Fix unit tests and broken variable #100

richgreen-moj · 2024-04-03T10:39:22Z

The unit tests for this module were failing e.g. https://github.com/ministryofjustice/modernisation-platform-terraform-ecs-cluster/actions/runs/8535945895/job/23383430602#step:6:391
since the recent update made in this PR #91

I have remediated the unit test code to account for the simplified module and in particular had to update the default of the new variable enable_container_insights which is not a bool and rather must be set as a value of enabled or disbaled.

github-actions · 2024-04-03T10:41:35Z

`TFSEC Scan` Success

Show Output

```hcl

TFSEC will check the following folders:
.

Running TFSEC in .
Excluding the following checks: aws-cloudwatch-log-group-customer-key, aws-iam-no-policy-wildcards, aws-vpc-no-public-egress-sgr, aws-iam-block-kms-policy-wildcard, aws-vpc-add-description-to-security-group

======================================================
tfsec is joining the Trivy family

tfsec will continue to remain available
for the time being, although our engineering
attention will be directed at Trivy going forward.

You can read more here:
aquasecurity/tfsec#1994

timings
──────────────────────────────────────────
disk i/o 178.954µs
parsing 2.809692ms
adaptation 126.104µs
checks 19.640491ms
total 22.755241ms

counts
──────────────────────────────────────────
modules downloaded 0
modules processed 3
blocks processed 50
files read 10

results
──────────────────────────────────────────
passed 1
ignored 0
critical 0
high 0
medium 0
low 0

No problems detected!

tfsec_exitcode=0

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
.

*****************************

Running Checkov in .
Excluding the following checks: CKV_GIT_1
terraform scan results:

Passed checks: 15, Failed checks: 2, Skipped checks: 1

Check: CKV_AWS_97: "Ensure Encryption in transit is enabled for EFS volumes in ECS Task definitions"
	FAILED for resource: aws_ecs_task_definition.default
	File: /service/task_def.tf:1-40
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-general-39

		1  | resource "aws_ecs_task_definition" "default" {
		2  |   count                 = var.ignore_changes || var.ignore_changes_service_task_definition == false ? 0 : 1
		3  |   container_definitions = nonsensitive(var.container_definitions)
		4  |   family                = var.name
		5  | 
		6  |   task_role_arn      = var.task_role_arn
		7  |   execution_role_arn = var.task_exec_role_arn
		8  | 
		9  |   network_mode = "awsvpc"
		10 | 
		11 |   cpu    = var.task_cpu
		12 |   memory = var.task_memory
		13 |   dynamic "volume" {
		14 |     for_each = var.efs_volumes
		15 |     content {
		16 |       host_path = lookup(volume.value, "host_path", null)
		17 |       name      = volume.value.name
		18 | 
		19 |       dynamic "efs_volume_configuration" {
		20 |         for_each = volume.value
		21 | 
		22 |         content {
		23 |           file_system_id          = lookup(efs_volume_configuration.value, "file_system_id", null)
		24 |           root_directory          = lookup(efs_volume_configuration.value, "root_directory", null)
		25 |           transit_encryption      = lookup(efs_volume_configuration.value, "transit_encryption", null)
		26 |           transit_encryption_port = lookup(efs_volume_configuration.value, "transit_encryption_port", null)
		27 | 
		28 |           dynamic "authorization_config" {
		29 |             for_each = lookup(efs_volume_configuration.value, "authorization_config", [])
		30 |             content {
		31 |               access_point_id = lookup(authorization_config.value, "access_point_id", null)
		32 |               iam             = lookup(authorization_config.value, "iam", null)
		33 |             }
		34 |           }
		35 |         }
		36 |       }
		37 |     }
		38 |   }
		39 |   tags = var.tags
		40 | }

Check: CKV_AWS_97: "Ensure Encryption in transit is enabled for EFS volumes in ECS Task definitions"
	FAILED for resource: aws_ecs_task_definition.ignore_changes
	File: /service/task_def.tf:42-90
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-general-39

		42 | resource "aws_ecs_task_definition" "ignore_changes" {
		43 |   count                 = var.ignore_changes || var.ignore_changes_service_task_definition == false ? 1 : 0
		44 |   container_definitions = nonsensitive(var.container_definitions)
		45 |   family                = var.name
		46 | 
		47 |   task_role_arn      = var.task_role_arn
		48 |   execution_role_arn = var.task_exec_role_arn
		49 | 
		50 |   network_mode = "awsvpc"
		51 | 
		52 |   cpu    = var.task_cpu
		53 |   memory = var.task_memory
		54 | 
		55 |   ephemeral_storage {
		56 |     size_in_gib = var.ephemeral_storage_size_in_gib
		57 |   }
		58 | 
		59 |   dynamic "volume" {
		60 |     for_each = var.efs_volumes
		61 |     content {
		62 |       host_path = lookup(volume.value, "host_path", null)
		63 |       name      = volume.value.name
		64 | 
		65 |       dynamic "efs_volume_configuration" {
		66 |         for_each = volume.value
		67 | 
		68 |         content {
		69 |           file_system_id          = lookup(efs_volume_configuration.value, "file_system_id", null)
		70 |           root_directory          = lookup(efs_volume_configuration.value, "root_directory", null)
		71 |           transit_encryption      = lookup(efs_volume_configuration.value, "transit_encryption", null)
		72 |           transit_encryption_port = lookup(efs_volume_configuration.value, "transit_encryption_port", null)
		73 | 
		74 |           dynamic "authorization_config" {
		75 |             for_each = lookup(efs_volume_configuration.value, "authorization_config", [])
		76 |             content {
		77 |               access_point_id = lookup(authorization_config.value, "access_point_id", null)
		78 |               iam             = lookup(authorization_config.value, "iam", null)
		79 |             }
		80 |           }
		81 |         }
		82 |       }
		83 |     }
		84 |   }
		85 |   tags = var.tags
		86 | 
		87 |   lifecycle {
		88 |     ignore_changes = [container_definitions]
		89 |   }
		90 | }

github_actions scan results:

Passed checks: 208, Failed checks: 0, Skipped checks: 0


checkov_exitcode=1

`CTFLint Scan` Success

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.5.0)
tflint will check the following folders:
.

*****************************

Running tflint in .
tflint_exitcode=0

`Trivy Scan`

Show Output

github-actions · 2024-04-03T10:44:34Z

`TFSEC Scan` Success

Show Output

```hcl

TFSEC will check the following folders:
.

Running TFSEC in .
Excluding the following checks: aws-cloudwatch-log-group-customer-key, aws-iam-no-policy-wildcards, aws-vpc-no-public-egress-sgr, aws-iam-block-kms-policy-wildcard, aws-vpc-add-description-to-security-group

======================================================
tfsec is joining the Trivy family

tfsec will continue to remain available
for the time being, although our engineering
attention will be directed at Trivy going forward.

You can read more here:
aquasecurity/tfsec#1994

timings
──────────────────────────────────────────
disk i/o 211.966µs
parsing 2.849401ms
adaptation 127.629µs
checks 13.270005ms
total 16.459001ms

counts
──────────────────────────────────────────
modules downloaded 0
modules processed 3
blocks processed 50
files read 10

results
──────────────────────────────────────────
passed 1
ignored 0
critical 0
high 0
medium 0
low 0

No problems detected!

tfsec_exitcode=0

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
.

*****************************

Running Checkov in .
Excluding the following checks: CKV_GIT_1
terraform scan results:

Passed checks: 15, Failed checks: 2, Skipped checks: 1

Check: CKV_AWS_97: "Ensure Encryption in transit is enabled for EFS volumes in ECS Task definitions"
	FAILED for resource: aws_ecs_task_definition.default
	File: /service/task_def.tf:1-40
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-general-39

		1  | resource "aws_ecs_task_definition" "default" {
		2  |   count                 = var.ignore_changes || var.ignore_changes_service_task_definition == false ? 0 : 1
		3  |   container_definitions = nonsensitive(var.container_definitions)
		4  |   family                = var.name
		5  | 
		6  |   task_role_arn      = var.task_role_arn
		7  |   execution_role_arn = var.task_exec_role_arn
		8  | 
		9  |   network_mode = "awsvpc"
		10 | 
		11 |   cpu    = var.task_cpu
		12 |   memory = var.task_memory
		13 |   dynamic "volume" {
		14 |     for_each = var.efs_volumes
		15 |     content {
		16 |       host_path = lookup(volume.value, "host_path", null)
		17 |       name      = volume.value.name
		18 | 
		19 |       dynamic "efs_volume_configuration" {
		20 |         for_each = volume.value
		21 | 
		22 |         content {
		23 |           file_system_id          = lookup(efs_volume_configuration.value, "file_system_id", null)
		24 |           root_directory          = lookup(efs_volume_configuration.value, "root_directory", null)
		25 |           transit_encryption      = lookup(efs_volume_configuration.value, "transit_encryption", null)
		26 |           transit_encryption_port = lookup(efs_volume_configuration.value, "transit_encryption_port", null)
		27 | 
		28 |           dynamic "authorization_config" {
		29 |             for_each = lookup(efs_volume_configuration.value, "authorization_config", [])
		30 |             content {
		31 |               access_point_id = lookup(authorization_config.value, "access_point_id", null)
		32 |               iam             = lookup(authorization_config.value, "iam", null)
		33 |             }
		34 |           }
		35 |         }
		36 |       }
		37 |     }
		38 |   }
		39 |   tags = var.tags
		40 | }

Check: CKV_AWS_97: "Ensure Encryption in transit is enabled for EFS volumes in ECS Task definitions"
	FAILED for resource: aws_ecs_task_definition.ignore_changes
	File: /service/task_def.tf:42-90
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-general-39

		42 | resource "aws_ecs_task_definition" "ignore_changes" {
		43 |   count                 = var.ignore_changes || var.ignore_changes_service_task_definition == false ? 1 : 0
		44 |   container_definitions = nonsensitive(var.container_definitions)
		45 |   family                = var.name
		46 | 
		47 |   task_role_arn      = var.task_role_arn
		48 |   execution_role_arn = var.task_exec_role_arn
		49 | 
		50 |   network_mode = "awsvpc"
		51 | 
		52 |   cpu    = var.task_cpu
		53 |   memory = var.task_memory
		54 | 
		55 |   ephemeral_storage {
		56 |     size_in_gib = var.ephemeral_storage_size_in_gib
		57 |   }
		58 | 
		59 |   dynamic "volume" {
		60 |     for_each = var.efs_volumes
		61 |     content {
		62 |       host_path = lookup(volume.value, "host_path", null)
		63 |       name      = volume.value.name
		64 | 
		65 |       dynamic "efs_volume_configuration" {
		66 |         for_each = volume.value
		67 | 
		68 |         content {
		69 |           file_system_id          = lookup(efs_volume_configuration.value, "file_system_id", null)
		70 |           root_directory          = lookup(efs_volume_configuration.value, "root_directory", null)
		71 |           transit_encryption      = lookup(efs_volume_configuration.value, "transit_encryption", null)
		72 |           transit_encryption_port = lookup(efs_volume_configuration.value, "transit_encryption_port", null)
		73 | 
		74 |           dynamic "authorization_config" {
		75 |             for_each = lookup(efs_volume_configuration.value, "authorization_config", [])
		76 |             content {
		77 |               access_point_id = lookup(authorization_config.value, "access_point_id", null)
		78 |               iam             = lookup(authorization_config.value, "iam", null)
		79 |             }
		80 |           }
		81 |         }
		82 |       }
		83 |     }
		84 |   }
		85 |   tags = var.tags
		86 | 
		87 |   lifecycle {
		88 |     ignore_changes = [container_definitions]
		89 |   }
		90 | }

github_actions scan results:

Passed checks: 208, Failed checks: 0, Skipped checks: 0


checkov_exitcode=1

`CTFLint Scan` Success

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.5.0)
tflint will check the following folders:
.

*****************************

Running tflint in .
tflint_exitcode=0

`Trivy Scan`

Show Output

fix tests and broken variable

8e90cc4

richgreen-moj requested a review from a team as a code owner April 3, 2024 10:39

terraform-docs: automated action

3006289

SteveLinden added 2 commits April 3, 2024 11:41

Added dependabot files into the repository as per #6489

50c21c9

Adding missing files to scripts folder

d03c01b

richgreen-moj changed the base branch from main to test-action April 3, 2024 10:53

richgreen-moj changed the base branch from test-action to main April 3, 2024 10:54

richgreen-moj closed this Apr 3, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix unit tests and broken variable #100

Fix unit tests and broken variable #100

richgreen-moj commented Apr 3, 2024

github-actions bot commented Apr 3, 2024

You can read more here:
aquasecurity/tfsec#1994

github-actions bot commented Apr 3, 2024

You can read more here:
aquasecurity/tfsec#1994

Fix unit tests and broken variable #100

Fix unit tests and broken variable #100

Conversation

richgreen-moj commented Apr 3, 2024

github-actions bot commented Apr 3, 2024

TFSEC Scan Success

You can read more here: aquasecurity/tfsec#1994

CTFLint Scan Success

Trivy Scan

github-actions bot commented Apr 3, 2024

TFSEC Scan Success

You can read more here: aquasecurity/tfsec#1994

CTFLint Scan Success

Trivy Scan

`TFSEC Scan` Success

You can read more here:
aquasecurity/tfsec#1994

`CTFLint Scan` Success

`Trivy Scan`

`TFSEC Scan` Success

You can read more here:
aquasecurity/tfsec#1994

`CTFLint Scan` Success

`Trivy Scan`