❇️ Add GitHub known TLS thumbprints

[jacobwoffenden]

Seeing continuous updates on thumbprint_list

~ thumbprint_list = [
  - "6938fd4d98bab03faadb97b34396831e3780aea1",
    "1c58a3a8518e8759bf075b76b750d4f2df264fcd",
  + "f879abce0008e4eb126e0097e46620f5aaae26ad",
  ]

https://github.blog/changelog/2023-06-27-github-actions-update-on-oidc-integration-with-aws/

[github-actions]

TFSEC Scan Success

Show Output

*****************************

TFSEC will check the following folders:
.

*****************************

Running TFSEC in .
Excluding the following checks: AWS089, AWS099, AWS009, AWS097, AWS018
  timings
  ──────────────────────────────────────────
  disk i/o             138.6µs
  parsing              1.407403ms
  adaptation           149.5µs
  checks               24.180959ms
  total                25.876462ms

  counts
  ──────────────────────────────────────────
  modules downloaded   0
  modules processed    1
  blocks processed     20
  files read           6

  results
  ──────────────────────────────────────────
  passed               2
  ignored              0
  critical             0
  high                 0
  medium               0
  low                  0


No problems detected!

tfsec_exitcode=0

Checkov Scan Failed

Show Output

*****************************

Checkov will check the following folders:
.

*****************************

Running Checkov in .
Excluding the following checks: CKV_GIT_1
terraform scan results:

Passed checks: 29, Failed checks: 1, Skipped checks: 4

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.extra_permissions
	File: /test/unit-test/main.tf:10-31

		10 | data "aws_iam_policy_document" "extra_permissions" {
		11 |   #checkov:skip=CKV_AWS_107
		12 |   #checkov:skip=CKV_AWS_108
		13 |   #checkov:skip=CKV_AWS_109
		14 |   #checkov:skip=CKV_AWS_111
		15 |   version = "2012-10-17"
		16 | 
		17 |   statement {
		18 |     effect = "Allow"
		19 |     actions = [
		20 |       "account:GetAlternateContact",
		21 |       "cur:DescribeReportDefinitions",
		22 |       "identitystore:ListGroups",
		23 |       "secretsmanager:GetSecretValue",
		24 |       "sts:AssumeRole",
		25 |       "s3:*",
		26 |       "kms:*",
		27 |     ]
		28 | 
		29 |     resources = ["*"]
		30 |   }
		31 | }

github_actions scan results:

Passed checks: 176, Failed checks: 0, Skipped checks: 0


checkov_exitcode=1

CTFLint Scan Success

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing `terraform` plugin...
Installed `terraform` (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.2.1)
tflint will check the following folders:
.

*****************************

Running tflint in .
tflint_exitcode=0

[github-actions]

TFSEC Scan Success

Show Output

*****************************

TFSEC will check the following folders:
.

*****************************

Running TFSEC in .
Excluding the following checks: AWS089, AWS099, AWS009, AWS097, AWS018
  timings
  ──────────────────────────────────────────
  disk i/o             131.504µs
  parsing              1.212132ms
  adaptation           139.004µs
  checks               12.331831ms
  total                13.814471ms

  counts
  ──────────────────────────────────────────
  modules downloaded   0
  modules processed    1
  blocks processed     20
  files read           6

  results
  ──────────────────────────────────────────
  passed               2
  ignored              0
  critical             0
  high                 0
  medium               0
  low                  0


No problems detected!

tfsec_exitcode=0

Checkov Scan Success

Show Output

*****************************

Checkov will check the following folders:
.

*****************************

Running Checkov in .
Excluding the following checks: CKV_GIT_1
terraform scan results:

Passed checks: 29, Failed checks: 0, Skipped checks: 5

github_actions scan results:

Passed checks: 176, Failed checks: 0, Skipped checks: 0


checkov_exitcode=0

CTFLint Scan Success

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing `terraform` plugin...
Installed `terraform` (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.2.1)
tflint will check the following folders:
.

*****************************

Running tflint in .
tflint_exitcode=0

[ewastempel]

LGTM

[github-actions]

TFSEC Scan Success

Show Output

*****************************

TFSEC will check the following folders:
.

*****************************

Running TFSEC in .
Excluding the following checks: AWS089, AWS099, AWS009, AWS097, AWS018
  timings
  ──────────────────────────────────────────
  disk i/o             120.204µs
  parsing              1.512831ms
  adaptation           260.306µs
  checks               22.239856ms
  total                24.133197ms

  counts
  ──────────────────────────────────────────
  modules downloaded   0
  modules processed    1
  blocks processed     20
  files read           6

  results
  ──────────────────────────────────────────
  passed               2
  ignored              0
  critical             0
  high                 0
  medium               0
  low                  0


No problems detected!

tfsec_exitcode=0

Checkov Scan Success

Show Output

*****************************

Checkov will check the following folders:
.

*****************************

Running Checkov in .
Excluding the following checks: CKV_GIT_1
terraform scan results:

Passed checks: 29, Failed checks: 0, Skipped checks: 5

github_actions scan results:

Passed checks: 176, Failed checks: 0, Skipped checks: 0


checkov_exitcode=0

CTFLint Scan Success

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing `terraform` plugin...
Installed `terraform` (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.2.1)
tflint will check the following folders:
.

*****************************

Running tflint in .
tflint_exitcode=0