttl      = 60
		16 |   records  = [module.instance.aws_instance.private_ip]
		17 | }


checkov_exitcode=1

*****************************

Running Checkov in terraform/environments/delius-core/modules/components/oracle_db_shared
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2025-01-09 16:21:21,803 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.1.0:None (for external modules, the --download-external-modules flag is required)
2025-01-09 16:21:21,804 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0:None (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 245, Failed checks: 1, Skipped checks: 19

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: s3_bucket_oracledb_backups_inventory
	File: /s3.tf:189-227
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		189 | module "s3_bucket_oracledb_backups_inventory" {
		190 |   source              = "github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.1.0"
		191 |   bucket_name         = "${local.oracle_backup_bucket_prefix}-inventory"
		192 |   versioning_enabled  = false
		193 |   ownership_controls  = "BucketOwnerEnforced"
		194 |   replication_enabled = false
		195 |   custom_kms_key      = var.account_config.kms_keys.general_shared
		196 |   bucket_policy       = [data.aws_iam_policy_document.oracledb_backups_inventory.json]
		197 | 
		198 |   providers = {
		199 |     aws.bucket-replication = aws.bucket-replication
		200 |   }
		201 | 
		202 |   lifecycle_rule = [
		203 |     {
		204 |       id      = "main"
		205 |       enabled = "Enabled"
		206 |       prefix  = ""
		207 | 
		208 |       tags = {
		209 |         rule      = "log"
		210 |         autoclean = "true"
		211 |       }
		212 | 
		213 |       transition = [
		214 |         {
		215 |           days          = 90
		216 |           storage_class = "STANDARD_IA"
		217 |         }
		218 |       ]
		219 | 
		220 |       expiration = {
		221 |         days = 365
		222 |       }
		223 |     }
		224 |   ]
		225 | 
		226 |   tags = var.tags
		227 | }


checkov_exitcode=2

`CTFLint Scan` Failed

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
terraform/environments/delius-core/modules/components/oracle_db_instance
terraform/environments/delius-core/modules/components/oracle_db_shared

*****************************

Running tflint in terraform/environments/delius-core/modules/components/oracle_db_instance
Excluding the following checks: terraform_unused_declarations
4 issue(s) found:

Warning: Duplicate key: "datapoints_to_alarm", first defined at terraform/environments/delius-core/modules/components/oracle_db_instance/locals.tf:49,9-28 (terraform_map_duplicate_keys)

  on terraform/environments/delius-core/modules/components/oracle_db_instance/locals.tf line 55:
  55:         datapoints_to_alarm = "10"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_map_duplicate_keys.md

Warning: Duplicate key: "evaluation_periods", first defined at terraform/environments/delius-core/modules/components/oracle_db_instance/locals.tf:48,9-27 (terraform_map_duplicate_keys)

  on terraform/environments/delius-core/modules/components/oracle_db_instance/locals.tf line 56:
  56:         evaluation_periods  = "10"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_map_duplicate_keys.md

Warning: `server_type_tag` variable has no type (terraform_typed_variables)

  on terraform/environments/delius-core/modules/components/oracle_db_instance/variables.tf line 36:
  36: variable "server_type_tag" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_typed_variables.md

Warning: `database_tag_prefix` variable has no type (terraform_typed_variables)

  on terraform/environments/delius-core/modules/components/oracle_db_instance/variables.tf line 41:
  41: variable "database_tag_prefix" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_typed_variables.md

tflint_exitcode=2

*****************************

Running tflint in terraform/environments/delius-core/modules/components/oracle_db_shared
Excluding the following checks: terraform_unused_declarations
7 issue(s) found:

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/delius-core/modules/components/oracle_db_shared/s3.tf line 10:
  10:       "${module.s3_bucket_oracledb_backups.bucket.arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/delius-core/modules/components/oracle_db_shared/s3.tf line 74:
  74:       "${module.s3_bucket_oracledb_backups.bucket.arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/delius-core/modules/components/oracle_db_shared/s3.tf line 87:
  87:       "${module.s3_bucket_oracledb_backups_inventory.bucket.arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/delius-core/modules/components/oracle_db_shared/s3.tf line 126:
 126:         "${module.s3_bucket_oracle_statistics[0].bucket.arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/delius-core/modules/components/oracle_db_shared/s3.tf line 241:
 241:       values   = ["${var.account_info.id}"]

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/delius-core/modules/components/oracle_db_shared/s3.tf line 253:
 253:       values   = ["${module.s3_bucket_oracledb_backups.bucket.arn}"]

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/delius-core/modules/components/oracle_db_shared/s3.tf line 294:
 294:     resources = ["${module.s3_bucket_oracle_statistics[0].bucket.arn}"]

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

tflint_exitcode=4

`Trivy Scan` Success

Show Output

*****************************

Trivy will check the following folders:
terraform/environments/delius-core/modules/components/oracle_db_instance
terraform/environments/delius-core/modules/components/oracle_db_shared

*****************************

Running Trivy in terraform/environments/delius-core/modules/components/oracle_db_instance
2025-01-09T16:21:07Z	INFO	[vulndb] Need to update DB
2025-01-09T16:21:07Z	INFO	[vulndb] Downloading vulnerability DB...
2025-01-09T16:21:07Z	INFO	[vulndb] Downloading artifact...	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-09T16:21:09Z	INFO	[vulndb] Artifact successfully downloaded	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-09T16:21:09Z	INFO	[vuln] Vulnerability scanning is enabled
2025-01-09T16:21:09Z	INFO	[misconfig] Misconfiguration scanning is enabled
2025-01-09T16:21:09Z	INFO	[misconfig] Need to update the built-in checks
2025-01-09T16:21:09Z	INFO	[misconfig] Downloading the built-in checks...
160.80 KiB / 160.80 KiB [---------------------------------------------------------] 100.00% ? p/s 0s2025-01-09T16:21:10Z	INFO	[secret] Secret scanning is enabled
2025-01-09T16:21:10Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-09T16:21:10Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-09T16:21:11Z	INFO	[terraform scanner] Scanning root module	file_path="."
2025-01-09T16:21:11Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="account_config, account_info, availability_zone, db_ami, ebs_volume_config, ebs_volumes, ec2_key_pair_name, env_name, environment_config, instance_profile_policies, security_group_ids, sns_topic_arn, ssh_keys_bucket_name, subnet_id, tags, user_data"
2025-01-09T16:21:11Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.instance.aws_ebs_volume.this" value="cty.NilVal"
2025-01-09T16:21:11Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.instance.aws_instance.this" err="2 errors occurred:\n\t* invalid for-each in aws_instance.this.dynamic.ephemeral_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_instance.this.dynamic.ebs_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-09T16:21:11Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.instance.aws_instance.this" err="2 errors occurred:\n\t* invalid for-each in aws_instance.this.dynamic.ephemeral_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_instance.this.dynamic.ebs_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-09T16:21:11Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-enforce-http-token-imds" range="github.com/ministryofjustice/modernisation-platform-terraform-ec2-instance?ref=20622418aa13871c279c12d9ae5e98f29c9a46f0/main.tf:22"
2025-01-09T16:21:11Z	INFO	Number of language-specific files	num=0
2025-01-09T16:21:11Z	INFO	Detected config files	num=2
trivy_exitcode=0

*****************************

Running Trivy in terraform/environments/delius-core/modules/components/oracle_db_shared
2025-01-09T16:21:12Z	INFO	[vuln] Vulnerability scanning is enabled
2025-01-09T16:21:12Z	INFO	[misconfig] Misconfiguration scanning is enabled
2025-01-09T16:21:12Z	INFO	[secret] Secret scanning is enabled
2025-01-09T16:21:12Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-09T16:21:12Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-09T16:21:13Z	INFO	[terraform scanner] Scanning root module	file_path="."
2025-01-09T16:21:13Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="account_config, account_info, bastion_sg_id, env_name, environment_config, instance_roles, platform_vars, public_keys, tags"
2025-01-09T16:21:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_s3_object.user_public_keys" value="cty.NilVal"
2025-01-09T16:21:15Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-public-egress-sgr" range="sg.tf:16"
2025-01-09T16:21:15Z	INFO	Number of language-specific files	num=0
2025-01-09T16:21:15Z	INFO	Detected config files	num=4
trivy_exitcode=0

github-actions · 2025-01-09T16:27:06Z

`Trivy Scan` Success

Show Output

```hcl

Trivy will check the following folders:
terraform/environments/delius-core/modules/components/oracle_db_instance
terraform/environments/delius-core/modules/components/oracle_db_shared
terraform/environments/delius-mis

Running Trivy in terraform/environments/delius-core/modules/components/oracle_db_instance
2025-01-09T16:26:31Z INFO [vulndb] Need to update DB
2025-01-09T16:26:31Z INFO [vulndb] Downloading vulnerability DB...
2025-01-09T16:26:31Z INFO [vulndb] Downloading artifact... repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-09T16:26:34Z INFO [vulndb] Artifact successfully downloaded repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-09T16:26:34Z INFO [vuln] Vulnerability scanning is enabled
2025-01-09T16:26:34Z INFO [misconfig] Misconfiguration scanning is enabled
2025-01-09T16:26:34Z INFO [misconfig] Need to update the built-in checks
2025-01-09T16:26:34Z INFO [misconfig] Downloading the built-in checks...
160.80 KiB / 160.80 KiB [---------------------------------------------------------] 100.00% ? p/s 0s2025-01-09T16:26:34Z INFO [secret] Secret scanning is enabled
2025-01-09T16:26:34Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-09T16:26:34Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-09T16:26:35Z INFO [terraform scanner] Scanning root module file_path="."
2025-01-09T16:26:35Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="account_config, account_info, availability_zone, db_ami, ebs_volume_config, ebs_volumes, ec2_key_pair_name, env_name, environment_config, instance_profile_policies, security_group_ids, sns_topic_arn, ssh_keys_bucket_name, subnet_id, tags, user_data"
2025-01-09T16:26:36Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.instance.aws_ebs_volume.this" value="cty.NilVal"
2025-01-09T16:26:36Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.instance.aws_instance.this" err="2 errors occurred:\n\t* invalid for-each in aws_instance.this.dynamic.ephemeral_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_instance.this.dynamic.ebs_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-09T16:26:36Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.instance.aws_instance.this" err="2 errors occurred:\n\t* invalid for-each in aws_instance.this.dynamic.ephemeral_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_instance.this.dynamic.ebs_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-09T16:26:36Z INFO [terraform executor] Ignore finding rule="aws-ec2-enforce-http-token-imds" range="github.com/ministryofjustice/modernisation-platform-terraform-ec2-instance?ref=20622418aa13871c279c12d9ae5e98f29c9a46f0/main.tf:22"
2025-01-09T16:26:36Z INFO Number of language-specific files num=0
2025-01-09T16:26:36Z INFO Detected config files num=2
trivy_exitcode=0

Running Trivy in terraform/environments/delius-core/modules/components/oracle_db_shared
2025-01-09T16:26:36Z INFO [vuln] Vulnerability scanning is enabled
2025-01-09T16:26:36Z INFO [misconfig] Misconfiguration scanning is enabled
2025-01-09T16:26:36Z INFO [secret] Secret scanning is enabled
2025-01-09T16:26:36Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-09T16:26:36Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-09T16:26:37Z INFO [terraform scanner] Scanning root module file_path="."
2025-01-09T16:26:37Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="account_config, account_info, bastion_sg_id, env_name, environment_config, instance_roles, platform_vars, public_keys, tags"
2025-01-09T16:26:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_s3_object.user_public_keys" value="cty.NilVal"
2025-01-09T16:26:39Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-public-egress-sgr" range="sg.tf:16"
2025-01-09T16:26:39Z INFO Number of language-specific files num=0
2025-01-09T16:26:39Z INFO Detected config files num=4
trivy_exitcode=0

Running Trivy in terraform/environments/delius-mis
2025-01-09T16:26:39Z INFO [vuln] Vulnerability scanning is enabled
2025-01-09T16:26:39Z INFO [misconfig] Misconfiguration scanning is enabled
2025-01-09T16:26:39Z INFO [secret] Secret scanning is enabled
2025-01-09T16:26:39Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-09T16:26:39Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-09T16:26:40Z INFO [terraform scanner] Scanning root module file_path="."
2025-01-09T16:26:40Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="networking"
2025-01-09T16:26:41Z INFO Number of language-specific files num=0
2025-01-09T16:26:41Z INFO Detected config files num=1
trivy_exitcode=0

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/delius-core/modules/components/oracle_db_instance
terraform/environments/delius-core/modules/components/oracle_db_shared
terraform/environments/delius-mis

*****************************

Running Checkov in terraform/environments/delius-core/modules/components/oracle_db_instance
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2025-01-09 16:26:43,942 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-ec2-instance?ref=20622418aa13871c279c12d9ae5e98f29c9a46f0:None (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 0, Failed checks: 1, Skipped checks: 2

Check: CKV2_AWS_23: "Route53 A Record has Attached Resource"
	FAILED for resource: aws_route53_record.db_ec2_instance_public
	File: /dns.tf:10-17
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-route53-a-record-has-an-attached-resource

		10 | resource "aws_route53_record" "db_ec2_instance_public" {
		11 |   provider = aws.core-vpc
		12 |   zone_id = var.account_config.route53_external_zone.zone_id
		13 |   name     = var.db_type == "primary" ? "${var.account_info.application_name}-${var.env_name}-${var.db_suffix}-${var.db_count_index}.${var.account_config.dns_suffix}" : "${var.account_info.application_name}-${var.env_name}-${var.db_suffix}-${var.db_count_index + 1}.${var.account_config.dns_suffix}"
		14 |   type     = "A"
		15 |   ttl      = 60
		16 |   records  = [module.instance.aws_instance.private_ip]
		17 | }


checkov_exitcode=1

*****************************

Running Checkov in terraform/environments/delius-core/modules/components/oracle_db_shared
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2025-01-09 16:26:47,702 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.1.0:None (for external modules, the --download-external-modules flag is required)
2025-01-09 16:26:47,702 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0:None (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 245, Failed checks: 1, Skipped checks: 19

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: s3_bucket_oracledb_backups_inventory
	File: /s3.tf:189-227
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		189 | module "s3_bucket_oracledb_backups_inventory" {
		190 |   source              = "github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.1.0"
		191 |   bucket_name         = "${local.oracle_backup_bucket_prefix}-inventory"
		192 |   versioning_enabled  = false
		193 |   ownership_controls  = "BucketOwnerEnforced"
		194 |   replication_enabled = false
		195 |   custom_kms_key      = var.account_config.kms_keys.general_shared
		196 |   bucket_policy       = [data.aws_iam_policy_document.oracledb_backups_inventory.json]
		197 | 
		198 |   providers = {
		199 |     aws.bucket-replication = aws.bucket-replication
		200 |   }
		201 | 
		202 |   lifecycle_rule = [
		203 |     {
		204 |       id      = "main"
		205 |       enabled = "Enabled"
		206 |       prefix  = ""
		207 | 
		208 |       tags = {
		209 |         rule      = "log"
		210 |         autoclean = "true"
		211 |       }
		212 | 
		213 |       transition = [
		214 |         {
		215 |           days          = 90
		216 |           storage_class = "STANDARD_IA"
		217 |         }
		218 |       ]
		219 | 
		220 |       expiration = {
		221 |         days = 365
		222 |       }
		223 |     }
		224 |   ]
		225 | 
		226 |   tags = var.tags
		227 | }


checkov_exitcode=2

*****************************

Running Checkov in terraform/environments/delius-mis
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2025-01-09 16:26:51,568 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=c918b2189d9f81d224e07e98fa1bc9ff38e4ba12:None (for external modules, the --download-external-modules flag is required)
2025-01-09 16:26:51,568 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.1.0:None (for external modules, the --download-external-modules flag is required)
2025-01-09 16:26:51,568 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-ec2-instance?ref=49e289239aec2845924f00fc5969f35ae76122e2:None (for external modules, the --download-external-modules flag is required)
2025-01-09 16:26:51,568 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-pagerduty-integration?ref=v2.0.0:None (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 3006, Failed checks: 84, Skipped checks: 240

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: module.environment_dev.module.oracle_db_shared["boe-db"].s3_bucket_oracledb_backups_inventory
	File: /../delius-core/modules/components/oracle_db_shared/s3.tf:189-227
	Calling File: /modules/mis_environment/databases.tf:13-42
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		189 | module "s3_bucket_oracledb_backups_inventory" {
		190 |   source              = "github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.1.0"
		191 |   bucket_name         = "${local.oracle_backup_bucket_prefix}-inventory"
		192 |   versioning_enabled  = false
		193 |   ownership_controls  = "BucketOwnerEnforced"
		194 |   replication_enabled = false
		195 |   custom_kms_key      = var.account_config.kms_keys.general_shared
		196 |   bucket_policy       = [data.aws_iam_policy_document.oracledb_backups_inventory.json]
		197 | 
		198 |   providers = {
		199 |     aws.bucket-replication = aws.bucket-replication
		200 |   }
		201 | 
		202 |   lifecycle_rule = [
		203 |     {
		204 |       id      = "main"
		205 |       enabled = "Enabled"
		206 |       prefix  = ""
		207 | 
		208 |       tags = {
		209 |         rule      = "log"
		210 |         autoclean = "true"
		211 |       }
		212 | 
		213 |       transition = [
		214 |         {
		215 |           days          = 90
		216 |           storage_class = "STANDARD_IA"
		217 |         }
		218 |       ]
		219 | 
		220 |       expiration = {
		221 |         days = 365
		222 |       }
		223 |     }
		224 |   ]
		225 | 
		226 |   tags = var.tags
		227 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: module.environment_preproduction.module.oracle_db_shared["boe-db"].s3_bucket_oracledb_backups_inventory
	File: /../delius-core/modules/components/oracle_db_shared/s3.tf:189-227
	Calling File: /modules/mis_environment/databases.tf:13-42
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		189 | module "s3_bucket_oracledb_backups_inventory" {
		190 |   source              = "github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.1.0"
		191 |   bucket_name         = "${local.oracle_backup_bucket_prefix}-inventory"
		192 |   versioning_enabled  = false
		193 |   ownership_controls  = "BucketOwnerEnforced"
		194 |   replication_enabled = false
		195 |   custom_kms_key      = var.account_config.kms_keys.general_shared
		196 |   bucket_policy       = [data.aws_iam_policy_document.oracledb_backups_inventory.json]
		197 | 
		198 |   providers = {
		199 |     aws.bucket-replication = aws.bucket-replication
		200 |   }
		201 | 
		202 |   lifecycle_rule = [
		203 |     {
		204 |       id      = "main"
		205 |       enabled = "Enabled"
		206 |       prefix  = ""
		207 | 
		208 |       tags = {
		209 |         rule      = "log"
		210 |         autoclean = "true"
		211 |       }
		212 | 
		213 |       transition = [
		214 |         {
		215 |           days          = 90
		216 |           storage_class = "STANDARD_IA"
		217 |         }
		218 |       ]
		219 | 
		220 |       expiration = {
		221 |         days = 365
		222 |       }
		223 |     }
		224 |   ]
		225 | 
		226 |   tags = var.tags
		227 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: module.environment_stage.module.oracle_db_shared["boe-db"].s3_bucket_oracledb_backups_inventory
	File: /../delius-core/modules/components/oracle_db_shared/s3.tf:189-227
	Calling File: /modules/mis_environment/databases.tf:13-42
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		189 | module "s3_bucket_oracledb_backups_inventory" {
		190 |   source              = "github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.1.0"
		191 |   bucket_name         = "${local.oracle_backup_bucket_prefix}-inventory"
		192 |   versioning_enabled  = false
		193 |   ownership_controls  = "BucketOwnerEnforced"
		194 |   replication_enabled = false
		195 |   custom_kms_key      = var.account_config.kms_keys.general_shared
		196 |   bucket_policy       = [data.aws_iam_policy_document.oracledb_backups_inventory.json]
		197 | 
		198 |   providers = {
		199 |     aws.bucket-replication = aws.bucket-replication
		200 |   }
		201 | 
		202 |   lifecycle_rule = [
		203 |     {
		204 |       id      = "main"
		205 |       enabled = "Enabled"
		206 |       prefix  = ""
		207 | 
		208 |       tags = {
		209 |         rule      = "log"
		210 |         autoclean = "true"
		211 |       }
		212 | 
		213 |       transition = [
		214 |         {
		215 |           days          = 90
		216 |           storage_class = "STANDARD_IA"
		217 |         }
		218 |       ]
		219 | 
		220 |       expiration = {
		221 |         days = 365
		222 |       }
		223 |     }
		224 |   ]
		225 | 
		226 |   tags = var.tags
		227 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_dev.aws_security_group.bcs
	File: /modules/mis_environment/bcs.tf:1-5
	Calling File: /main_development.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		1 | resource "aws_security_group" "bcs" {
		2 |   #checkov:skip=CKV2_AWS_5 "ignore"
		3 |   name_prefix = "${var.env_name}-bcs"
		4 |   vpc_id      = var.account_info.vpc_id
		5 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_preproduction.aws_security_group.bcs
	File: /modules/mis_environment/bcs.tf:1-5
	Calling File: /main_preproduction.tf:48-88
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		1 | resource "aws_security_group" "bcs" {
		2 |   #checkov:skip=CKV2_AWS_5 "ignore"
		3 |   name_prefix = "${var.env_name}-bcs"
		4 |   vpc_id      = var.account_info.vpc_id
		5 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_stage.aws_security_group.bcs
	File: /modules/mis_environment/bcs.tf:1-5
	Calling File: /main_preproduction.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		1 | resource "aws_security_group" "bcs" {
		2 |   #checkov:skip=CKV2_AWS_5 "ignore"
		3 |   name_prefix = "${var.env_name}-bcs"
		4 |   vpc_id      = var.account_info.vpc_id
		5 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_dev.aws_security_group.bps
	File: /modules/mis_environment/bps.tf:1-5
	Calling File: /main_development.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		1 | resource "aws_security_group" "bps" {
		2 |   #checkov:skip=CKV2_AWS_5 "ignore"
		3 |   name_prefix = "${var.env_name}-bps"
		4 |   vpc_id      = var.account_info.vpc_id
		5 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_preproduction.aws_security_group.bps
	File: /modules/mis_environment/bps.tf:1-5
	Calling File: /main_preproduction.tf:48-88
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		1 | resource "aws_security_group" "bps" {
		2 |   #checkov:skip=CKV2_AWS_5 "ignore"
		3 |   name_prefix = "${var.env_name}-bps"
		4 |   vpc_id      = var.account_info.vpc_id
		5 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_stage.aws_security_group.bps
	File: /modules/mis_environment/bps.tf:1-5
	Calling File: /main_preproduction.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		1 | resource "aws_security_group" "bps" {
		2 |   #checkov:skip=CKV2_AWS_5 "ignore"
		3 |   name_prefix = "${var.env_name}-bps"
		4 |   vpc_id      = var.account_info.vpc_id
		5 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_dev.aws_security_group.bws
	File: /modules/mis_environment/bws.tf:1-5
	Calling File: /main_development.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		1 | resource "aws_security_group" "bws" {
		2 |   #checkov:skip=CKV2_AWS_5 "ignore"
		3 |   name_prefix = "${var.env_name}-bws"
		4 |   vpc_id      = var.account_info.vpc_id
		5 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_preproduction.aws_security_group.bws
	File: /modules/mis_environment/bws.tf:1-5
	Calling File: /main_preproduction.tf:48-88
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		1 | resource "aws_security_group" "bws" {
		2 |   #checkov:skip=CKV2_AWS_5 "ignore"
		3 |   name_prefix = "${var.env_name}-bws"
		4 |   vpc_id      = var.account_info.vpc_id
		5 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_stage.aws_security_group.bws
	File: /modules/mis_environment/bws.tf:1-5
	Calling File: /main_preproduction.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		1 | resource "aws_security_group" "bws" {
		2 |   #checkov:skip=CKV2_AWS_5 "ignore"
		3 |   name_prefix = "${var.env_name}-bws"
		4 |   vpc_id      = var.account_info.vpc_id
		5 | }

Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: module.environment_dev.aws_secretsmanager_secret.ad_admin_password
	File: /modules/mis_environment/directory_service.tf:29-39
	Calling File: /main_development.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		29 | resource "aws_secretsmanager_secret" "ad_admin_password" {
		30 |   name                    = "${var.app_name}-${var.env_name}-ad-admin-password"
		31 |   recovery_window_in_days = 0
		32 | 
		33 |   tags = merge(
		34 |     var.tags,
		35 |     {
		36 |       Name = "${var.app_name}-${var.env_name}-ad-admin-password"
		37 |     }
		38 |   )
		39 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: module.environment_dev.aws_cloudwatch_log_group.active_directory
	File: /modules/mis_environment/directory_service.tf:49-52
	Calling File: /main_development.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		49 | resource "aws_cloudwatch_log_group" "active_directory" {
		50 |   name              = "/aws/directoryservice/${aws_directory_service_directory.mis_ad.id}"
		51 |   retention_in_days = 14
		52 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: module.environment_dev.aws_cloudwatch_log_group.active_directory
	File: /modules/mis_environment/directory_service.tf:49-52
	Calling File: /main_development.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		49 | resource "aws_cloudwatch_log_group" "active_directory" {
		50 |   name              = "/aws/directoryservice/${aws_directory_service_directory.mis_ad.id}"
		51 |   retention_in_days = 14
		52 | }

Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: module.environment_preproduction.aws_secretsmanager_secret.ad_admin_password
	File: /modules/mis_environment/directory_service.tf:29-39
	Calling File: /main_preproduction.tf:48-88
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		29 | resource "aws_secretsmanager_secret" "ad_admin_password" {
		30 |   name                    = "${var.app_name}-${var.env_name}-ad-admin-password"
		31 |   recovery_window_in_days = 0
		32 | 
		33 |   tags = merge(
		34 |     var.tags,
		35 |     {
		36 |       Name = "${var.app_name}-${var.env_name}-ad-admin-password"
		37 |     }
		38 |   )
		39 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: module.environment_preproduction.aws_cloudwatch_log_group.active_directory
	File: /modules/mis_environment/directory_service.tf:49-52
	Calling File: /main_preproduction.tf:48-88
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		49 | resource "aws_cloudwatch_log_group" "active_directory" {
		50 |   name              = "/aws/directoryservice/${aws_directory_service_directory.mis_ad.id}"
		51 |   retention_in_days = 14
		52 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: module.environment_preproduction.aws_cloudwatch_log_group.active_directory
	File: /modules/mis_environment/directory_service.tf:49-52
	Calling File: /main_preproduction.tf:48-88
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		49 | resource "aws_cloudwatch_log_group" "active_directory" {
		50 |   name              = "/aws/directoryservice/${aws_directory_service_directory.mis_ad.id}"
		51 |   retention_in_days = 14
		52 | }

Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: module.environment_stage.aws_secretsmanager_secret.ad_admin_password
	File: /modules/mis_environment/directory_service.tf:29-39
	Calling File: /main_preproduction.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		29 | resource "aws_secretsmanager_secret" "ad_admin_password" {
		30 |   name                    = "${var.app_name}-${var.env_name}-ad-admin-password"
		31 |   recovery_window_in_days = 0
		32 | 
		33 |   tags = merge(
		34 |     var.tags,
		35 |     {
		36 |       Name = "${var.app_name}-${var.env_name}-ad-admin-password"
		37 |     }
		38 |   )
		39 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: module.environment_stage.aws_cloudwatch_log_group.active_directory
	File: /modules/mis_environment/directory_service.tf:49-52
	Calling File: /main_preproduction.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		49 | resource "aws_cloudwatch_log_group" "active_directory" {
		50 |   name              = "/aws/directoryservice/${aws_directory_service_directory.mis_ad.id}"
		51 |   retention_in_days = 14
		52 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: module.environment_stage.aws_cloudwatch_log_group.active_directory
	File: /modules/mis_environment/directory_service.tf:49-52
	Calling File: /main_preproduction.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		49 | resource "aws_cloudwatch_log_group" "active_directory" {
		50 |   name              = "/aws/directoryservice/${aws_directory_service_directory.mis_ad.id}"
		51 |   retention_in_days = 14
		52 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_dev.aws_security_group.dis
	File: /modules/mis_environment/dis.tf:1-5
	Calling File: /main_development.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		1 | resource "aws_security_group" "dis" {
		2 |   #checkov:skip=CKV2_AWS_5 "ignore"
		3 |   name_prefix = "${var.env_name}-dis"
		4 |   vpc_id      = var.account_info.vpc_id
		5 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_preproduction.aws_security_group.dis
	File: /modules/mis_environment/dis.tf:1-5
	Calling File: /main_preproduction.tf:48-88
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		1 | resource "aws_security_group" "dis" {
		2 |   #checkov:skip=CKV2_AWS_5 "ignore"
		3 |   name_prefix = "${var.env_name}-dis"
		4 |   vpc_id      = var.account_info.vpc_id
		5 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_stage.aws_security_group.dis
	File: /modules/mis_environment/dis.tf:1-5
	Calling File: /main_preproduction.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		1 | resource "aws_security_group" "dis" {
		2 |   #checkov:skip=CKV2_AWS_5 "ignore"
		3 |   name_prefix = "${var.env_name}-dis"
		4 |   vpc_id      = var.account_info.vpc_id
		5 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: module.environment_dev.pagerduty_core_alerts
	File: /modules/mis_environment/pagerduty.tf:12-21
	Calling File: /main_development.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		12 | module "pagerduty_core_alerts" {
		13 | 
		14 |   depends_on = [
		15 |     aws_sns_topic.delius_mis_alarms
		16 |   ]
		17 | 
		18 |   source                    = "github.com/ministryofjustice/modernisation-platform-terraform-pagerduty-integration?ref=v2.0.0"
		19 |   sns_topics                = [aws_sns_topic.delius_mis_alarms.name]
		20 |   pagerduty_integration_key = var.pagerduty_integration_key
		21 | }

Check: CKV_AWS_26: "Ensure all data stored in the SNS topic is encrypted"
	FAILED for resource: module.environment_dev.aws_sns_topic.delius_mis_alarms
	File: /modules/mis_environment/pagerduty.tf:1-10
	Calling File: /main_development.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-15

		1  | resource "aws_sns_topic" "delius_mis_alarms" {
		2  |   name = "${var.app_name}-${var.env_name}-sns-topic"
		3  | 
		4  |   tags = merge(
		5  |     var.tags,
		6  |     {
		7  |       Name = "${var.app_name}-${var.env_name}-sns-topic"
		8  |     }
		9  |   )
		10 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: module.environment_preproduction.pagerduty_core_alerts
	File: /modules/mis_environment/pagerduty.tf:12-21
	Calling File: /main_preproduction.tf:48-88
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		12 | module "pagerduty_core_alerts" {
		13 | 
		14 |   depends_on = [
		15 |     aws_sns_topic.delius_mis_alarms
		16 |   ]
		17 | 
		18 |   source                    = "github.com/ministryofjustice/modernisation-platform-terraform-pagerduty-integration?ref=v2.0.0"
		19 |   sns_topics                = [aws_sns_topic.delius_mis_alarms.name]
		20 |   pagerduty_integration_key = var.pagerduty_integration_key
		21 | }

Check: CKV_AWS_26: "Ensure all data stored in the SNS topic is encrypted"
	FAILED for resource: module.environment_preproduction.aws_sns_topic.delius_mis_alarms
	File: /modules/mis_environment/pagerduty.tf:1-10
	Calling File: /main_preproduction.tf:48-88
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-15

		1  | resource "aws_sns_topic" "delius_mis_alarms" {
		2  |   name = "${var.app_name}-${var.env_name}-sns-topic"
		3  | 
		4  |   tags = merge(
		5  |     var.tags,
		6  |     {
		7  |       Name = "${var.app_name}-${var.env_name}-sns-topic"
		8  |     }
		9  |   )
		10 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: module.environment_stage.pagerduty_core_alerts
	File: /modules/mis_environment/pagerduty.tf:12-21
	Calling File: /main_preproduction.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		12 | module "pagerduty_core_alerts" {
		13 | 
		14 |   depends_on = [
		15 |     aws_sns_topic.delius_mis_alarms
		16 |   ]
		17 | 
		18 |   source                    = "github.com/ministryofjustice/modernisation-platform-terraform-pagerduty-integration?ref=v2.0.0"
		19 |   sns_topics                = [aws_sns_topic.delius_mis_alarms.name]
		20 |   pagerduty_integration_key = var.pagerduty_integration_key
		21 | }

Check: CKV_AWS_26: "Ensure all data stored in the SNS topic is encrypted"
	FAILED for resource: module.environment_stage.aws_sns_topic.delius_mis_alarms
	File: /modules/mis_environment/pagerduty.tf:1-10
	Calling File: /main_preproduction.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-15

		1  | resource "aws_sns_topic" "delius_mis_alarms" {
		2  |   name = "${var.app_name}-${var.env_name}-sns-topic"
		3  | 
		4  |   tags = merge(
		5  |     var.tags,
		6  |     {
		7  |       Name = "${var.app_name}-${var.env_name}-sns-topic"
		8  |     }
		9  |   )
		10 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_dev.aws_vpc_security_group_ingress_rule.icmp
	File: /modules/mis_environment/sg_legacy.tf:9-15
	Calling File: /main_development.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		9  | resource "aws_vpc_security_group_ingress_rule" "icmp" {
		10 |   security_group_id = aws_security_group.legacy.id
		11 |   cidr_ipv4         = var.environment_config.legacy_counterpart_vpc_cidr
		12 |   ip_protocol       = "icmp"
		13 |   from_port         = -1
		14 |   to_port           = -1
		15 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_dev.aws_vpc_security_group_egress_rule.icmp
	File: /modules/mis_environment/sg_legacy.tf:17-23
	Calling File: /main_development.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		17 | resource "aws_vpc_security_group_egress_rule" "icmp" {
		18 |   security_group_id = aws_security_group.legacy.id
		19 |   cidr_ipv4         = var.environment_config.legacy_counterpart_vpc_cidr
		20 |   ip_protocol       = "icmp"
		21 |   from_port         = -1
		22 |   to_port           = -1
		23 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_preproduction.aws_vpc_security_group_ingress_rule.icmp
	File: /modules/mis_environment/sg_legacy.tf:9-15
	Calling File: /main_preproduction.tf:48-88
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		9  | resource "aws_vpc_security_group_ingress_rule" "icmp" {
		10 |   security_group_id = aws_security_group.legacy.id
		11 |   cidr_ipv4         = var.environment_config.legacy_counterpart_vpc_cidr
		12 |   ip_protocol       = "icmp"
		13 |   from_port         = -1
		14 |   to_port           = -1
		15 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_preproduction.aws_vpc_security_group_egress_rule.icmp
	File: /modules/mis_environment/sg_legacy.tf:17-23
	Calling File: /main_preproduction.tf:48-88
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		17 | resource "aws_vpc_security_group_egress_rule" "icmp" {
		18 |   security_group_id = aws_security_group.legacy.id
		19 |   cidr_ipv4         = var.environment_config.legacy_counterpart_vpc_cidr
		20 |   ip_protocol       = "icmp"
		21 |   from_port         = -1
		22 |   to_port           = -1
		23 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_stage.aws_vpc_security_group_ingress_rule.icmp
	File: /modules/mis_environment/sg_legacy.tf:9-15
	Calling File: /main_preproduction.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		9  | resource "aws_vpc_security_group_ingress_rule" "icmp" {
		10 |   security_group_id = aws_security_group.legacy.id
		11 |   cidr_ipv4         = var.environment_config.legacy_counterpart_vpc_cidr
		12 |   ip_protocol       = "icmp"
		13 |   from_port         = -1
		14 |   to_port           = -1
		15 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_stage.aws_vpc_security_group_egress_rule.icmp
	File: /modules/mis_environment/sg_legacy.tf:17-23
	Calling File: /main_preproduction.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		17 | resource "aws_vpc_security_group_egress_rule" "icmp" {
		18 |   security_group_id = aws_security_group.legacy.id
		19 |   cidr_ipv4         = var.environment_config.legacy_counterpart_vpc_cidr
		20 |   ip_protocol       = "icmp"
		21 |   from_port         = -1
		22 |   to_port           = -1
		23 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_dev.aws_vpc_security_group_egress_rule.http_s["443"]
	File: /modules/mis_environment/sg_shared.tf:9-17
	Calling File: /main_development.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		9  | resource "aws_vpc_security_group_egress_rule" "http_s" {
		10 |   for_each = toset(["80", "443"])
		11 | 
		12 |   security_group_id = aws_security_group.mis_ec2_shared.id
		13 |   cidr_ipv4         = "0.0.0.0/0"
		14 |   ip_protocol       = "tcp"
		15 |   from_port         = each.key
		16 |   to_port           = each.key
		17 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_dev.aws_vpc_security_group_egress_rule.fleet_manager
	File: /modules/mis_environment/sg_shared.tf:19-25
	Calling File: /main_development.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		19 | resource "aws_vpc_security_group_egress_rule" "fleet_manager" {
		20 |   security_group_id = aws_security_group.mis_ec2_shared.id
		21 |   cidr_ipv4         = "0.0.0.0/0"
		22 |   ip_protocol       = "tcp"
		23 |   from_port         = 3389
		24 |   to_port           = 3389
		25 | }

Check: CKV_AWS_25: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389"
	FAILED for resource: module.environment_dev.aws_vpc_security_group_ingress_rule.fleet_manager
	File: /modules/mis_environment/sg_shared.tf:27-33
	Calling File: /main_development.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-2

		27 | resource "aws_vpc_security_group_ingress_rule" "fleet_manager" {
		28 |   security_group_id = aws_security_group.mis_ec2_shared.id
		29 |   cidr_ipv4         = "0.0.0.0/0"
		30 |   ip_protocol       = "tcp"
		31 |   from_port         = 3389
		32 |   to_port           = 3389
		33 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_dev.aws_vpc_security_group_ingress_rule.fleet_manager
	File: /modules/mis_environment/sg_shared.tf:27-33
	Calling File: /main_development.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		27 | resource "aws_vpc_security_group_ingress_rule" "fleet_manager" {
		28 |   security_group_id = aws_security_group.mis_ec2_shared.id
		29 |   cidr_ipv4         = "0.0.0.0/0"
		30 |   ip_protocol       = "tcp"
		31 |   from_port         = 3389
		32 |   to_port           = 3389
		33 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_dev.aws_vpc_security_group_egress_rule.domain_join
	File: /modules/mis_environment/sg_shared.tf:35-42
	Calling File: /main_development.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		35 | resource "aws_vpc_security_group_egress_rule" "domain_join" {
		36 |   for_each                     = { for port in var.domain_join_ports : "${port.protocol}_${port.from_port}" => port }
		37 |   from_port                    = each.value.from_port
		38 |   to_port                      = each.value.to_port
		39 |   ip_protocol                  = each.value.protocol
		40 |   security_group_id            = aws_security_group.mis_ec2_shared.id
		41 |   referenced_security_group_id = aws_directory_service_directory.mis_ad.security_group_id
		42 | }
Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_dev.aws_vpc_security_group_egress_rule.http_s["80"]
	File: /modules/mis_environment/sg_shared.tf:9-17
	Calling File: /main_development.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		9  | resource "aws_vpc_security_group_egress_rule" "http_s" {
		10 |   for_each = toset(["80", "443"])
		11 | 
		12 |   security_group_id = aws_security_group.mis_ec2_shared.id
		13 |   cidr_ipv4         = "0.0.0.0/0"
		14 |   ip_protocol       = "tcp"
		15 |   from_port         = each.key
		16 |   to_port           = each.key
		17 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_preproduction.aws_vpc_security_group_egress_rule.http_s["443"]
	File: /modules/mis_environment/sg_shared.tf:9-17
	Calling File: /main_preproduction.tf:48-88
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		9  | resource "aws_vpc_security_group_egress_rule" "http_s" {
		10 |   for_each = toset(["80", "443"])
		11 | 
		12 |   security_group_id = aws_security_group.mis_ec2_shared.id
		13 |   cidr_ipv4         = "0.0.0.0/0"
		14 |   ip_protocol       = "tcp"
		15 |   from_port         = each.key
		16 |   to_port           = each.key
		17 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_preproduction.aws_vpc_security_group_egress_rule.fleet_manager
	File: /modules/mis_environment/sg_shared.tf:19-25
	Calling File: /main_preproduction.tf:48-88
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		19 | resource "aws_vpc_security_group_egress_rule" "fleet_manager" {
		20 |   security_group_id = aws_security_group.mis_ec2_shared.id
		21 |   cidr_ipv4         = "0.0.0.0/0"
		22 |   ip_protocol       = "tcp"
		23 |   from_port         = 3389
		24 |   to_port           = 3389
		25 | }

Check: CKV_AWS_25: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389"
	FAILED for resource: module.environment_preproduction.aws_vpc_security_group_ingress_rule.fleet_manager
	File: /modules/mis_environment/sg_shared.tf:27-33
	Calling File: /main_preproduction.tf:48-88
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-2

		27 | resource "aws_vpc_security_group_ingress_rule" "fleet_manager" {
		28 |   security_group_id = aws_security_group.mis_ec2_shared.id
		29 |   cidr_ipv4         = "0.0.0.0/0"
		30 |   ip_protocol       = "tcp"
		31 |   from_port         = 3389
		32 |   to_port           = 3389
		33 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_preproduction.aws_vpc_security_group_ingress_rule.fleet_manager
	File: /modules/mis_environment/sg_shared.tf:27-33
	Calling File: /main_preproduction.tf:48-88
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		27 | resource "aws_vpc_security_group_ingress_rule" "fleet_manager" {
		28 |   security_group_id = aws_security_group.mis_ec2_shared.id
		29 |   cidr_ipv4         = "0.0.0.0/0"
		30 |   ip_protocol       = "tcp"
		31 |   from_port         = 3389
		32 |   to_port           = 3389
		33 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_preproduction.aws_vpc_security_group_egress_rule.domain_join
	File: /modules/mis_environment/sg_shared.tf:35-42
	Calling File: /main_preproduction.tf:48-88
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		35 | resource "aws_vpc_security_group_egress_rule" "domain_join" {
		36 |   for_each                     = { for port in var.domain_join_ports : "${port.protocol}_${port.from_port}" => port }
		37 |   from_port                    = each.value.from_port
		38 |   to_port                      = each.value.to_port
		39 |   ip_protocol                  = each.value.protocol
		40 |   security_group_id            = aws_security_group.mis_ec2_shared.id
		41 |   referenced_security_group_id = aws_directory_service_directory.mis_ad.security_group_id
		42 | }
Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_preproduction.aws_vpc_security_group_egress_rule.http_s["80"]
	File: /modules/mis_environment/sg_shared.tf:9-17
	Calling File: /main_preproduction.tf:48-88
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		9  | resource "aws_vpc_security_group_egress_rule" "http_s" {
		10 |   for_each = toset(["80", "443"])
		11 | 
		12 |   security_group_id = aws_security_group.mis_ec2_shared.id
		13 |   cidr_ipv4         = "0.0.0.0/0"
		14 |   ip_protocol       = "tcp"
		15 |   from_port         = each.key
		16 |   to_port           = each.key
		17 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_stage.aws_vpc_security_group_egress_rule.http_s["443"]
	File: /modules/mis_environment/sg_shared.tf:9-17
	Calling File: /main_preproduction.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		9  | resource "aws_vpc_security_group_egress_rule" "http_s" {
		10 |   for_each = toset(["80", "443"])
		11 | 
		12 |   security_group_id = aws_security_group.mis_ec2_shared.id
		13 |   cidr_ipv4         = "0.0.0.0/0"
		14 |   ip_protocol       = "tcp"
		15 |   from_port         = each.key
		16 |   to_port           = each.key
		17 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_stage.aws_vpc_security_group_egress_rule.fleet_manager
	File: /modules/mis_environment/sg_shared.tf:19-25
	Calling File: /main_preproduction.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		19 | resource "aws_vpc_security_group_egress_rule" "fleet_manager" {
		20 |   security_group_id = aws_security_group.mis_ec2_shared.id
		21 |   cidr_ipv4         = "0.0.0.0/0"
		22 |   ip_protocol       = "tcp"
		23 |   from_port         = 3389
		24 |   to_port           = 3389
		25 | }

Check: CKV_AWS_25: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389"
	FAILED for resource: module.environment_stage.aws_vpc_security_group_ingress_rule.fleet_manager
	File: /modules/mis_environment/sg_shared.tf:27-33
	Calling File: /main_preproduction.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-2

		27 | resource "aws_vpc_security_group_ingress_rule" "fleet_manager" {
		28 |   security_group_id = aws_security_group.mis_ec2_shared.id
		29 |   cidr_ipv4         = "0.0.0.0/0"
		30 |   ip_protocol       = "tcp"
		31 |   from_port         = 3389
		32 |   to_port           = 3389
		33 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_stage.aws_vpc_security_group_ingress_rule.fleet_manager
	File: /modules/mis_environment/sg_shared.tf:27-33
	Calling File: /main_preproduction.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		27 | resource "aws_vpc_security_group_ingress_rule" "fleet_manager" {
		28 |   security_group_id = aws_security_group.mis_ec2_shared.id
		29 |   cidr_ipv4         = "0.0.0.0/0"
		30 |   ip_protocol       = "tcp"
		31 |   from_port         = 3389
		32 |   to_port           = 3389
		33 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_stage.aws_vpc_security_group_egress_rule.domain_join
	File: /modules/mis_environment/sg_shared.tf:35-42
	Calling File: /main_preproduction.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		35 | resource "aws_vpc_security_group_egress_rule" "domain_join" {
		36 |   for_each                     = { for port in var.domain_join_ports : "${port.protocol}_${port.from_port}" => port }
		37 |   from_port                    = each.value.from_port
		38 |   to_port                      = each.value.to_port
		39 |   ip_protocol                  = each.value.protocol
		40 |   security_group_id            = aws_security_group.mis_ec2_shared.id
		41 |   referenced_security_group_id = aws_directory_service_directory.mis_ad.security_group_id
		42 | }
Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_stage.aws_vpc_security_group_egress_rule.http_s["80"]
	File: /modules/mis_environment/sg_shared.tf:9-17
	Calling File: /main_preproduction.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		9  | resource "aws_vpc_security_group_egress_rule" "http_s" {
		10 |   for_each = toset(["80", "443"])
		11 | 
		12 |   security_group_id = aws_security_group.mis_ec2_shared.id
		13 |   cidr_ipv4         = "0.0.0.0/0"
		14 |   ip_protocol       = "tcp"
		15 |   from_port         = each.key
		16 |   to_port           = each.key
		17 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: module.environment_dev.s3_bucket_ssm_sessions
	File: /modules/mis_environment/ssm.tf:4-16
	Calling File: /main_development.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		4  | module "s3_bucket_ssm_sessions" {
		5  | 
		6  |   source = "github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.1.0"
		7  | 
		8  |   bucket_prefix      = "${var.account_info.application_name}-${var.env_name}-ssm-sessions"
		9  |   versioning_enabled = false
		10 | 
		11 |   providers = {
		12 |     aws.bucket-replication = aws
		13 |   }
		14 | 
		15 |   tags = var.tags
		16 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: module.environment_preproduction.s3_bucket_ssm_sessions
	File: /modules/mis_environment/ssm.tf:4-16
	Calling File: /main_preproduction.tf:48-88
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		4  | module "s3_bucket_ssm_sessions" {
		5  | 
		6  |   source = "github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.1.0"
		7  | 
		8  |   bucket_prefix      = "${var.account_info.application_name}-${var.env_name}-ssm-sessions"
		9  |   versioning_enabled = false
		10 | 
		11 |   providers = {
		12 |     aws.bucket-replication = aws
		13 |   }
		14 | 
		15 |   tags = var.tags
		16 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: module.environment_stage.s3_bucket_ssm_sessions
	File: /modules/mis_environment/ssm.tf:4-16
	Calling File: /main_preproduction.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		4  | module "s3_bucket_ssm_sessions" {
		5  | 
		6  |   source = "github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.1.0"
		7  | 
		8  |   bucket_prefix      = "${var.account_info.application_name}-${var.env_name}-ssm-sessions"
		9  |   versioning_enabled = false
		10 | 
		11 |   providers = {
		12 |     aws.bucket-replication = aws
		13 |   }
		14 | 
		15 |   tags = var.tags
		16 | }

Check: CKV_AWS_337: "Ensure SSM parameters are using KMS CMK"
	FAILED for resource: aws_ssm_parameter.hmpps_bot_priv_key
	File: /ssm.tf:6-16
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-337

		6  | resource "aws_ssm_parameter" "hmpps_bot_priv_key" {
		7  |   name  = "/github/hmpps_bot_priv_key"
		8  |   type  = "SecureString"
		9  |   value = "INITIAL_VALUE_OVERRIDDEN"
		10 |   lifecycle {
		11 |     ignore_changes = [
		12 |       value
		13 |     ]
		14 |   }
		15 |   tags = local.tags
		16 | }

Check: CKV_AWS_337: "Ensure SSM parameters are using KMS CMK"
	FAILED for resource: aws_ssm_parameter.hmpps_bot_installation_id
	File: /ssm.tf:18-28
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-337

		18 | resource "aws_ssm_parameter" "hmpps_bot_installation_id" {
		19 |   name  = "/github/hmpps_bot_installation_id"
		20 |   type  = "SecureString"
		21 |   value = "INITIAL_VALUE_OVERRIDDEN"
		22 |   lifecycle {
		23 |     ignore_changes = [
		24 |       value
		25 |     ]
		26 |   }
		27 |   tags = local.tags
		28 | }

Check: CKV_AWS_337: "Ensure SSM parameters are using KMS CMK"
	FAILED for resource: aws_ssm_parameter.hmpps_bot_app_id
	File: /ssm.tf:30-40
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-337

		30 | resource "aws_ssm_parameter" "hmpps_bot_app_id" {
		31 |   name  = "/github/hmpps_bot_app_id"
		32 |   type  = "SecureString"
		33 |   value = "INITIAL_VALUE_OVERRIDDEN"
		34 |   lifecycle {
		35 |     ignore_changes = [
		36 |       value
		37 |     ]
		38 |   }
		39 |   tags = local.tags
		40 | }
Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: module.environment_dev.module.oracle_db_shared["dsd-db"].s3_bucket_oracledb_backups_inventory
	File: /../delius-core/modules/components/oracle_db_shared/s3.tf:189-227
	Calling File: /modules/mis_environment/databases.tf:13-42
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		189 | module "s3_bucket_oracledb_backups_inventory" {
		190 |   source              = "github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.1.0"
		191 |   bucket_name         = "${local.oracle_backup_bucket_prefix}-inventory"
		192 |   versioning_enabled  = false
		193 |   ownership_controls  = "BucketOwnerEnforced"
		194 |   replication_enabled = false
		195 |   custom_kms_key      = var.account_config.kms_keys.general_shared
		196 |   bucket_policy       = [data.aws_iam_policy_document.oracledb_backups_inventory.json]
		197 | 
		198 |   providers = {
		199 |     aws.bucket-replication = aws.bucket-replication
		200 |   }
		201 | 
		202 |   lifecycle_rule = [
		203 |     {
		204 |       id      = "main"
		205 |       enabled = "Enabled"
		206 |       prefix  = ""
		207 | 
		208 |       tags = {
		209 |         rule      = "log"
		210 |         autoclean = "true"
		211 |       }
		212 | 
		213 |       transition = [
		214 |         {
		215 |           days          = 90
		216 |           storage_class = "STANDARD_IA"
		217 |         }
		218 |       ]
		219 | 
		220 |       expiration = {
		221 |         days = 365
		222 |       }
		223 |     }
		224 |   ]
		225 | 
		226 |   tags = var.tags
		227 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: module.environment_dev.module.oracle_db_shared["mis-db"].s3_bucket_oracledb_backups_inventory
	File: /../delius-core/modules/components/oracle_db_shared/s3.tf:189-227
	Calling File: /modules/mis_environment/databases.tf:13-42
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		189 | module "s3_bucket_oracledb_backups_inventory" {
		190 |   source              = "github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.1.0"
		191 |   bucket_name         = "${local.oracle_backup_bucket_prefix}-inventory"
		192 |   versioning_enabled  = false
		193 |   ownership_controls  = "BucketOwnerEnforced"
		194 |   replication_enabled = false
		195 |   custom_kms_key      = var.account_config.kms_keys.general_shared
		196 |   bucket_policy       = [data.aws_iam_policy_document.oracledb_backups_inventory.json]
		197 | 
		198 |   providers = {
		199 |     aws.bucket-replication = aws.bucket-replication
		200 |   }
		201 | 
		202 |   lifecycle_rule = [
		203 |     {
		204 |       id      = "main"
		205 |       enabled = "Enabled"
		206 |       prefix  = ""
		207 | 
		208 |       tags = {
		209 |         rule      = "log"
		210 |         autoclean = "true"
		211 |       }
		212 | 
		213 |       transition = [
		214 |         {
		215 |           days          = 90
		216 |           storage_class = "STANDARD_IA"
		217 |         }
		218 |       ]
		219 | 
		220 |       expiration = {
		221 |         days = 365
		222 |       }
		223 |     }
		224 |   ]
		225 | 
		226 |   tags = var.tags
		227 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: module.environment_stage.module.oracle_db_shared["dsd-db"].s3_bucket_oracledb_backups_inventory
	File: /../delius-core/modules/components/oracle_db_shared/s3.tf:189-227
	Calling File: /modules/mis_environment/databases.tf:13-42
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		189 | module "s3_bucket_oracledb_backups_inventory" {
		190 |   source              = "github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.1.0"
		191 |   bucket_name         = "${local.oracle_backup_bucket_prefix}-inventory"
		192 |   versioning_enabled  = false
		193 |   ownership_controls  = "BucketOwnerEnforced"
		194 |   replication_enabled = false
		195 |   custom_kms_key      = var.account_config.kms_keys.general_shared
		196 |   bucket_policy       = [data.aws_iam_policy_document.oracledb_backups_inventory.json]
		197 | 
		198 |   providers = {
		199 |     aws.bucket-replication = aws.bucket-replication
		200 |   }
		201 | 
		202 |   lifecycle_rule = [
		203 |     {
		204 |       id      = "main"
		205 |       enabled = "Enabled"
		206 |       prefix  = ""
		207 | 
		208 |       tags = {
		209 |         rule      = "log"
		210 |         autoclean = "true"
		211 |       }
		212 | 
		213 |       transition = [
		214 |         {
		215 |           days          = 90
		216 |           storage_class = "STANDARD_IA"
		217 |         }
		218 |       ]
		219 | 
		220 |       expiration = {
		221 |         days = 365
		222 |       }
		223 |     }
		224 |   ]
		225 | 
		226 |   tags = var.tags
		227 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: module.environment_stage.module.oracle_db_shared["mis-db"].s3_bucket_oracledb_backups_inventory
	File: /../delius-core/modules/components/oracle_db_shared/s3.tf:189-227
	Calling File: /modules/mis_environment/databases.tf:13-42
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		189 | module "s3_bucket_oracledb_backups_inventory" {
		190 |   source              = "github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.1.0"
		191 |   bucket_name         = "${local.oracle_backup_bucket_prefix}-inventory"
		192 |   versioning_enabled  = false
		193 |   ownership_controls  = "BucketOwnerEnforced"
		194 |   replication_enabled = false
		195 |   custom_kms_key      = var.account_config.kms_keys.general_shared
		196 |   bucket_policy       = [data.aws_iam_policy_document.oracledb_backups_inventory.json]
		197 | 
		198 |   providers = {
		199 |     aws.bucket-replication = aws.bucket-replication
		200 |   }
		201 | 
		202 |   lifecycle_rule = [
		203 |     {
		204 |       id      = "main"
		205 |       enabled = "Enabled"
		206 |       prefix  = ""
		207 | 
		208 |       tags = {
		209 |         rule      = "log"
		210 |         autoclean = "true"
		211 |       }
		212 | 
		213 |       transition = [
		214 |         {
		215 |           days          = 90
		216 |           storage_class = "STANDARD_IA"
		217 |         }
		218 |       ]
		219 | 
		220 |       expiration = {
		221 |         days = 365
		222 |       }
		223 |     }
		224 |   ]
		225 | 
		226 |   tags = var.tags
		227 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: module.environment_preproduction.module.oracle_db_shared["dsd-db"].s3_bucket_oracledb_backups_inventory
	File: /../delius-core/modules/components/oracle_db_shared/s3.tf:189-227
	Calling File: /modules/mis_environment/databases.tf:13-42
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		189 | module "s3_bucket_oracledb_backups_inventory" {
		190 |   source              = "github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.1.0"
		191 |   bucket_name         = "${local.oracle_backup_bucket_prefix}-inventory"
		192 |   versioning_enabled  = false
		193 |   ownership_controls  = "BucketOwnerEnforced"
		194 |   replication_enabled = false
		195 |   custom_kms_key      = var.account_config.kms_keys.general_shared
		196 |   bucket_policy       = [data.aws_iam_policy_document.oracledb_backups_inventory.json]
		197 | 
		198 |   providers = {
		199 |     aws.bucket-replication = aws.bucket-replication
		200 |   }
		201 | 
		202 |   lifecycle_rule = [
		203 |     {
		204 |       id      = "main"
		205 |       enabled = "Enabled"
		206 |       prefix  = ""
		207 | 
		208 |       tags = {
		209 |         rule      = "log"
		210 |         autoclean = "true"
		211 |       }
		212 | 
		213 |       transition = [
		214 |         {
		215 |           days          = 90
		216 |           storage_class = "STANDARD_IA"
		217 |         }
		218 |       ]
		219 | 
		220 |       expiration = {
		221 |         days = 365
		222 |       }
		223 |     }
		224 |   ]
		225 | 
		226 |   tags = var.tags
		227 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: module.environment_preproduction.module.oracle_db_shared["mis-db"].s3_bucket_oracledb_backups_inventory
	File: /../delius-core/modules/components/oracle_db_shared/s3.tf:189-227
	Calling File: /modules/mis_environment/databases.tf:13-42
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		189 | module "s3_bucket_oracledb_backups_inventory" {
		190 |   source              = "github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.1.0"
		191 |   bucket_name         = "${local.oracle_backup_bucket_prefix}-inventory"
		192 |   versioning_enabled  = false
		193 |   ownership_controls  = "BucketOwnerEnforced"
		194 |   replication_enabled = false
		195 |   custom_kms_key      = var.account_config.kms_keys.general_shared
		196 |   bucket_policy       = [data.aws_iam_policy_document.oracledb_backups_inventory.json]
		197 | 
		198 |   providers = {
		199 |     aws.bucket-replication = aws.bucket-replication
		200 |   }
		201 | 
		202 |   lifecycle_rule = [
		203 |     {
		204 |       id      = "main"
		205 |       enabled = "Enabled"
		206 |       prefix  = ""
		207 | 
		208 |       tags = {
		209 |         rule      = "log"
		210 |         autoclean = "true"
		211 |       }
		212 | 
		213 |       transition = [
		214 |         {
		215 |           days          = 90
		216 |           storage_class = "STANDARD_IA"
		217 |         }
		218 |       ]
		219 | 
		220 |       expiration = {
		221 |         days = 365
		222 |       }
		223 |     }
		224 |   ]
		225 | 
		226 |   tags = var.tags
		227 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: module.environment_dev.aws_secretsmanager_secret.ad_admin_password
	File: /modules/mis_environment/directory_service.tf:29-39
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		29 | resource "aws_secretsmanager_secret" "ad_admin_password" {
		30 |   name                    = "${var.app_name}-${var.env_name}-ad-admin-password"
		31 |   recovery_window_in_days = 0
		32 | 
		33 |   tags = merge(
		34 |     var.tags,
		35 |     {
		36 |       Name = "${var.app_name}-${var.env_name}-ad-admin-password"
		37 |     }
		38 |   )
		39 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: module.environment_preproduction.aws_secretsmanager_secret.ad_admin_password
	File: /modules/mis_environment/directory_service.tf:29-39
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		29 | resource "aws_secretsmanager_secret" "ad_admin_password" {
		30 |   name                    = "${var.app_name}-${var.env_name}-ad-admin-password"
		31 |   recovery_window_in_days = 0
		32 | 
		33 |   tags = merge(
		34 |     var.tags,
		35 |     {
		36 |       Name = "${var.app_name}-${var.env_name}-ad-admin-password"
		37 |     }
		38 |   )
		39 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: module.environment_stage.aws_secretsmanager_secret.ad_admin_password
	File: /modules/mis_environment/directory_service.tf:29-39
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		29 | resource "aws_secretsmanager_secret" "ad_admin_password" {
		30 |   name                    = "${var.app_name}-${var.env_name}-ad-admin-password"
		31 |   recovery_window_in_days = 0
		32 | 
		33 |   tags = merge(
		34 |     var.tags,
		35 |     {
		36 |       Name = "${var.app_name}-${var.env_name}-ad-admin-password"
		37 |     }
		38 |   )
		39 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: module.environment_dev.aws_secretsmanager_secret.ad_username
	File: /modules/mis_environment/secrets.tf:3-9
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		3 | resource "aws_secretsmanager_secret" "ad_username" {
		4 |   #checkov:skip=CKV_AWS_149 "ignore"
		5 |   name                    = "${var.env_name}-legacy-ad-username"
		6 |   recovery_window_in_days = 0
		7 | 
		8 |   tags = var.tags
		9 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: module.environment_dev.aws_secretsmanager_secret.ad_password
	File: /modules/mis_environment/secrets.tf:12-18
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		12 | resource "aws_secretsmanager_secret" "ad_password" {
		13 |   #checkov:skip=CKV_AWS_149 "ignore"
		14 |   name                    = "${var.env_name}-legacy-ad-password"
		15 |   recovery_window_in_days = 0
		16 | 
		17 |   tags = var.tags
		18 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: module.environment_preproduction.aws_secretsmanager_secret.ad_username
	File: /modules/mis_environment/secrets.tf:3-9
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		3 | resource "aws_secretsmanager_secret" "ad_username" {
		4 |   #checkov:skip=CKV_AWS_149 "ignore"
		5 |   name                    = "${var.env_name}-legacy-ad-username"
		6 |   recovery_window_in_days = 0
		7 | 
		8 |   tags = var.tags
		9 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: module.environment_preproduction.aws_secretsmanager_secret.ad_password
	File: /modules/mis_environment/secrets.tf:12-18
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		12 | resource "aws_secretsmanager_secret" "ad_password" {
		13 |   #checkov:skip=CKV_AWS_149 "ignore"
		14 |   name                    = "${var.env_name}-legacy-ad-password"
		15 |   recovery_window_in_days = 0
		16 | 
		17 |   tags = var.tags
		18 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: module.environment_stage.aws_secretsmanager_secret.ad_username
	File: /modules/mis_environment/secrets.tf:3-9
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		3 | resource "aws_secretsmanager_secret" "ad_username" {
		4 |   #checkov:skip=CKV_AWS_149 "ignore"
		5 |   name                    = "${var.env_name}-legacy-ad-username"
		6 |   recovery_window_in_days = 0
		7 | 
		8 |   tags = var.tags
		9 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: module.environment_stage.aws_secretsmanager_secret.ad_password
	File: /modules/mis_environment/secrets.tf:12-18
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		12 | resource "aws_secretsmanager_secret" "ad_password" {
		13 |   #checkov:skip=CKV_AWS_149 "ignore"
		14 |   name                    = "${var.env_name}-legacy-ad-password"
		15 |   recovery_window_in_days = 0
		16 | 
		17 |   tags = var.tags
		18 | }

Check: CKV2_AWS_23: "Route53 A Record has Attached Resource"
	FAILED for resource: module.environment_dev.module.oracle_db_boe.aws_route53_record.db_ec2_instance_public
	File: /../delius-core/modules/components/oracle_db_instance/dns.tf:10-17
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-route53-a-record-has-an-attached-resource

		10 | resource "aws_route53_record" "db_ec2_instance_public" {
		11 |   provider = aws.core-vpc
		12 |   zone_id = var.account_config.route53_external_zone.zone_id
		13 |   name     = var.db_type == "primary" ? "${var.account_info.application_name}-${var.env_name}-${var.db_suffix}-${var.db_count_index}.${var.account_config.dns_suffix}" : "${var.account_info.application_name}-${var.env_name}-${var.db_suffix}-${var.db_count_index + 1}.${var.account_config.dns_suffix}"
		14 |   type     = "A"
		15 |   ttl      = 60
		16 |   records  = [module.instance.aws_instance.private_ip]
		17 | }

Check: CKV2_AWS_23: "Route53 A Record has Attached Resource"
	FAILED for resource: module.environment_preproduction.module.oracle_db_boe.aws_route53_record.db_ec2_instance_public
	File: /../delius-core/modules/components/oracle_db_instance/dns.tf:10-17
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-route53-a-record-has-an-attached-resource

		10 | resource "aws_route53_record" "db_ec2_instance_public" {
		11 |   provider = aws.core-vpc
		12 |   zone_id = var.account_config.route53_external_zone.zone_id
		13 |   name     = var.db_type == "primary" ? "${var.account_info.application_name}-${var.env_name}-${var.db_suffix}-${var.db_count_index}.${var.account_config.dns_suffix}" : "${var.account_info.application_name}-${var.env_name}-${var.db_suffix}-${var.db_count_index + 1}.${var.account_config.dns_suffix}"
		14 |   type     = "A"
		15 |   ttl      = 60
		16 |   records  = [module.instance.aws_instance.private_ip]
		17 | }

Check: CKV2_AWS_23: "Route53 A Record has Attached Resource"
	FAILED for resource: module.environment_stage.module.oracle_db_boe.aws_route53_record.db_ec2_instance_public
	File: /../delius-core/modules/components/oracle_db_instance/dns.tf:10-17
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-route53-a-record-has-an-attached-resource

		10 | resource "aws_route53_record" "db_ec2_instance_public" {
		11 |   provider = aws.core-vpc
		12 |   zone_id = var.account_config.route53_external_zone.zone_id
		13 |   name     = var.db_type == "primary" ? "${var.account_info.application_name}-${var.env_name}-${var.db_suffix}-${var.db_count_index}.${var.account_config.dns_suffix}" : "${var.account_info.application_name}-${var.env_name}-${var.db_suffix}-${var.db_count_index + 1}.${var.account_config.dns_suffix}"
		14 |   type     = "A"
		15 |   ttl      = 60
		16 |   records  = [module.instance.aws_instance.private_ip]
		17 | }

Check: CKV2_AWS_23: "Route53 A Record has Attached Resource"
	FAILED for resource: module.environment_dev.module.oracle_db_dsd.aws_route53_record.db_ec2_instance_public
	File: /../delius-core/modules/components/oracle_db_instance/dns.tf:10-17
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-route53-a-record-has-an-attached-resource

		10 | resource "aws_route53_record" "db_ec2_instance_public" {
		11 |   provider = aws.core-vpc
		12 |   zone_id = var.account_config.route53_external_zone.zone_id
		13 |   name     = var.db_type == "primary" ? "${var.account_info.application_name}-${var.env_name}-${var.db_suffix}-${var.db_count_index}.${var.account_config.dns_suffix}" : "${var.account_info.application_name}-${var.env_name}-${var.db_suffix}-${var.db_count_index + 1}.${var.account_config.dns_suffix}"
		14 |   type     = "A"
		15 |   ttl      = 60
		16 |   records  = [module.instance.aws_instance.private_ip]
		17 | }

Check: CKV2_AWS_23: "Route53 A Record has Attached Resource"
	FAILED for resource: module.environment_preproduction.module.oracle_db_dsd.aws_route53_record.db_ec2_instance_public
	File: /../delius-core/modules/components/oracle_db_instance/dns.tf:10-17
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-route53-a-record-has-an-attached-resource

		10 | resource "aws_route53_record" "db_ec2_instance_public" {
		11 |   provider = aws.core-vpc
		12 |   zone_id = var.account_config.route53_external_zone.zone_id
		13 |   name     = var.db_type == "primary" ? "${var.account_info.application_name}-${var.env_name}-${var.db_suffix}-${var.db_count_index}.${var.account_config.dns_suffix}" : "${var.account_info.application_name}-${var.env_name}-${var.db_suffix}-${var.db_count_index + 1}.${var.account_config.dns_suffix}"
		14 |   type     = "A"
		15 |   ttl      = 60
		16 |   records  = [module.instance.aws_instance.private_ip]
		17 | }

Check: CKV2_AWS_23: "Route53 A Record has Attached Resource"
	FAILED for resource: module.environment_stage.module.oracle_db_dsd.aws_route53_record.db_ec2_instance_public
	File: /../delius-core/modules/components/oracle_db_instance/dns.tf:10-17
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-route53-a-record-has-an-attached-resource

		10 | resource "aws_route53_record" "db_ec2_instance_public" {
		11 |   provider = aws.core-vpc
		12 |   zone_id = var.account_config.route53_external_zone.zone_id
		13 |   name     = var.db_type == "primary" ? "${var.account_info.application_name}-${var.env_name}-${var.db_suffix}-${var.db_count_index}.${var.account_config.dns_suffix}" : "${var.account_info.application_name}-${var.env_name}-${var.db_suffix}-${var.db_count_index + 1}.${var.account_config.dns_suffix}"
		14 |   type     = "A"
		15 |   ttl      = 60
		16 |   records  = [module.instance.aws_instance.private_ip]
		17 | }

Check: CKV2_AWS_23: "Route53 A Record has Attached Resource"
	FAILED for resource: module.environment_dev.module.oracle_db_mis.aws_route53_record.db_ec2_instance_public
	File: /../delius-core/modules/components/oracle_db_instance/dns.tf:10-17
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-route53-a-record-has-an-attached-resource

		10 | resource "aws_route53_record" "db_ec2_instance_public" {
		11 |   provider = aws.core-vpc
		12 |   zone_id = var.account_config.route53_external_zone.zone_id
		13 |   name     = var.db_type == "primary" ? "${var.account_info.application_name}-${var.env_name}-${var.db_suffix}-${var.db_count_index}.${var.account_config.dns_suffix}" : "${var.account_info.application_name}-${var.env_name}-${var.db_suffix}-${var.db_count_index + 1}.${var.account_config.dns_suffix}"
		14 |   type     = "A"
		15 |   ttl      = 60
		16 |   records  = [module.instance.aws_instance.private_ip]
		17 | }

Check: CKV2_AWS_23: "Route53 A Record has Attached Resource"
	FAILED for resource: module.environment_preproduction.module.oracle_db_mis.aws_route53_record.db_ec2_instance_public
	File: /../delius-core/modules/components/oracle_db_instance/dns.tf:10-17
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-route53-a-record-has-an-attached-resource

		10 | resource "aws_route53_record" "db_ec2_instance_public" {
		11 |   provider = aws.core-vpc
		12 |   zone_id = var.account_config.route53_external_zone.zone_id
		13 |   name     = var.db_type == "primary" ? "${var.account_info.application_name}-${var.env_name}-${var.db_suffix}-${var.db_count_index}.${var.account_config.dns_suffix}" : "${var.account_info.application_name}-${var.env_name}-${var.db_suffix}-${var.db_count_index + 1}.${var.account_config.dns_suffix}"
		14 |   type     = "A"
		15 |   ttl      = 60
		16 |   records  = [module.instance.aws_instance.private_ip]
		17 | }

Check: CKV2_AWS_23: "Route53 A Record has Attached Resource"
	FAILED for resource: module.environment_stage.module.oracle_db_mis.aws_route53_record.db_ec2_instance_public
	File: /../delius-core/modules/components/oracle_db_instance/dns.tf:10-17
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-route53-a-record-has-an-attached-resource

		10 | resource "aws_route53_record" "db_ec2_instance_public" {
		11 |   provider = aws.core-vpc
		12 |   zone_id = var.account_config.route53_external_zone.zone_id
		13 |   name     = var.db_type == "primary" ? "${var.account_info.application_name}-${var.env_name}-${var.db_suffix}-${var.db_count_index}.${var.account_config.dns_suffix}" : "${var.account_info.application_name}-${var.env_name}-${var.db_suffix}-${var.db_count_index + 1}.${var.account_config.dns_suffix}"
		14 |   type     = "A"
		15 |   ttl      = 60
		16 |   records  = [module.instance.aws_instance.private_ip]
		17 | }


checkov_exitcode=3

`CTFLint Scan` Failed

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
terraform/environments/delius-core/modules/components/oracle_db_instance
terraform/environments/delius-core/modules/components/oracle_db_shared
terraform/environments/delius-mis

*****************************

Running tflint in terraform/environments/delius-core/modules/components/oracle_db_instance
Excluding the following checks: terraform_unused_declarations
4 issue(s) found:

Warning: Duplicate key: "datapoints_to_alarm", first defined at terraform/environments/delius-core/modules/components/oracle_db_instance/locals.tf:49,9-28 (terraform_map_duplicate_keys)

  on terraform/environments/delius-core/modules/components/oracle_db_instance/locals.tf line 55:
  55:         datapoints_to_alarm = "10"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_map_duplicate_keys.md

Warning: Duplicate key: "evaluation_periods", first defined at terraform/environments/delius-core/modules/components/oracle_db_instance/locals.tf:48,9-27 (terraform_map_duplicate_keys)

  on terraform/environments/delius-core/modules/components/oracle_db_instance/locals.tf line 56:
  56:         evaluation_periods  = "10"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_map_duplicate_keys.md

Warning: `server_type_tag` variable has no type (terraform_typed_variables)

  on terraform/environments/delius-core/modules/components/oracle_db_instance/variables.tf line 36:
  36: variable "server_type_tag" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_typed_variables.md

Warning: `database_tag_prefix` variable has no type (terraform_typed_variables)

  on terraform/environments/delius-core/modules/components/oracle_db_instance/variables.tf line 41:
  41: variable "database_tag_prefix" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_typed_variables.md

tflint_exitcode=2

*****************************

Running tflint in terraform/environments/delius-core/modules/components/oracle_db_shared
Excluding the following checks: terraform_unused_declarations
7 issue(s) found:

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/delius-core/modules/components/oracle_db_shared/s3.tf line 10:
  10:       "${module.s3_bucket_oracledb_backups.bucket.arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/delius-core/modules/components/oracle_db_shared/s3.tf line 74:
  74:       "${module.s3_bucket_oracledb_backups.bucket.arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/delius-core/modules/components/oracle_db_shared/s3.tf line 87:
  87:       "${module.s3_bucket_oracledb_backups_inventory.bucket.arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/delius-core/modules/components/oracle_db_shared/s3.tf line 126:
 126:         "${module.s3_bucket_oracle_statistics[0].bucket.arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/delius-core/modules/components/oracle_db_shared/s3.tf line 241:
 241:       values   = ["${var.account_info.id}"]

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/delius-core/modules/components/oracle_db_shared/s3.tf line 253:
 253:       values   = ["${module.s3_bucket_oracledb_backups.bucket.arn}"]

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/delius-core/modules/components/oracle_db_shared/s3.tf line 294:
 294:     resources = ["${module.s3_bucket_oracle_statistics[0].bucket.arn}"]

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

tflint_exitcode=4

*****************************

Running tflint in terraform/environments/delius-mis
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=4

`Trivy Scan` Success

Show Output

*****************************

Trivy will check the following folders:
terraform/environments/delius-core/modules/components/oracle_db_instance
terraform/environments/delius-core/modules/components/oracle_db_shared
terraform/environments/delius-mis

*****************************

Running Trivy in terraform/environments/delius-core/modules/components/oracle_db_instance
2025-01-09T16:26:31Z	INFO	[vulndb] Need to update DB
2025-01-09T16:26:31Z	INFO	[vulndb] Downloading vulnerability DB...
2025-01-09T16:26:31Z	INFO	[vulndb] Downloading artifact...	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-09T16:26:34Z	INFO	[vulndb] Artifact successfully downloaded	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-09T16:26:34Z	INFO	[vuln] Vulnerability scanning is enabled
2025-01-09T16:26:34Z	INFO	[misconfig] Misconfiguration scanning is enabled
2025-01-09T16:26:34Z	INFO	[misconfig] Need to update the built-in checks
2025-01-09T16:26:34Z	INFO	[misconfig] Downloading the built-in checks...
160.80 KiB / 160.80 KiB [---------------------------------------------------------] 100.00% ? p/s 0s2025-01-09T16:26:34Z	INFO	[secret] Secret scanning is enabled
2025-01-09T16:26:34Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-09T16:26:34Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-09T16:26:35Z	INFO	[terraform scanner] Scanning root module	file_path="."
2025-01-09T16:26:35Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="account_config, account_info, availability_zone, db_ami, ebs_volume_config, ebs_volumes, ec2_key_pair_name, env_name, environment_config, instance_profile_policies, security_group_ids, sns_topic_arn, ssh_keys_bucket_name, subnet_id, tags, user_data"
2025-01-09T16:26:36Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.instance.aws_ebs_volume.this" value="cty.NilVal"
2025-01-09T16:26:36Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.instance.aws_instance.this" err="2 errors occurred:\n\t* invalid for-each in aws_instance.this.dynamic.ephemeral_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_instance.this.dynamic.ebs_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-09T16:26:36Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.instance.aws_instance.this" err="2 errors occurred:\n\t* invalid for-each in aws_instance.this.dynamic.ephemeral_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_instance.this.dynamic.ebs_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-09T16:26:36Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-enforce-http-token-imds" range="github.com/ministryofjustice/modernisation-platform-terraform-ec2-instance?ref=20622418aa13871c279c12d9ae5e98f29c9a46f0/main.tf:22"
2025-01-09T16:26:36Z	INFO	Number of language-specific files	num=0
2025-01-09T16:26:36Z	INFO	Detected config files	num=2
trivy_exitcode=0

*****************************

Running Trivy in terraform/environments/delius-core/modules/components/oracle_db_shared
2025-01-09T16:26:36Z	INFO	[vuln] Vulnerability scanning is enabled
2025-01-09T16:26:36Z	INFO	[misconfig] Misconfiguration scanning is enabled
2025-01-09T16:26:36Z	INFO	[secret] Secret scanning is enabled
2025-01-09T16:26:36Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-09T16:26:36Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-09T16:26:37Z	INFO	[terraform scanner] Scanning root module	file_path="."
2025-01-09T16:26:37Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="account_config, account_info, bastion_sg_id, env_name, environment_config, instance_roles, platform_vars, public_keys, tags"
2025-01-09T16:26:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_s3_object.user_public_keys" value="cty.NilVal"
2025-01-09T16:26:39Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-public-egress-sgr" range="sg.tf:16"
2025-01-09T16:26:39Z	INFO	Number of language-specific files	num=0
2025-01-09T16:26:39Z	INFO	Detected config files	num=4
trivy_exitcode=0

*****************************

Running Trivy in terraform/environments/delius-mis
2025-01-09T16:26:39Z	INFO	[vuln] Vulnerability scanning is enabled
2025-01-09T16:26:39Z	INFO	[misconfig] Misconfiguration scanning is enabled
2025-01-09T16:26:39Z	INFO	[secret] Secret scanning is enabled
2025-01-09T16:26:39Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-09T16:26:39Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-09T16:26:40Z	INFO	[terraform scanner] Scanning root module	file_path="."
2025-01-09T16:26:40Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="networking"
2025-01-09T16:26:41Z	INFO	Number of language-specific files	num=0
2025-01-09T16:26:41Z	INFO	Detected config files	num=1
trivy_exitcode=0

github-actions · 2025-01-09T17:04:04Z

`Trivy Scan` Success

Show Output

```hcl

Trivy will check the following folders:
terraform/environments/delius-core/modules/components/oracle_db_instance
terraform/environments/delius-core/modules/components/oracle_db_shared
terraform/environments/delius-mis

Running Trivy in terraform/environments/delius-core/modules/components/oracle_db_instance
2025-01-09T17:03:24Z INFO [vulndb] Need to update DB
2025-01-09T17:03:24Z INFO [vulndb] Downloading vulnerability DB...
2025-01-09T17:03:24Z INFO [vulndb] Downloading artifact... repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-09T17:03:26Z INFO [vulndb] Artifact successfully downloaded repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-09T17:03:26Z INFO [vuln] Vulnerability scanning is enabled
2025-01-09T17:03:26Z INFO [misconfig] Misconfiguration scanning is enabled
2025-01-09T17:03:26Z INFO [misconfig] Need to update the built-in checks
2025-01-09T17:03:26Z INFO [misconfig] Downloading the built-in checks...
160.80 KiB / 160.80 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2025-01-09T17:03:26Z INFO [secret] Secret scanning is enabled
2025-01-09T17:03:26Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-09T17:03:26Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-09T17:03:28Z INFO [terraform scanner] Scanning root module file_path="."
2025-01-09T17:03:28Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="account_config, account_info, availability_zone, db_ami, ebs_volume_config, ebs_volumes, ec2_key_pair_name, env_name, environment_config, instance_profile_policies, security_group_ids, sns_topic_arn, ssh_keys_bucket_name, subnet_id, tags, user_data"
2025-01-09T17:03:28Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.instance.aws_ebs_volume.this" value="cty.NilVal"
2025-01-09T17:03:28Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.instance.aws_instance.this" err="2 errors occurred:\n\t* invalid for-each in aws_instance.this.dynamic.ephemeral_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_instance.this.dynamic.ebs_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-09T17:03:28Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.instance.aws_instance.this" err="2 errors occurred:\n\t* invalid for-each in aws_instance.this.dynamic.ephemeral_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_instance.this.dynamic.ebs_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-09T17:03:28Z INFO [terraform executor] Ignore finding rule="aws-ec2-enforce-http-token-imds" range="github.com/ministryofjustice/modernisation-platform-terraform-ec2-instance?ref=20622418aa13871c279c12d9ae5e98f29c9a46f0/main.tf:22"
2025-01-09T17:03:28Z INFO Number of language-specific files num=0
2025-01-09T17:03:28Z INFO Detected config files num=2
trivy_exitcode=0

Running Trivy in terraform/environments/delius-core/modules/components/oracle_db_shared
2025-01-09T17:03:28Z INFO [vuln] Vulnerability scanning is enabled
2025-01-09T17:03:28Z INFO [misconfig] Misconfiguration scanning is enabled
2025-01-09T17:03:28Z INFO [secret] Secret scanning is enabled
2025-01-09T17:03:28Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-09T17:03:28Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-09T17:03:30Z INFO [terraform scanner] Scanning root module file_path="."
2025-01-09T17:03:30Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="account_config, account_info, bastion_sg_id, env_name, environment_config, instance_roles, platform_vars, public_keys, tags"
2025-01-09T17:03:30Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_s3_object.user_public_keys" value="cty.NilVal"
2025-01-09T17:03:30Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_vpc_security_group_egress_rule.db_ec2_instance_legacy_oracle" value="cty.NilVal"
2025-01-09T17:03:30Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_vpc_security_group_ingress_rule.db_ec2_instance_legacy_oracle" value="cty.NilVal"
2025-01-09T17:03:34Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-public-egress-sgr" range="sg.tf:16"
2025-01-09T17:03:34Z INFO Number of language-specific files num=0
2025-01-09T17:03:34Z INFO Detected config files num=4
trivy_exitcode=0

Running Trivy in terraform/environments/delius-mis
2025-01-09T17:03:34Z INFO [vuln] Vulnerability scanning is enabled
2025-01-09T17:03:34Z INFO [misconfig] Misconfiguration scanning is enabled
2025-01-09T17:03:34Z INFO [secret] Secret scanning is enabled
2025-01-09T17:03:34Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-09T17:03:34Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-09T17:03:36Z INFO [terraform scanner] Scanning root module file_path="."
2025-01-09T17:03:36Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="networking"
2025-01-09T17:03:36Z INFO Number of language-specific files num=0
2025-01-09T17:03:36Z INFO Detected config files num=1
trivy_exitcode=0

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/delius-core/modules/components/oracle_db_instance
terraform/environments/delius-core/modules/components/oracle_db_shared
terraform/environments/delius-mis

*****************************

Running Checkov in terraform/environments/delius-core/modules/components/oracle_db_instance
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2025-01-09 17:03:39,168 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-ec2-instance?ref=20622418aa13871c279c12d9ae5e98f29c9a46f0:None (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 0, Failed checks: 1, Skipped checks: 2

Check: CKV2_AWS_23: "Route53 A Record has Attached Resource"
	FAILED for resource: aws_route53_record.db_ec2_instance_public
	File: /dns.tf:10-17
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-route53-a-record-has-an-attached-resource

		10 | resource "aws_route53_record" "db_ec2_instance_public" {
		11 |   provider = aws.core-vpc
		12 |   zone_id = var.account_config.route53_external_zone.zone_id
		13 |   name     = var.db_type == "primary" ? "${var.account_info.application_name}-${var.env_name}-${var.db_suffix}-${var.db_count_index}.${var.account_config.dns_suffix}" : "${var.account_info.application_name}-${var.env_name}-${var.db_suffix}-${var.db_count_index + 1}.${var.account_config.dns_suffix}"
		14 |   type     = "A"
		15 |   ttl      = 60
		16 |   records  = [module.instance.aws_instance.private_ip]
		17 | }


checkov_exitcode=1

*****************************

Running Checkov in terraform/environments/delius-core/modules/components/oracle_db_shared
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2025-01-09 17:03:43,310 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.1.0:None (for external modules, the --download-external-modules flag is required)
2025-01-09 17:03:43,310 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0:None (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 245, Failed checks: 1, Skipped checks: 19

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: s3_bucket_oracledb_backups_inventory
	File: /s3.tf:189-227
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		189 | module "s3_bucket_oracledb_backups_inventory" {
		190 |   source              = "github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.1.0"
		191 |   bucket_name         = "${local.oracle_backup_bucket_prefix}-inventory"
		192 |   versioning_enabled  = false
		193 |   ownership_controls  = "BucketOwnerEnforced"
		194 |   replication_enabled = false
		195 |   custom_kms_key      = var.account_config.kms_keys.general_shared
		196 |   bucket_policy       = [data.aws_iam_policy_document.oracledb_backups_inventory.json]
		197 | 
		198 |   providers = {
		199 |     aws.bucket-replication = aws.bucket-replication
		200 |   }
		201 | 
		202 |   lifecycle_rule = [
		203 |     {
		204 |       id      = "main"
		205 |       enabled = "Enabled"
		206 |       prefix  = ""
		207 | 
		208 |       tags = {
		209 |         rule      = "log"
		210 |         autoclean = "true"
		211 |       }
		212 | 
		213 |       transition = [
		214 |         {
		215 |           days          = 90
		216 |           storage_class = "STANDARD_IA"
		217 |         }
		218 |       ]
		219 | 
		220 |       expiration = {
		221 |         days = 365
		222 |       }
		223 |     }
		224 |   ]
		225 | 
		226 |   tags = var.tags
		227 | }


checkov_exitcode=2

*****************************

Running Checkov in terraform/environments/delius-mis
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2025-01-09 17:03:47,118 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=c918b2189d9f81d224e07e98fa1bc9ff38e4ba12:None (for external modules, the --download-external-modules flag is required)
2025-01-09 17:03:47,118 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.1.0:None (for external modules, the --download-external-modules flag is required)
2025-01-09 17:03:47,118 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-ec2-instance?ref=49e289239aec2845924f00fc5969f35ae76122e2:None (for external modules, the --download-external-modules flag is required)
2025-01-09 17:03:47,118 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-pagerduty-integration?ref=v2.0.0:None (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 3657, Failed checks: 84, Skipped checks: 240

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: module.environment_dev.module.oracle_db_shared["mis-db"].s3_bucket_oracledb_backups_inventory
	File: /../delius-core/modules/components/oracle_db_shared/s3.tf:189-227
	Calling File: /modules/mis_environment/databases.tf:13-42
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		189 | module "s3_bucket_oracledb_backups_inventory" {
		190 |   source              = "github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.1.0"
		191 |   bucket_name         = "${local.oracle_backup_bucket_prefix}-inventory"
		192 |   versioning_enabled  = false
		193 |   ownership_controls  = "BucketOwnerEnforced"
		194 |   replication_enabled = false
		195 |   custom_kms_key      = var.account_config.kms_keys.general_shared
		196 |   bucket_policy       = [data.aws_iam_policy_document.oracledb_backups_inventory.json]
		197 | 
		198 |   providers = {
		199 |     aws.bucket-replication = aws.bucket-replication
		200 |   }
		201 | 
		202 |   lifecycle_rule = [
		203 |     {
		204 |       id      = "main"
		205 |       enabled = "Enabled"
		206 |       prefix  = ""
		207 | 
		208 |       tags = {
		209 |         rule      = "log"
		210 |         autoclean = "true"
		211 |       }
		212 | 
		213 |       transition = [
		214 |         {
		215 |           days          = 90
		216 |           storage_class = "STANDARD_IA"
		217 |         }
		218 |       ]
		219 | 
		220 |       expiration = {
		221 |         days = 365
		222 |       }
		223 |     }
		224 |   ]
		225 | 
		226 |   tags = var.tags
		227 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: module.environment_preproduction.module.oracle_db_shared["mis-db"].s3_bucket_oracledb_backups_inventory
	File: /../delius-core/modules/components/oracle_db_shared/s3.tf:189-227
	Calling File: /modules/mis_environment/databases.tf:13-42
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		189 | module "s3_bucket_oracledb_backups_inventory" {
		190 |   source              = "github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.1.0"
		191 |   bucket_name         = "${local.oracle_backup_bucket_prefix}-inventory"
		192 |   versioning_enabled  = false
		193 |   ownership_controls  = "BucketOwnerEnforced"
		194 |   replication_enabled = false
		195 |   custom_kms_key      = var.account_config.kms_keys.general_shared
		196 |   bucket_policy       = [data.aws_iam_policy_document.oracledb_backups_inventory.json]
		197 | 
		198 |   providers = {
		199 |     aws.bucket-replication = aws.bucket-replication
		200 |   }
		201 | 
		202 |   lifecycle_rule = [
		203 |     {
		204 |       id      = "main"
		205 |       enabled = "Enabled"
		206 |       prefix  = ""
		207 | 
		208 |       tags = {
		209 |         rule      = "log"
		210 |         autoclean = "true"
		211 |       }
		212 | 
		213 |       transition = [
		214 |         {
		215 |           days          = 90
		216 |           storage_class = "STANDARD_IA"
		217 |         }
		218 |       ]
		219 | 
		220 |       expiration = {
		221 |         days = 365
		222 |       }
		223 |     }
		224 |   ]
		225 | 
		226 |   tags = var.tags
		227 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: module.environment_stage.module.oracle_db_shared["mis-db"].s3_bucket_oracledb_backups_inventory
	File: /../delius-core/modules/components/oracle_db_shared/s3.tf:189-227
	Calling File: /modules/mis_environment/databases.tf:13-42
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		189 | module "s3_bucket_oracledb_backups_inventory" {
		190 |   source              = "github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.1.0"
		191 |   bucket_name         = "${local.oracle_backup_bucket_prefix}-inventory"
		192 |   versioning_enabled  = false
		193 |   ownership_controls  = "BucketOwnerEnforced"
		194 |   replication_enabled = false
		195 |   custom_kms_key      = var.account_config.kms_keys.general_shared
		196 |   bucket_policy       = [data.aws_iam_policy_document.oracledb_backups_inventory.json]
		197 | 
		198 |   providers = {
		199 |     aws.bucket-replication = aws.bucket-replication
		200 |   }
		201 | 
		202 |   lifecycle_rule = [
		203 |     {
		204 |       id      = "main"
		205 |       enabled = "Enabled"
		206 |       prefix  = ""
		207 | 
		208 |       tags = {
		209 |         rule      = "log"
		210 |         autoclean = "true"
		211 |       }
		212 | 
		213 |       transition = [
		214 |         {
		215 |           days          = 90
		216 |           storage_class = "STANDARD_IA"
		217 |         }
		218 |       ]
		219 | 
		220 |       expiration = {
		221 |         days = 365
		222 |       }
		223 |     }
		224 |   ]
		225 | 
		226 |   tags = var.tags
		227 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_dev.aws_security_group.bcs
	File: /modules/mis_environment/bcs.tf:1-5
	Calling File: /main_development.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		1 | resource "aws_security_group" "bcs" {
		2 |   #checkov:skip=CKV2_AWS_5 "ignore"
		3 |   name_prefix = "${var.env_name}-bcs"
		4 |   vpc_id      = var.account_info.vpc_id
		5 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_preproduction.aws_security_group.bcs
	File: /modules/mis_environment/bcs.tf:1-5
	Calling File: /main_preproduction.tf:48-88
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		1 | resource "aws_security_group" "bcs" {
		2 |   #checkov:skip=CKV2_AWS_5 "ignore"
		3 |   name_prefix = "${var.env_name}-bcs"
		4 |   vpc_id      = var.account_info.vpc_id
		5 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_stage.aws_security_group.bcs
	File: /modules/mis_environment/bcs.tf:1-5
	Calling File: /main_preproduction.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		1 | resource "aws_security_group" "bcs" {
		2 |   #checkov:skip=CKV2_AWS_5 "ignore"
		3 |   name_prefix = "${var.env_name}-bcs"
		4 |   vpc_id      = var.account_info.vpc_id
		5 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_dev.aws_security_group.bps
	File: /modules/mis_environment/bps.tf:1-5
	Calling File: /main_development.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		1 | resource "aws_security_group" "bps" {
		2 |   #checkov:skip=CKV2_AWS_5 "ignore"
		3 |   name_prefix = "${var.env_name}-bps"
		4 |   vpc_id      = var.account_info.vpc_id
		5 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_preproduction.aws_security_group.bps
	File: /modules/mis_environment/bps.tf:1-5
	Calling File: /main_preproduction.tf:48-88
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		1 | resource "aws_security_group" "bps" {
		2 |   #checkov:skip=CKV2_AWS_5 "ignore"
		3 |   name_prefix = "${var.env_name}-bps"
		4 |   vpc_id      = var.account_info.vpc_id
		5 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_stage.aws_security_group.bps
	File: /modules/mis_environment/bps.tf:1-5
	Calling File: /main_preproduction.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		1 | resource "aws_security_group" "bps" {
		2 |   #checkov:skip=CKV2_AWS_5 "ignore"
		3 |   name_prefix = "${var.env_name}-bps"
		4 |   vpc_id      = var.account_info.vpc_id
		5 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_dev.aws_security_group.bws
	File: /modules/mis_environment/bws.tf:1-5
	Calling File: /main_development.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		1 | resource "aws_security_group" "bws" {
		2 |   #checkov:skip=CKV2_AWS_5 "ignore"
		3 |   name_prefix = "${var.env_name}-bws"
		4 |   vpc_id      = var.account_info.vpc_id
		5 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_preproduction.aws_security_group.bws
	File: /modules/mis_environment/bws.tf:1-5
	Calling File: /main_preproduction.tf:48-88
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		1 | resource "aws_security_group" "bws" {
		2 |   #checkov:skip=CKV2_AWS_5 "ignore"
		3 |   name_prefix = "${var.env_name}-bws"
		4 |   vpc_id      = var.account_info.vpc_id
		5 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_stage.aws_security_group.bws
	File: /modules/mis_environment/bws.tf:1-5
	Calling File: /main_preproduction.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		1 | resource "aws_security_group" "bws" {
		2 |   #checkov:skip=CKV2_AWS_5 "ignore"
		3 |   name_prefix = "${var.env_name}-bws"
		4 |   vpc_id      = var.account_info.vpc_id
		5 | }

Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: module.environment_dev.aws_secretsmanager_secret.ad_admin_password
	File: /modules/mis_environment/directory_service.tf:29-39
	Calling File: /main_development.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		29 | resource "aws_secretsmanager_secret" "ad_admin_password" {
		30 |   name                    = "${var.app_name}-${var.env_name}-ad-admin-password"
		31 |   recovery_window_in_days = 0
		32 | 
		33 |   tags = merge(
		34 |     var.tags,
		35 |     {
		36 |       Name = "${var.app_name}-${var.env_name}-ad-admin-password"
		37 |     }
		38 |   )
		39 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: module.environment_dev.aws_cloudwatch_log_group.active_directory
	File: /modules/mis_environment/directory_service.tf:49-52
	Calling File: /main_development.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		49 | resource "aws_cloudwatch_log_group" "active_directory" {
		50 |   name              = "/aws/directoryservice/${aws_directory_service_directory.mis_ad.id}"
		51 |   retention_in_days = 14
		52 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: module.environment_dev.aws_cloudwatch_log_group.active_directory
	File: /modules/mis_environment/directory_service.tf:49-52
	Calling File: /main_development.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		49 | resource "aws_cloudwatch_log_group" "active_directory" {
		50 |   name              = "/aws/directoryservice/${aws_directory_service_directory.mis_ad.id}"
		51 |   retention_in_days = 14
		52 | }

Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: module.environment_preproduction.aws_secretsmanager_secret.ad_admin_password
	File: /modules/mis_environment/directory_service.tf:29-39
	Calling File: /main_preproduction.tf:48-88
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		29 | resource "aws_secretsmanager_secret" "ad_admin_password" {
		30 |   name                    = "${var.app_name}-${var.env_name}-ad-admin-password"
		31 |   recovery_window_in_days = 0
		32 | 
		33 |   tags = merge(
		34 |     var.tags,
		35 |     {
		36 |       Name = "${var.app_name}-${var.env_name}-ad-admin-password"
		37 |     }
		38 |   )
		39 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: module.environment_preproduction.aws_cloudwatch_log_group.active_directory
	File: /modules/mis_environment/directory_service.tf:49-52
	Calling File: /main_preproduction.tf:48-88
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		49 | resource "aws_cloudwatch_log_group" "active_directory" {
		50 |   name              = "/aws/directoryservice/${aws_directory_service_directory.mis_ad.id}"
		51 |   retention_in_days = 14
		52 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: module.environment_preproduction.aws_cloudwatch_log_group.active_directory
	File: /modules/mis_environment/directory_service.tf:49-52
	Calling File: /main_preproduction.tf:48-88
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		49 | resource "aws_cloudwatch_log_group" "active_directory" {
		50 |   name              = "/aws/directoryservice/${aws_directory_service_directory.mis_ad.id}"
		51 |   retention_in_days = 14
		52 | }

Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: module.environment_stage.aws_secretsmanager_secret.ad_admin_password
	File: /modules/mis_environment/directory_service.tf:29-39
	Calling File: /main_preproduction.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		29 | resource "aws_secretsmanager_secret" "ad_admin_password" {
		30 |   name                    = "${var.app_name}-${var.env_name}-ad-admin-password"
		31 |   recovery_window_in_days = 0
		32 | 
		33 |   tags = merge(
		34 |     var.tags,
		35 |     {
		36 |       Name = "${var.app_name}-${var.env_name}-ad-admin-password"
		37 |     }
		38 |   )
		39 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: module.environment_stage.aws_cloudwatch_log_group.active_directory
	File: /modules/mis_environment/directory_service.tf:49-52
	Calling File: /main_preproduction.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		49 | resource "aws_cloudwatch_log_group" "active_directory" {
		50 |   name              = "/aws/directoryservice/${aws_directory_service_directory.mis_ad.id}"
		51 |   retention_in_days = 14
		52 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: module.environment_stage.aws_cloudwatch_log_group.active_directory
	File: /modules/mis_environment/directory_service.tf:49-52
	Calling File: /main_preproduction.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		49 | resource "aws_cloudwatch_log_group" "active_directory" {
		50 |   name              = "/aws/directoryservice/${aws_directory_service_directory.mis_ad.id}"
		51 |   retention_in_days = 14
		52 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_dev.aws_security_group.dis
	File: /modules/mis_environment/dis.tf:1-5
	Calling File: /main_development.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		1 | resource "aws_security_group" "dis" {
		2 |   #checkov:skip=CKV2_AWS_5 "ignore"
		3 |   name_prefix = "${var.env_name}-dis"
		4 |   vpc_id      = var.account_info.vpc_id
		5 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_preproduction.aws_security_group.dis
	File: /modules/mis_environment/dis.tf:1-5
	Calling File: /main_preproduction.tf:48-88
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		1 | resource "aws_security_group" "dis" {
		2 |   #checkov:skip=CKV2_AWS_5 "ignore"
		3 |   name_prefix = "${var.env_name}-dis"
		4 |   vpc_id      = var.account_info.vpc_id
		5 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_stage.aws_security_group.dis
	File: /modules/mis_environment/dis.tf:1-5
	Calling File: /main_preproduction.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		1 | resource "aws_security_group" "dis" {
		2 |   #checkov:skip=CKV2_AWS_5 "ignore"
		3 |   name_prefix = "${var.env_name}-dis"
		4 |   vpc_id      = var.account_info.vpc_id
		5 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: module.environment_dev.pagerduty_core_alerts
	File: /modules/mis_environment/pagerduty.tf:12-21
	Calling File: /main_development.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		12 | module "pagerduty_core_alerts" {
		13 | 
		14 |   depends_on = [
		15 |     aws_sns_topic.delius_mis_alarms
		16 |   ]
		17 | 
		18 |   source                    = "github.com/ministryofjustice/modernisation-platform-terraform-pagerduty-integration?ref=v2.0.0"
		19 |   sns_topics                = [aws_sns_topic.delius_mis_alarms.name]
		20 |   pagerduty_integration_key = var.pagerduty_integration_key
		21 | }

Check: CKV_AWS_26: "Ensure all data stored in the SNS topic is encrypted"
	FAILED for resource: module.environment_dev.aws_sns_topic.delius_mis_alarms
	File: /modules/mis_environment/pagerduty.tf:1-10
	Calling File: /main_development.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-15

		1  | resource "aws_sns_topic" "delius_mis_alarms" {
		2  |   name = "${var.app_name}-${var.env_name}-sns-topic"
		3  | 
		4  |   tags = merge(
		5  |     var.tags,
		6  |     {
		7  |       Name = "${var.app_name}-${var.env_name}-sns-topic"
		8  |     }
		9  |   )
		10 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: module.environment_preproduction.pagerduty_core_alerts
	File: /modules/mis_environment/pagerduty.tf:12-21
	Calling File: /main_preproduction.tf:48-88
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		12 | module "pagerduty_core_alerts" {
		13 | 
		14 |   depends_on = [
		15 |     aws_sns_topic.delius_mis_alarms
		16 |   ]
		17 | 
		18 |   source                    = "github.com/ministryofjustice/modernisation-platform-terraform-pagerduty-integration?ref=v2.0.0"
		19 |   sns_topics                = [aws_sns_topic.delius_mis_alarms.name]
		20 |   pagerduty_integration_key = var.pagerduty_integration_key
		21 | }

Check: CKV_AWS_26: "Ensure all data stored in the SNS topic is encrypted"
	FAILED for resource: module.environment_preproduction.aws_sns_topic.delius_mis_alarms
	File: /modules/mis_environment/pagerduty.tf:1-10
	Calling File: /main_preproduction.tf:48-88
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-15

		1  | resource "aws_sns_topic" "delius_mis_alarms" {
		2  |   name = "${var.app_name}-${var.env_name}-sns-topic"
		3  | 
		4  |   tags = merge(
		5  |     var.tags,
		6  |     {
		7  |       Name = "${var.app_name}-${var.env_name}-sns-topic"
		8  |     }
		9  |   )
		10 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: module.environment_stage.pagerduty_core_alerts
	File: /modules/mis_environment/pagerduty.tf:12-21
	Calling File: /main_preproduction.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		12 | module "pagerduty_core_alerts" {
		13 | 
		14 |   depends_on = [
		15 |     aws_sns_topic.delius_mis_alarms
		16 |   ]
		17 | 
		18 |   source                    = "github.com/ministryofjustice/modernisation-platform-terraform-pagerduty-integration?ref=v2.0.0"
		19 |   sns_topics                = [aws_sns_topic.delius_mis_alarms.name]
		20 |   pagerduty_integration_key = var.pagerduty_integration_key
		21 | }

Check: CKV_AWS_26: "Ensure all data stored in the SNS topic is encrypted"
	FAILED for resource: module.environment_stage.aws_sns_topic.delius_mis_alarms
	File: /modules/mis_environment/pagerduty.tf:1-10
	Calling File: /main_preproduction.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-15

		1  | resource "aws_sns_topic" "delius_mis_alarms" {
		2  |   name = "${var.app_name}-${var.env_name}-sns-topic"
		3  | 
		4  |   tags = merge(
		5  |     var.tags,
		6  |     {
		7  |       Name = "${var.app_name}-${var.env_name}-sns-topic"
		8  |     }
		9  |   )
		10 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_dev.aws_vpc_security_group_ingress_rule.icmp
	File: /modules/mis_environment/sg_legacy.tf:9-15
	Calling File: /main_development.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		9  | resource "aws_vpc_security_group_ingress_rule" "icmp" {
		10 |   security_group_id = aws_security_group.legacy.id
		11 |   cidr_ipv4         = var.environment_config.legacy_counterpart_vpc_cidr
		12 |   ip_protocol       = "icmp"
		13 |   from_port         = -1
		14 |   to_port           = -1
		15 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_dev.aws_vpc_security_group_egress_rule.icmp
	File: /modules/mis_environment/sg_legacy.tf:17-23
	Calling File: /main_development.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		17 | resource "aws_vpc_security_group_egress_rule" "icmp" {
		18 |   security_group_id = aws_security_group.legacy.id
		19 |   cidr_ipv4         = var.environment_config.legacy_counterpart_vpc_cidr
		20 |   ip_protocol       = "icmp"
		21 |   from_port         = -1
		22 |   to_port           = -1
		23 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_preproduction.aws_vpc_security_group_ingress_rule.icmp
	File: /modules/mis_environment/sg_legacy.tf:9-15
	Calling File: /main_preproduction.tf:48-88
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		9  | resource "aws_vpc_security_group_ingress_rule" "icmp" {
		10 |   security_group_id = aws_security_group.legacy.id
		11 |   cidr_ipv4         = var.environment_config.legacy_counterpart_vpc_cidr
		12 |   ip_protocol       = "icmp"
		13 |   from_port         = -1
		14 |   to_port           = -1
		15 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_preproduction.aws_vpc_security_group_egress_rule.icmp
	File: /modules/mis_environment/sg_legacy.tf:17-23
	Calling File: /main_preproduction.tf:48-88
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		17 | resource "aws_vpc_security_group_egress_rule" "icmp" {
		18 |   security_group_id = aws_security_group.legacy.id
		19 |   cidr_ipv4         = var.environment_config.legacy_counterpart_vpc_cidr
		20 |   ip_protocol       = "icmp"
		21 |   from_port         = -1
		22 |   to_port           = -1
		23 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_stage.aws_vpc_security_group_ingress_rule.icmp
	File: /modules/mis_environment/sg_legacy.tf:9-15
	Calling File: /main_preproduction.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		9  | resource "aws_vpc_security_group_ingress_rule" "icmp" {
		10 |   security_group_id = aws_security_group.legacy.id
		11 |   cidr_ipv4         = var.environment_config.legacy_counterpart_vpc_cidr
		12 |   ip_protocol       = "icmp"
		13 |   from_port         = -1
		14 |   to_port           = -1
		15 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_stage.aws_vpc_security_group_egress_rule.icmp
	File: /modules/mis_environment/sg_legacy.tf:17-23
	Calling File: /main_preproduction.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		17 | resource "aws_vpc_security_group_egress_rule" "icmp" {
		18 |   security_group_id = aws_security_group.legacy.id
		19 |   cidr_ipv4         = var.environment_config.legacy_counterpart_vpc_cidr
		20 |   ip_protocol       = "icmp"
		21 |   from_port         = -1
		22 |   to_port           = -1
		23 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_dev.aws_vpc_security_group_egress_rule.http_s["80"]
	File: /modules/mis_environment/sg_shared.tf:9-17
	Calling File: /main_development.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		9  | resource "aws_vpc_security_group_egress_rule" "http_s" {
		10 |   for_each = toset(["80", "443"])
		11 | 
		12 |   security_group_id = aws_security_group.mis_ec2_shared.id
		13 |   cidr_ipv4         = "0.0.0.0/0"
		14 |   ip_protocol       = "tcp"
		15 |   from_port         = each.key
		16 |   to_port           = each.key
		17 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_dev.aws_vpc_security_group_egress_rule.fleet_manager
	File: /modules/mis_environment/sg_shared.tf:19-25
	Calling File: /main_development.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		19 | resource "aws_vpc_security_group_egress_rule" "fleet_manager" {
		20 |   security_group_id = aws_security_group.mis_ec2_shared.id
		21 |   cidr_ipv4         = "0.0.0.0/0"
		22 |   ip_protocol       = "tcp"
		23 |   from_port         = 3389
		24 |   to_port           = 3389
		25 | }

Check: CKV_AWS_25: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389"
	FAILED for resource: module.environment_dev.aws_vpc_security_group_ingress_rule.fleet_manager
	File: /modules/mis_environment/sg_shared.tf:27-33
	Calling File: /main_development.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-2

		27 | resource "aws_vpc_security_group_ingress_rule" "fleet_manager" {
		28 |   security_group_id = aws_security_group.mis_ec2_shared.id
		29 |   cidr_ipv4         = "0.0.0.0/0"
		30 |   ip_protocol       = "tcp"
		31 |   from_port         = 3389
		32 |   to_port           = 3389
		33 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_dev.aws_vpc_security_group_ingress_rule.fleet_manager
	File: /modules/mis_environment/sg_shared.tf:27-33
	Calling File: /main_development.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		27 | resource "aws_vpc_security_group_ingress_rule" "fleet_manager" {
		28 |   security_group_id = aws_security_group.mis_ec2_shared.id
		29 |   cidr_ipv4         = "0.0.0.0/0"
		30 |   ip_protocol       = "tcp"
		31 |   from_port         = 3389
		32 |   to_port           = 3389
		33 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_dev.aws_vpc_security_group_egress_rule.domain_join
	File: /modules/mis_environment/sg_shared.tf:35-42
	Calling File: /main_development.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		35 | resource "aws_vpc_security_group_egress_rule" "domain_join" {
		36 |   for_each                     = { for port in var.domain_join_ports : "${port.protocol}_${port.from_port}" => port }
		37 |   from_port                    = each.value.from_port
		38 |   to_port                      = each.value.to_port
		39 |   ip_protocol                  = each.value.protocol
		40 |   security_group_id            = aws_security_group.mis_ec2_shared.id
		41 |   referenced_security_group_id = aws_directory_service_directory.mis_ad.security_group_id
		42 | }
Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_dev.aws_vpc_security_group_egress_rule.http_s["443"]
	File: /modules/mis_environment/sg_shared.tf:9-17
	Calling File: /main_development.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		9  | resource "aws_vpc_security_group_egress_rule" "http_s" {
		10 |   for_each = toset(["80", "443"])
		11 | 
		12 |   security_group_id = aws_security_group.mis_ec2_shared.id
		13 |   cidr_ipv4         = "0.0.0.0/0"
		14 |   ip_protocol       = "tcp"
		15 |   from_port         = each.key
		16 |   to_port           = each.key
		17 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_preproduction.aws_vpc_security_group_egress_rule.http_s["80"]
	File: /modules/mis_environment/sg_shared.tf:9-17
	Calling File: /main_preproduction.tf:48-88
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		9  | resource "aws_vpc_security_group_egress_rule" "http_s" {
		10 |   for_each = toset(["80", "443"])
		11 | 
		12 |   security_group_id = aws_security_group.mis_ec2_shared.id
		13 |   cidr_ipv4         = "0.0.0.0/0"
		14 |   ip_protocol       = "tcp"
		15 |   from_port         = each.key
		16 |   to_port           = each.key
		17 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_preproduction.aws_vpc_security_group_egress_rule.fleet_manager
	File: /modules/mis_environment/sg_shared.tf:19-25
	Calling File: /main_preproduction.tf:48-88
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		19 | resource "aws_vpc_security_group_egress_rule" "fleet_manager" {
		20 |   security_group_id = aws_security_group.mis_ec2_shared.id
		21 |   cidr_ipv4         = "0.0.0.0/0"
		22 |   ip_protocol       = "tcp"
		23 |   from_port         = 3389
		24 |   to_port           = 3389
		25 | }

Check: CKV_AWS_25: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389"
	FAILED for resource: module.environment_preproduction.aws_vpc_security_group_ingress_rule.fleet_manager
	File: /modules/mis_environment/sg_shared.tf:27-33
	Calling File: /main_preproduction.tf:48-88
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-2

		27 | resource "aws_vpc_security_group_ingress_rule" "fleet_manager" {
		28 |   security_group_id = aws_security_group.mis_ec2_shared.id
		29 |   cidr_ipv4         = "0.0.0.0/0"
		30 |   ip_protocol       = "tcp"
		31 |   from_port         = 3389
		32 |   to_port           = 3389
		33 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_preproduction.aws_vpc_security_group_ingress_rule.fleet_manager
	File: /modules/mis_environment/sg_shared.tf:27-33
	Calling File: /main_preproduction.tf:48-88
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		27 | resource "aws_vpc_security_group_ingress_rule" "fleet_manager" {
		28 |   security_group_id = aws_security_group.mis_ec2_shared.id
		29 |   cidr_ipv4         = "0.0.0.0/0"
		30 |   ip_protocol       = "tcp"
		31 |   from_port         = 3389
		32 |   to_port           = 3389
		33 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_preproduction.aws_vpc_security_group_egress_rule.domain_join
	File: /modules/mis_environment/sg_shared.tf:35-42
	Calling File: /main_preproduction.tf:48-88
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		35 | resource "aws_vpc_security_group_egress_rule" "domain_join" {
		36 |   for_each                     = { for port in var.domain_join_ports : "${port.protocol}_${port.from_port}" => port }
		37 |   from_port                    = each.value.from_port
		38 |   to_port                      = each.value.to_port
		39 |   ip_protocol                  = each.value.protocol
		40 |   security_group_id            = aws_security_group.mis_ec2_shared.id
		41 |   referenced_security_group_id = aws_directory_service_directory.mis_ad.security_group_id
		42 | }
Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_preproduction.aws_vpc_security_group_egress_rule.http_s["443"]
	File: /modules/mis_environment/sg_shared.tf:9-17
	Calling File: /main_preproduction.tf:48-88
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		9  | resource "aws_vpc_security_group_egress_rule" "http_s" {
		10 |   for_each = toset(["80", "443"])
		11 | 
		12 |   security_group_id = aws_security_group.mis_ec2_shared.id
		13 |   cidr_ipv4         = "0.0.0.0/0"
		14 |   ip_protocol       = "tcp"
		15 |   from_port         = each.key
		16 |   to_port           = each.key
		17 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_stage.aws_vpc_security_group_egress_rule.http_s["80"]
	File: /modules/mis_environment/sg_shared.tf:9-17
	Calling File: /main_preproduction.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		9  | resource "aws_vpc_security_group_egress_rule" "http_s" {
		10 |   for_each = toset(["80", "443"])
		11 | 
		12 |   security_group_id = aws_security_group.mis_ec2_shared.id
		13 |   cidr_ipv4         = "0.0.0.0/0"
		14 |   ip_protocol       = "tcp"
		15 |   from_port         = each.key
		16 |   to_port           = each.key
		17 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_stage.aws_vpc_security_group_egress_rule.fleet_manager
	File: /modules/mis_environment/sg_shared.tf:19-25
	Calling File: /main_preproduction.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		19 | resource "aws_vpc_security_group_egress_rule" "fleet_manager" {
		20 |   security_group_id = aws_security_group.mis_ec2_shared.id
		21 |   cidr_ipv4         = "0.0.0.0/0"
		22 |   ip_protocol       = "tcp"
		23 |   from_port         = 3389
		24 |   to_port           = 3389
		25 | }

Check: CKV_AWS_25: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389"
	FAILED for resource: module.environment_stage.aws_vpc_security_group_ingress_rule.fleet_manager
	File: /modules/mis_environment/sg_shared.tf:27-33
	Calling File: /main_preproduction.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-2

		27 | resource "aws_vpc_security_group_ingress_rule" "fleet_manager" {
		28 |   security_group_id = aws_security_group.mis_ec2_shared.id
		29 |   cidr_ipv4         = "0.0.0.0/0"
		30 |   ip_protocol       = "tcp"
		31 |   from_port         = 3389
		32 |   to_port           = 3389
		33 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_stage.aws_vpc_security_group_ingress_rule.fleet_manager
	File: /modules/mis_environment/sg_shared.tf:27-33
	Calling File: /main_preproduction.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		27 | resource "aws_vpc_security_group_ingress_rule" "fleet_manager" {
		28 |   security_group_id = aws_security_group.mis_ec2_shared.id
		29 |   cidr_ipv4         = "0.0.0.0/0"
		30 |   ip_protocol       = "tcp"
		31 |   from_port         = 3389
		32 |   to_port           = 3389
		33 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_stage.aws_vpc_security_group_egress_rule.domain_join
	File: /modules/mis_environment/sg_shared.tf:35-42
	Calling File: /main_preproduction.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		35 | resource "aws_vpc_security_group_egress_rule" "domain_join" {
		36 |   for_each                     = { for port in var.domain_join_ports : "${port.protocol}_${port.from_port}" => port }
		37 |   from_port                    = each.value.from_port
		38 |   to_port                      = each.value.to_port
		39 |   ip_protocol                  = each.value.protocol
		40 |   security_group_id            = aws_security_group.mis_ec2_shared.id
		41 |   referenced_security_group_id = aws_directory_service_directory.mis_ad.security_group_id
		42 | }
Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: module.environment_stage.aws_vpc_security_group_egress_rule.http_s["443"]
	File: /modules/mis_environment/sg_shared.tf:9-17
	Calling File: /main_preproduction.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		9  | resource "aws_vpc_security_group_egress_rule" "http_s" {
		10 |   for_each = toset(["80", "443"])
		11 | 
		12 |   security_group_id = aws_security_group.mis_ec2_shared.id
		13 |   cidr_ipv4         = "0.0.0.0/0"
		14 |   ip_protocol       = "tcp"
		15 |   from_port         = each.key
		16 |   to_port           = each.key
		17 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: module.environment_dev.s3_bucket_ssm_sessions
	File: /modules/mis_environment/ssm.tf:4-16
	Calling File: /main_development.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		4  | module "s3_bucket_ssm_sessions" {
		5  | 
		6  |   source = "github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.1.0"
		7  | 
		8  |   bucket_prefix      = "${var.account_info.application_name}-${var.env_name}-ssm-sessions"
		9  |   versioning_enabled = false
		10 | 
		11 |   providers = {
		12 |     aws.bucket-replication = aws
		13 |   }
		14 | 
		15 |   tags = var.tags
		16 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: module.environment_preproduction.s3_bucket_ssm_sessions
	File: /modules/mis_environment/ssm.tf:4-16
	Calling File: /main_preproduction.tf:48-88
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		4  | module "s3_bucket_ssm_sessions" {
		5  | 
		6  |   source = "github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.1.0"
		7  | 
		8  |   bucket_prefix      = "${var.account_info.application_name}-${var.env_name}-ssm-sessions"
		9  |   versioning_enabled = false
		10 | 
		11 |   providers = {
		12 |     aws.bucket-replication = aws
		13 |   }
		14 | 
		15 |   tags = var.tags
		16 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: module.environment_stage.s3_bucket_ssm_sessions
	File: /modules/mis_environment/ssm.tf:4-16
	Calling File: /main_preproduction.tf:5-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		4  | module "s3_bucket_ssm_sessions" {
		5  | 
		6  |   source = "github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.1.0"
		7  | 
		8  |   bucket_prefix      = "${var.account_info.application_name}-${var.env_name}-ssm-sessions"
		9  |   versioning_enabled = false
		10 | 
		11 |   providers = {
		12 |     aws.bucket-replication = aws
		13 |   }
		14 | 
		15 |   tags = var.tags
		16 | }

Check: CKV_AWS_337: "Ensure SSM parameters are using KMS CMK"
	FAILED for resource: aws_ssm_parameter.hmpps_bot_priv_key
	File: /ssm.tf:6-16
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-337

		6  | resource "aws_ssm_parameter" "hmpps_bot_priv_key" {
		7  |   name  = "/github/hmpps_bot_priv_key"
		8  |   type  = "SecureString"
		9  |   value = "INITIAL_VALUE_OVERRIDDEN"
		10 |   lifecycle {
		11 |     ignore_changes = [
		12 |       value
		13 |     ]
		14 |   }
		15 |   tags = local.tags
		16 | }

Check: CKV_AWS_337: "Ensure SSM parameters are using KMS CMK"
	FAILED for resource: aws_ssm_parameter.hmpps_bot_installation_id
	File: /ssm.tf:18-28
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-337

		18 | resource "aws_ssm_parameter" "hmpps_bot_installation_id" {
		19 |   name  = "/github/hmpps_bot_installation_id"
		20 |   type  = "SecureString"
		21 |   value = "INITIAL_VALUE_OVERRIDDEN"
		22 |   lifecycle {
		23 |     ignore_changes = [
		24 |       value
		25 |     ]
		26 |   }
		27 |   tags = local.tags
		28 | }

Check: CKV_AWS_337: "Ensure SSM parameters are using KMS CMK"
	FAILED for resource: aws_ssm_parameter.hmpps_bot_app_id
	File: /ssm.tf:30-40
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-337

		30 | resource "aws_ssm_parameter" "hmpps_bot_app_id" {
		31 |   name  = "/github/hmpps_bot_app_id"
		32 |   type  = "SecureString"
		33 |   value = "INITIAL_VALUE_OVERRIDDEN"
		34 |   lifecycle {
		35 |     ignore_changes = [
		36 |       value
		37 |     ]
		38 |   }
		39 |   tags = local.tags
		40 | }
Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: module.environment_dev.module.oracle_db_shared["dsd-db"].s3_bucket_oracledb_backups_inventory
	File: /../delius-core/modules/components/oracle_db_shared/s3.tf:189-227
	Calling File: /modules/mis_environment/databases.tf:13-42
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		189 | module "s3_bucket_oracledb_backups_inventory" {
		190 |   source              = "github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.1.0"
		191 |   bucket_name         = "${local.oracle_backup_bucket_prefix}-inventory"
		192 |   versioning_enabled  = false
		193 |   ownership_controls  = "BucketOwnerEnforced"
		194 |   replication_enabled = false
		195 |   custom_kms_key      = var.account_config.kms_keys.general_shared
		196 |   bucket_policy       = [data.aws_iam_policy_document.oracledb_backups_inventory.json]
		197 | 
		198 |   providers = {
		199 |     aws.bucket-replication = aws.bucket-replication
		200 |   }
		201 | 
		202 |   lifecycle_rule = [
		203 |     {
		204 |       id      = "main"
		205 |       enabled = "Enabled"
		206 |       prefix  = ""
		207 | 
		208 |       tags = {
		209 |         rule      = "log"
		210 |         autoclean = "true"
		211 |       }
		212 | 
		213 |       transition = [
		214 |         {
		215 |           days          = 90
		216 |           storage_class = "STANDARD_IA"
		217 |         }
		218 |       ]
		219 | 
		220 |       expiration = {
		221 |         days = 365
		222 |       }
		223 |     }
		224 |   ]
		225 | 
		226 |   tags = var.tags
		227 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: module.environment_dev.module.oracle_db_shared["boe-db"].s3_bucket_oracledb_backups_inventory
	File: /../delius-core/modules/components/oracle_db_shared/s3.tf:189-227
	Calling File: /modules/mis_environment/databases.tf:13-42
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		189 | module "s3_bucket_oracledb_backups_inventory" {
		190 |   source              = "github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.1.0"
		191 |   bucket_name         = "${local.oracle_backup_bucket_prefix}-inventory"
		192 |   versioning_enabled  = false
		193 |   ownership_controls  = "BucketOwnerEnforced"
		194 |   replication_enabled = false
		195 |   custom_kms_key      = var.account_config.kms_keys.general_shared
		196 |   bucket_policy       = [data.aws_iam_policy_document.oracledb_backups_inventory.json]
		197 | 
		198 |   providers = {
		199 |     aws.bucket-replication = aws.bucket-replication
		200 |   }
		201 | 
		202 |   lifecycle_rule = [
		203 |     {
		204 |       id      = "main"
		205 |       enabled = "Enabled"
		206 |       prefix  = ""
		207 | 
		208 |       tags = {
		209 |         rule      = "log"
		210 |         autoclean = "true"
		211 |       }
		212 | 
		213 |       transition = [
		214 |         {
		215 |           days          = 90
		216 |           storage_class = "STANDARD_IA"
		217 |         }
		218 |       ]
		219 | 
		220 |       expiration = {
		221 |         days = 365
		222 |       }
		223 |     }
		224 |   ]
		225 | 
		226 |   tags = var.tags
		227 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: module.environment_stage.module.oracle_db_shared["dsd-db"].s3_bucket_oracledb_backups_inventory
	File: /../delius-core/modules/components/oracle_db_shared/s3.tf:189-227
	Calling File: /modules/mis_environment/databases.tf:13-42
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		189 | module "s3_bucket_oracledb_backups_inventory" {
		190 |   source              = "github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.1.0"
		191 |   bucket_name         = "${local.oracle_backup_bucket_prefix}-inventory"
		192 |   versioning_enabled  = false
		193 |   ownership_controls  = "BucketOwnerEnforced"
		194 |   replication_enabled = false
		195 |   custom_kms_key      = var.account_config.kms_keys.general_shared
		196 |   bucket_policy       = [data.aws_iam_policy_document.oracledb_backups_inventory.json]
		197 | 
		198 |   providers = {
		199 |     aws.bucket-replication = aws.bucket-replication
		200 |   }
		201 | 
		202 |   lifecycle_rule = [
		203 |     {
		204 |       id      = "main"
		205 |       enabled = "Enabled"
		206 |       prefix  = ""
		207 | 
		208 |       tags = {
		209 |         rule      = "log"
		210 |         autoclean = "true"
		211 |       }
		212 | 
		213 |       transition = [
		214 |         {
		215 |           days          = 90
		216 |           storage_class = "STANDARD_IA"
		217 |         }
		218 |       ]
		219 | 
		220 |       expiration = {
		221 |         days = 365
		222 |       }
		223 |     }
		224 |   ]
		225 | 
		226 |   tags = var.tags
		227 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: module.environment_stage.module.oracle_db_shared["boe-db"].s3_bucket_oracledb_backups_inventory
	File: /../delius-core/modules/components/oracle_db_shared/s3.tf:189-227
	Calling File: /modules/mis_environment/databases.tf:13-42
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		189 | module "s3_bucket_oracledb_backups_inventory" {
		190 |   source              = "github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.1.0"
		191 |   bucket_name         = "${local.oracle_backup_bucket_prefix}-inventory"
		192 |   versioning_enabled  = false
		193 |   ownership_controls  = "BucketOwnerEnforced"
		194 |   replication_enabled = false
		195 |   custom_kms_key      = var.account_config.kms_keys.general_shared
		196 |   bucket_policy       = [data.aws_iam_policy_document.oracledb_backups_inventory.json]
		197 | 
		198 |   providers = {
		199 |     aws.bucket-replication = aws.bucket-replication
		200 |   }
		201 | 
		202 |   lifecycle_rule = [
		203 |     {
		204 |       id      = "main"
		205 |       enabled = "Enabled"
		206 |       prefix  = ""
		207 | 
		208 |       tags = {
		209 |         rule      = "log"
		210 |         autoclean = "true"
		211 |       }
		212 | 
		213 |       transition = [
		214 |         {
		215 |           days          = 90
		216 |           storage_class = "STANDARD_IA"
		217 |         }
		218 |       ]
		219 | 
		220 |       expiration = {
		221 |         days = 365
		222 |       }
		223 |     }
		224 |   ]
		225 | 
		226 |   tags = var.tags
		227 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: module.environment_preproduction.module.oracle_db_shared["dsd-db"].s3_bucket_oracledb_backups_inventory
	File: /../delius-core/modules/components/oracle_db_shared/s3.tf:189-227
	Calling File: /modules/mis_environment/databases.tf:13-42
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		189 | module "s3_bucket_oracledb_backups_inventory" {
		190 |   source              = "github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.1.0"
		191 |   bucket_name         = "${local.oracle_backup_bucket_prefix}-inventory"
		192 |   versioning_enabled  = false
		193 |   ownership_controls  = "BucketOwnerEnforced"
		194 |   replication_enabled = false
		195 |   custom_kms_key      = var.account_config.kms_keys.general_shared
		196 |   bucket_policy       = [data.aws_iam_policy_document.oracledb_backups_inventory.json]
		197 | 
		198 |   providers = {
		199 |     aws.bucket-replication = aws.bucket-replication
		200 |   }
		201 | 
		202 |   lifecycle_rule = [
		203 |     {
		204 |       id      = "main"
		205 |       enabled = "Enabled"
		206 |       prefix  = ""
		207 | 
		208 |       tags = {
		209 |         rule      = "log"
		210 |         autoclean = "true"
		211 |       }
		212 | 
		213 |       transition = [
		214 |         {
		215 |           days          = 90
		216 |           storage_class = "STANDARD_IA"
		217 |         }
		218 |       ]
		219 | 
		220 |       expiration = {
		221 |         days = 365
		222 |       }
		223 |     }
		224 |   ]
		225 | 
		226 |   tags = var.tags
		227 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: module.environment_preproduction.module.oracle_db_shared["boe-db"].s3_bucket_oracledb_backups_inventory
	File: /../delius-core/modules/components/oracle_db_shared/s3.tf:189-227
	Calling File: /modules/mis_environment/databases.tf:13-42
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		189 | module "s3_bucket_oracledb_backups_inventory" {
		190 |   source              = "github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.1.0"
		191 |   bucket_name         = "${local.oracle_backup_bucket_prefix}-inventory"
		192 |   versioning_enabled  = false
		193 |   ownership_controls  = "BucketOwnerEnforced"
		194 |   replication_enabled = false
		195 |   custom_kms_key      = var.account_config.kms_keys.general_shared
		196 |   bucket_policy       = [data.aws_iam_policy_document.oracledb_backups_inventory.json]
		197 | 
		198 |   providers = {
		199 |     aws.bucket-replication = aws.bucket-replication
		200 |   }
		201 | 
		202 |   lifecycle_rule = [
		203 |     {
		204 |       id      = "main"
		205 |       enabled = "Enabled"
		206 |       prefix  = ""
		207 | 
		208 |       tags = {
		209 |         rule      = "log"
		210 |         autoclean = "true"
		211 |       }
		212 | 
		213 |       transition = [
		214 |         {
		215 |           days          = 90
		216 |           storage_class = "STANDARD_IA"
		217 |         }
		218 |       ]
		219 | 
		220 |       expiration = {
		221 |         days = 365
		222 |       }
		223 |     }
		224 |   ]
		225 | 
		226 |   tags = var.tags
		227 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: module.environment_dev.aws_secretsmanager_secret.ad_admin_password
	File: /modules/mis_environment/directory_service.tf:29-39
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		29 | resource "aws_secretsmanager_secret" "ad_admin_password" {
		30 |   name                    = "${var.app_name}-${var.env_name}-ad-admin-password"
		31 |   recovery_window_in_days = 0
		32 | 
		33 |   tags = merge(
		34 |     var.tags,
		35 |     {
		36 |       Name = "${var.app_name}-${var.env_name}-ad-admin-password"
		37 |     }
		38 |   )
		39 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: module.environment_preproduction.aws_secretsmanager_secret.ad_admin_password
	File: /modules/mis_environment/directory_service.tf:29-39
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		29 | resource "aws_secretsmanager_secret" "ad_admin_password" {
		30 |   name                    = "${var.app_name}-${var.env_name}-ad-admin-password"
		31 |   recovery_window_in_days = 0
		32 | 
		33 |   tags = merge(
		34 |     var.tags,
		35 |     {
		36 |       Name = "${var.app_name}-${var.env_name}-ad-admin-password"
		37 |     }
		38 |   )
		39 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: module.environment_stage.aws_secretsmanager_secret.ad_admin_password
	File: /modules/mis_environment/directory_service.tf:29-39
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		29 | resource "aws_secretsmanager_secret" "ad_admin_password" {
		30 |   name                    = "${var.app_name}-${var.env_name}-ad-admin-password"
		31 |   recovery_window_in_days = 0
		32 | 
		33 |   tags = merge(
		34 |     var.tags,
		35 |     {
		36 |       Name = "${var.app_name}-${var.env_name}-ad-admin-password"
		37 |     }
		38 |   )
		39 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: module.environment_dev.aws_secretsmanager_secret.ad_username
	File: /modules/mis_environment/secrets.tf:3-9
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		3 | resource "aws_secretsmanager_secret" "ad_username" {
		4 |   #checkov:skip=CKV_AWS_149 "ignore"
		5 |   name                    = "${var.env_name}-legacy-ad-username"
		6 |   recovery_window_in_days = 0
		7 | 
		8 |   tags = var.tags
		9 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: module.environment_dev.aws_secretsmanager_secret.ad_password
	File: /modules/mis_environment/secrets.tf:12-18
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		12 | resource "aws_secretsmanager_secret" "ad_password" {
		13 |   #checkov:skip=CKV_AWS_149 "ignore"
		14 |   name                    = "${var.env_name}-legacy-ad-password"
		15 |   recovery_window_in_days = 0
		16 | 
		17 |   tags = var.tags
		18 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: module.environment_preproduction.aws_secretsmanager_secret.ad_username
	File: /modules/mis_environment/secrets.tf:3-9
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		3 | resource "aws_secretsmanager_secret" "ad_username" {
		4 |   #checkov:skip=CKV_AWS_149 "ignore"
		5 |   name                    = "${var.env_name}-legacy-ad-username"
		6 |   recovery_window_in_days = 0
		7 | 
		8 |   tags = var.tags
		9 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: module.environment_preproduction.aws_secretsmanager_secret.ad_password
	File: /modules/mis_environment/secrets.tf:12-18
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		12 | resource "aws_secretsmanager_secret" "ad_password" {
		13 |   #checkov:skip=CKV_AWS_149 "ignore"
		14 |   name                    = "${var.env_name}-legacy-ad-password"
		15 |   recovery_window_in_days = 0
		16 | 
		17 |   tags = var.tags
		18 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: module.environment_stage.aws_secretsmanager_secret.ad_username
	File: /modules/mis_environment/secrets.tf:3-9
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		3 | resource "aws_secretsmanager_secret" "ad_username" {
		4 |   #checkov:skip=CKV_AWS_149 "ignore"
		5 |   name                    = "${var.env_name}-legacy-ad-username"
		6 |   recovery_window_in_days = 0
		7 | 
		8 |   tags = var.tags
		9 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: module.environment_stage.aws_secretsmanager_secret.ad_password
	File: /modules/mis_environment/secrets.tf:12-18
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		12 | resource "aws_secretsmanager_secret" "ad_password" {
		13 |   #checkov:skip=CKV_AWS_149 "ignore"
		14 |   name                    = "${var.env_name}-legacy-ad-password"
		15 |   recovery_window_in_days = 0
		16 | 
		17 |   tags = var.tags
		18 | }

Check: CKV2_AWS_23: "Route53 A Record has Attached Resource"
	FAILED for resource: module.environment_dev.module.oracle_db_boe.aws_route53_record.db_ec2_instance_public
	File: /../delius-core/modules/components/oracle_db_instance/dns.tf:10-17
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-route53-a-record-has-an-attached-resource

		10 | resource "aws_route53_record" "db_ec2_instance_public" {
		11 |   provider = aws.core-vpc
		12 |   zone_id = var.account_config.route53_external_zone.zone_id
		13 |   name     = var.db_type == "primary" ? "${var.account_info.application_name}-${var.env_name}-${var.db_suffix}-${var.db_count_index}.${var.account_config.dns_suffix}" : "${var.account_info.application_name}-${var.env_name}-${var.db_suffix}-${var.db_count_index + 1}.${var.account_config.dns_suffix}"
		14 |   type     = "A"
		15 |   ttl      = 60
		16 |   records  = [module.instance.aws_instance.private_ip]
		17 | }

Check: CKV2_AWS_23: "Route53 A Record has Attached Resource"
	FAILED for resource: module.environment_preproduction.module.oracle_db_boe.aws_route53_record.db_ec2_instance_public
	File: /../delius-core/modules/components/oracle_db_instance/dns.tf:10-17
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-route53-a-record-has-an-attached-resource

		10 | resource "aws_route53_record" "db_ec2_instance_public" {
		11 |   provider = aws.core-vpc
		12 |   zone_id = var.account_config.route53_external_zone.zone_id
		13 |   name     = var.db_type == "primary" ? "${var.account_info.application_name}-${var.env_name}-${var.db_suffix}-${var.db_count_index}.${var.account_config.dns_suffix}" : "${var.account_info.application_name}-${var.env_name}-${var.db_suffix}-${var.db_count_index + 1}.${var.account_config.dns_suffix}"
		14 |   type     = "A"
		15 |   ttl      = 60
		16 |   records  = [module.instance.aws_instance.private_ip]
		17 | }

Check: CKV2_AWS_23: "Route53 A Record has Attached Resource"
	FAILED for resource: module.environment_stage.module.oracle_db_boe.aws_route53_record.db_ec2_instance_public
	File: /../delius-core/modules/components/oracle_db_instance/dns.tf:10-17
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-route53-a-record-has-an-attached-resource

		10 | resource "aws_route53_record" "db_ec2_instance_public" {
		11 |   provider = aws.core-vpc
		12 |   zone_id = var.account_config.route53_external_zone.zone_id
		13 |   name     = var.db_type == "primary" ? "${var.account_info.application_name}-${var.env_name}-${var.db_suffix}-${var.db_count_index}.${var.account_config.dns_suffix}" : "${var.account_info.application_name}-${var.env_name}-${var.db_suffix}-${var.db_count_index + 1}.${var.account_config.dns_suffix}"
		14 |   type     = "A"
		15 |   ttl      = 60
		16 |   records  = [module.instance.aws_instance.private_ip]
		17 | }

Check: CKV2_AWS_23: "Route53 A Record has Attached Resource"
	FAILED for resource: module.environment_dev.module.oracle_db_dsd.aws_route53_record.db_ec2_instance_public
	File: /../delius-core/modules/components/oracle_db_instance/dns.tf:10-17
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-route53-a-record-has-an-attached-resource

		10 | resource "aws_route53_record" "db_ec2_instance_public" {
		11 |   provider = aws.core-vpc
		12 |   zone_id = var.account_config.route53_external_zone.zone_id
		13 |   name     = var.db_type == "primary" ? "${var.account_info.application_name}-${var.env_name}-${var.db_suffix}-${var.db_count_index}.${var.account_config.dns_suffix}" : "${var.account_info.application_name}-${var.env_name}-${var.db_suffix}-${var.db_count_index + 1}.${var.account_config.dns_suffix}"
		14 |   type     = "A"
		15 |   ttl      = 60
		16 |   records  = [module.instance.aws_instance.private_ip]
		17 | }

Check: CKV2_AWS_23: "Route53 A Record has Attached Resource"
	FAILED for resource: module.environment_preproduction.module.oracle_db_dsd.aws_route53_record.db_ec2_instance_public
	File: /../delius-core/modules/components/oracle_db_instance/dns.tf:10-17
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-route53-a-record-has-an-attached-resource

		10 | resource "aws_route53_record" "db_ec2_instance_public" {
		11 |   provider = aws.core-vpc
		12 |   zone_id = var.account_config.route53_external_zone.zone_id
		13 |   name     = var.db_type == "primary" ? "${var.account_info.application_name}-${var.env_name}-${var.db_suffix}-${var.db_count_index}.${var.account_config.dns_suffix}" : "${var.account_info.application_name}-${var.env_name}-${var.db_suffix}-${var.db_count_index + 1}.${var.account_config.dns_suffix}"
		14 |   type     = "A"
		15 |   ttl      = 60
		16 |   records  = [module.instance.aws_instance.private_ip]
		17 | }

Check: CKV2_AWS_23: "Route53 A Record has Attached Resource"
	FAILED for resource: module.environment_stage.module.oracle_db_dsd.aws_route53_record.db_ec2_instance_public
	File: /../delius-core/modules/components/oracle_db_instance/dns.tf:10-17
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-route53-a-record-has-an-attached-resource

		10 | resource "aws_route53_record" "db_ec2_instance_public" {
		11 |   provider = aws.core-vpc
		12 |   zone_id = var.account_config.route53_external_zone.zone_id
		13 |   name     = var.db_type == "primary" ? "${var.account_info.application_name}-${var.env_name}-${var.db_suffix}-${var.db_count_index}.${var.account_config.dns_suffix}" : "${var.account_info.application_name}-${var.env_name}-${var.db_suffix}-${var.db_count_index + 1}.${var.account_config.dns_suffix}"
		14 |   type     = "A"
		15 |   ttl      = 60
		16 |   records  = [module.instance.aws_instance.private_ip]
		17 | }

Check: CKV2_AWS_23: "Route53 A Record has Attached Resource"
	FAILED for resource: module.environment_dev.module.oracle_db_mis.aws_route53_record.db_ec2_instance_public
	File: /../delius-core/modules/components/oracle_db_instance/dns.tf:10-17
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-route53-a-record-has-an-attached-resource

		10 | resource "aws_route53_record" "db_ec2_instance_public" {
		11 |   provider = aws.core-vpc
		12 |   zone_id = var.account_config.route53_external_zone.zone_id
		13 |   name     = var.db_type == "primary" ? "${var.account_info.application_name}-${var.env_name}-${var.db_suffix}-${var.db_count_index}.${var.account_config.dns_suffix}" : "${var.account_info.application_name}-${var.env_name}-${var.db_suffix}-${var.db_count_index + 1}.${var.account_config.dns_suffix}"
		14 |   type     = "A"
		15 |   ttl      = 60
		16 |   records  = [module.instance.aws_instance.private_ip]
		17 | }

Check: CKV2_AWS_23: "Route53 A Record has Attached Resource"
	FAILED for resource: module.environment_preproduction.module.oracle_db_mis.aws_route53_record.db_ec2_instance_public
	File: /../delius-core/modules/components/oracle_db_instance/dns.tf:10-17
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-route53-a-record-has-an-attached-resource

		10 | resource "aws_route53_record" "db_ec2_instance_public" {
		11 |   provider = aws.core-vpc
		12 |   zone_id = var.account_config.route53_external_zone.zone_id
		13 |   name     = var.db_type == "primary" ? "${var.account_info.application_name}-${var.env_name}-${var.db_suffix}-${var.db_count_index}.${var.account_config.dns_suffix}" : "${var.account_info.application_name}-${var.env_name}-${var.db_suffix}-${var.db_count_index + 1}.${var.account_config.dns_suffix}"
		14 |   type     = "A"
		15 |   ttl      = 60
		16 |   records  = [module.instance.aws_instance.private_ip]
		17 | }

Check: CKV2_AWS_23: "Route53 A Record has Attached Resource"
	FAILED for resource: module.environment_stage.module.oracle_db_mis.aws_route53_record.db_ec2_instance_public
	File: /../delius-core/modules/components/oracle_db_instance/dns.tf:10-17
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-route53-a-record-has-an-attached-resource

		10 | resource "aws_route53_record" "db_ec2_instance_public" {
		11 |   provider = aws.core-vpc
		12 |   zone_id = var.account_config.route53_external_zone.zone_id
		13 |   name     = var.db_type == "primary" ? "${var.account_info.application_name}-${var.env_name}-${var.db_suffix}-${var.db_count_index}.${var.account_config.dns_suffix}" : "${var.account_info.application_name}-${var.env_name}-${var.db_suffix}-${var.db_count_index + 1}.${var.account_config.dns_suffix}"
		14 |   type     = "A"
		15 |   ttl      = 60
		16 |   records  = [module.instance.aws_instance.private_ip]
		17 | }


checkov_exitcode=3

`CTFLint Scan` Failed

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
terraform/environments/delius-core/modules/components/oracle_db_instance
terraform/environments/delius-core/modules/components/oracle_db_shared
terraform/environments/delius-mis

*****************************

Running tflint in terraform/environments/delius-core/modules/components/oracle_db_instance
Excluding the following checks: terraform_unused_declarations
4 issue(s) found:

Warning: Duplicate key: "datapoints_to_alarm", first defined at terraform/environments/delius-core/modules/components/oracle_db_instance/locals.tf:49,9-28 (terraform_map_duplicate_keys)

  on terraform/environments/delius-core/modules/components/oracle_db_instance/locals.tf line 55:
  55:         datapoints_to_alarm = "10"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_map_duplicate_keys.md

Warning: Duplicate key: "evaluation_periods", first defined at terraform/environments/delius-core/modules/components/oracle_db_instance/locals.tf:48,9-27 (terraform_map_duplicate_keys)

  on terraform/environments/delius-core/modules/components/oracle_db_instance/locals.tf line 56:
  56:         evaluation_periods  = "10"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_map_duplicate_keys.md

Warning: `server_type_tag` variable has no type (terraform_typed_variables)

  on terraform/environments/delius-core/modules/components/oracle_db_instance/variables.tf line 36:
  36: variable "server_type_tag" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_typed_variables.md

Warning: `database_tag_prefix` variable has no type (terraform_typed_variables)

  on terraform/environments/delius-core/modules/components/oracle_db_instance/variables.tf line 41:
  41: variable "database_tag_prefix" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_typed_variables.md

tflint_exitcode=2

*****************************

Running tflint in terraform/environments/delius-core/modules/components/oracle_db_shared
Excluding the following checks: terraform_unused_declarations
7 issue(s) found:

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/delius-core/modules/components/oracle_db_shared/s3.tf line 10:
  10:       "${module.s3_bucket_oracledb_backups.bucket.arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/delius-core/modules/components/oracle_db_shared/s3.tf line 74:
  74:       "${module.s3_bucket_oracledb_backups.bucket.arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/delius-core/modules/components/oracle_db_shared/s3.tf line 87:
  87:       "${module.s3_bucket_oracledb_backups_inventory.bucket.arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/delius-core/modules/components/oracle_db_shared/s3.tf line 126:
 126:         "${module.s3_bucket_oracle_statistics[0].bucket.arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/delius-core/modules/components/oracle_db_shared/s3.tf line 241:
 241:       values   = ["${var.account_info.id}"]

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/delius-core/modules/components/oracle_db_shared/s3.tf line 253:
 253:       values   = ["${module.s3_bucket_oracledb_backups.bucket.arn}"]

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/delius-core/modules/components/oracle_db_shared/s3.tf line 294:
 294:     resources = ["${module.s3_bucket_oracle_statistics[0].bucket.arn}"]

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

tflint_exitcode=4

*****************************

Running tflint in terraform/environments/delius-mis
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=4

`Trivy Scan` Success

Show Output

*****************************

Trivy will check the following folders:
terraform/environments/delius-core/modules/components/oracle_db_instance
terraform/environments/delius-core/modules/components/oracle_db_shared
terraform/environments/delius-mis

*****************************

Running Trivy in terraform/environments/delius-core/modules/components/oracle_db_instance
2025-01-09T17:03:24Z	INFO	[vulndb] Need to update DB
2025-01-09T17:03:24Z	INFO	[vulndb] Downloading vulnerability DB...
2025-01-09T17:03:24Z	INFO	[vulndb] Downloading artifact...	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-09T17:03:26Z	INFO	[vulndb] Artifact successfully downloaded	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-09T17:03:26Z	INFO	[vuln] Vulnerability scanning is enabled
2025-01-09T17:03:26Z	INFO	[misconfig] Misconfiguration scanning is enabled
2025-01-09T17:03:26Z	INFO	[misconfig] Need to update the built-in checks
2025-01-09T17:03:26Z	INFO	[misconfig] Downloading the built-in checks...
160.80 KiB / 160.80 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2025-01-09T17:03:26Z	INFO	[secret] Secret scanning is enabled
2025-01-09T17:03:26Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-09T17:03:26Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-09T17:03:28Z	INFO	[terraform scanner] Scanning root module	file_path="."
2025-01-09T17:03:28Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="account_config, account_info, availability_zone, db_ami, ebs_volume_config, ebs_volumes, ec2_key_pair_name, env_name, environment_config, instance_profile_policies, security_group_ids, sns_topic_arn, ssh_keys_bucket_name, subnet_id, tags, user_data"
2025-01-09T17:03:28Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.instance.aws_ebs_volume.this" value="cty.NilVal"
2025-01-09T17:03:28Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.instance.aws_instance.this" err="2 errors occurred:\n\t* invalid for-each in aws_instance.this.dynamic.ephemeral_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_instance.this.dynamic.ebs_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-09T17:03:28Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.instance.aws_instance.this" err="2 errors occurred:\n\t* invalid for-each in aws_instance.this.dynamic.ephemeral_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_instance.this.dynamic.ebs_block_device block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-09T17:03:28Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-enforce-http-token-imds" range="github.com/ministryofjustice/modernisation-platform-terraform-ec2-instance?ref=20622418aa13871c279c12d9ae5e98f29c9a46f0/main.tf:22"
2025-01-09T17:03:28Z	INFO	Number of language-specific files	num=0
2025-01-09T17:03:28Z	INFO	Detected config files	num=2
trivy_exitcode=0

*****************************

Running Trivy in terraform/environments/delius-core/modules/components/oracle_db_shared
2025-01-09T17:03:28Z	INFO	[vuln] Vulnerability scanning is enabled
2025-01-09T17:03:28Z	INFO	[misconfig] Misconfiguration scanning is enabled
2025-01-09T17:03:28Z	INFO	[secret] Secret scanning is enabled
2025-01-09T17:03:28Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-09T17:03:28Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-09T17:03:30Z	INFO	[terraform scanner] Scanning root module	file_path="."
2025-01-09T17:03:30Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="account_config, account_info, bastion_sg_id, env_name, environment_config, instance_roles, platform_vars, public_keys, tags"
2025-01-09T17:03:30Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_s3_object.user_public_keys" value="cty.NilVal"
2025-01-09T17:03:30Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_vpc_security_group_egress_rule.db_ec2_instance_legacy_oracle" value="cty.NilVal"
2025-01-09T17:03:30Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_vpc_security_group_ingress_rule.db_ec2_instance_legacy_oracle" value="cty.NilVal"
2025-01-09T17:03:34Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-public-egress-sgr" range="sg.tf:16"
2025-01-09T17:03:34Z	INFO	Number of language-specific files	num=0
2025-01-09T17:03:34Z	INFO	Detected config files	num=4
trivy_exitcode=0

*****************************

Running Trivy in terraform/environments/delius-mis
2025-01-09T17:03:34Z	INFO	[vuln] Vulnerability scanning is enabled
2025-01-09T17:03:34Z	INFO	[misconfig] Misconfiguration scanning is enabled
2025-01-09T17:03:34Z	INFO	[secret] Secret scanning is enabled
2025-01-09T17:03:34Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-09T17:03:34Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-09T17:03:36Z	INFO	[terraform scanner] Scanning root module	file_path="."
2025-01-09T17:03:36Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="networking"
2025-01-09T17:03:36Z	INFO	Number of language-specific files	num=0
2025-01-09T17:03:36Z	INFO	Detected config files	num=1
trivy_exitcode=0

sobostion requested review from a team as code owners January 8, 2025 13:14

github-actions bot added the environments-repository Used to exclude PRs from this repo in our Slack PR update label Jan 8, 2025

sobostion had a problem deploying to delius-core-development January 8, 2025 13:18 — with GitHub Actions Failure

sobostion force-pushed the TM-855 branch from c0ff2a5 to d5d5d5d Compare January 8, 2025 13:26

sobostion had a problem deploying to delius-core-development January 8, 2025 13:28 — with GitHub Actions Error

add public dns record for oracle databases

0546968

sobostion force-pushed the TM-855 branch from d5d5d5d to 0546968 Compare January 8, 2025 14:01

sobostion temporarily deployed to delius-core-development January 8, 2025 14:03 — with GitHub Actions Inactive

sobostion added 2 commits January 9, 2025 09:26

use private ip instead of private dns

e930c04

typo

2cd3c07

sobostion temporarily deployed to delius-core-development January 9, 2025 09:32 — with GitHub Actions Inactive

use A record now that we are using private ip

2e6e79a

sobostion temporarily deployed to delius-core-development January 9, 2025 10:00 — with GitHub Actions Inactive

sobostion had a problem deploying to delius-mis-development January 9, 2025 10:30 — with GitHub Actions Failure

sobostion had a problem deploying to delius-mis-development January 9, 2025 11:25 — with GitHub Actions Failure

allow connectivity between legacy and MP oracle

f8697f8

add migration cidr to mis

d873b27

iterate over migration cidrs

a53daf7

sobostion had a problem deploying to delius-core-test January 9, 2025 17:01 — with GitHub Actions Error

sobostion had a problem deploying to delius-core-development January 9, 2025 17:01 — with GitHub Actions Error

sobostion had a problem deploying to delius-mis-development January 9, 2025 17:03 — with GitHub Actions Error

sobostion deployed to delius-core-development January 9, 2025 17:05 — with GitHub Actions Active

sobostion deployed to delius-core-test January 9, 2025 17:05 — with GitHub Actions Active

sobostion had a problem deploying to delius-mis-development January 9, 2025 17:08 — with GitHub Actions Failure

sobostion had a problem deploying to delius-mis-development January 10, 2025 09:10 — with GitHub Actions Failure

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

add public dns record for oracle databases #9254

add public dns record for oracle databases #9254

sobostion commented Jan 8, 2025

github-actions bot commented Jan 8, 2025

github-actions bot commented Jan 8, 2025

github-actions bot commented Jan 8, 2025

github-actions bot commented Jan 9, 2025

github-actions bot commented Jan 9, 2025

github-actions bot commented Jan 9, 2025

github-actions bot commented Jan 9, 2025

github-actions bot commented Jan 9, 2025

github-actions bot commented Jan 9, 2025

add public dns record for oracle databases #9254

Are you sure you want to change the base?

add public dns record for oracle databases #9254

Conversation

sobostion commented Jan 8, 2025

github-actions bot commented Jan 8, 2025

Trivy Scan Success

CTFLint Scan Failed

Trivy Scan Success

github-actions bot commented Jan 8, 2025

Trivy Scan Success

CTFLint Scan Failed

Trivy Scan Success

github-actions bot commented Jan 8, 2025

Trivy Scan Success

CTFLint Scan Failed

Trivy Scan Success

github-actions bot commented Jan 9, 2025

Trivy Scan Success

CTFLint Scan Failed

Trivy Scan Success

github-actions bot commented Jan 9, 2025

Trivy Scan Success

CTFLint Scan Failed

Trivy Scan Success

github-actions bot commented Jan 9, 2025

Trivy Scan Success

CTFLint Scan Failed

Trivy Scan Success

github-actions bot commented Jan 9, 2025

Trivy Scan Success

CTFLint Scan Failed

Trivy Scan Success

github-actions bot commented Jan 9, 2025

Trivy Scan Success

CTFLint Scan Failed

Trivy Scan Success

github-actions bot commented Jan 9, 2025

Trivy Scan Success

CTFLint Scan Failed

Trivy Scan Success

`Trivy Scan` Success

`CTFLint Scan` Failed

`Trivy Scan` Success

`Trivy Scan` Success

`CTFLint Scan` Failed

`Trivy Scan` Success

`Trivy Scan` Success

`CTFLint Scan` Failed

`Trivy Scan` Success

`Trivy Scan` Success

`CTFLint Scan` Failed

`Trivy Scan` Success

`Trivy Scan` Success

`CTFLint Scan` Failed

`Trivy Scan` Success

`Trivy Scan` Success

`CTFLint Scan` Failed

`Trivy Scan` Success

`Trivy Scan` Success

`CTFLint Scan` Failed

`Trivy Scan` Success

`Trivy Scan` Success

`CTFLint Scan` Failed

`Trivy Scan` Success

`Trivy Scan` Success

`CTFLint Scan` Failed

`Trivy Scan` Success