Fixing checkov errors - adding arn for sns

[SteveLinden]

First attempt to correct errors as per Fix a couple of checkov issues on modernisation-platform-terraform-s3-bucket#4996

[github-actions]

TFSEC Scan Failed

Show Output

*****************************

TFSEC will check the following folders:
.

*****************************

Running TFSEC in .
Excluding the following checks: AWS089, AWS099, AWS009, AWS097, AWS018

======================================================
tfsec is joining the Trivy family

tfsec will continue to remain available 
for the time being, although our engineering 
attention will be directed at Trivy going forward.

You can read more here: 
https://github.com/aquasecurity/tfsec/discussions/1994
======================================================
Error: scan failed: github/workspace/main.tf:107,1-2: Argument or block definition required; An argument or block definition is required here.
tfsec_exitcode=1

Checkov Scan Failed

Show Output

*****************************

Checkov will check the following folders:
.

*****************************

Running Checkov in .
Excluding the following checks: CKV_GIT_1
terraform scan results:

Passed checks: 5, Failed checks: 0, Skipped checks: 0, Parsing errors: 1

github_actions scan results:

Passed checks: 175, Failed checks: 1, Skipped checks: 0

Check: CKV2_GHA_1: "Ensure top-level permissions are not set to write-all"
	FAILED for resource: on(Generate Terraform README docs)
	File: /.github/workflows/documentation.yml:0-1

checkov_exitcode=1

CTFLint Scan Failed

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing `terraform` plugin...
Installed `terraform` (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.2.1)
tflint will check the following folders:
.

*****************************

Running tflint in .
Failed to load configurations; main.tf:107,1-2: Argument or block definition required; An argument or block definition is required here.:

�[31mError�[0m: Argument or block definition required

  on main.tf line 107:
 107: �[1;4m}�[0m

An argument or block definition is required here.

tflint_exitcode=1

[github-actions]

TFSEC Scan Success

Show Output

*****************************

TFSEC will check the following folders:
.

*****************************

Running TFSEC in .
Excluding the following checks: AWS089, AWS099, AWS009, AWS097, AWS018

======================================================
tfsec is joining the Trivy family

tfsec will continue to remain available 
for the time being, although our engineering 
attention will be directed at Trivy going forward.

You can read more here: 
https://github.com/aquasecurity/tfsec/discussions/1994
======================================================
  timings
  ──────────────────────────────────────────
  disk i/o             116.1µs
  parsing              21.072136ms
  adaptation           1.096102ms
  checks               8.598215ms
  total                30.882553ms

  counts
  ──────────────────────────────────────────
  modules downloaded   0
  modules processed    1
  blocks processed     43
  files read           4

  results
  ──────────────────────────────────────────
  passed               6
  ignored              4
  critical             0
  high                 0
  medium               0
  low                  0


No problems detected!

tfsec_exitcode=0

Checkov Scan Failed

Show Output

*****************************

Checkov will check the following folders:
.

*****************************

Running Checkov in .
Excluding the following checks: CKV_GIT_1
terraform scan results:

Passed checks: 83, Failed checks: 4, Skipped checks: 19

Check: CKV2_AWS_62: "Ensure S3 buckets should have event notifications enabled"
	FAILED for resource: module.s3.aws_s3_bucket.default
	File: /main.tf:13-26

		13 | resource "aws_s3_bucket" "default" {
		14 |   #checkov:skip=CKV_AWS_144: "Replication handled in replication configuration resource"
		15 |   #checkov:skip=CKV_AWS_18: "Logging handled in logging configuration resource"
		16 |   #checkov:skip=CKV_AWS_21: "Versioning handled in Versioning configuration resource"
		17 |   #checkov:skip=CKV_AWS_145: "Encryption handled in encryption configuration resource"
		18 |   
		19 | 
		20 |   bucket        = var.bucket_name
		21 |   bucket_prefix = var.bucket_prefix
		22 |   force_destroy = var.force_destroy
		23 |   bucket_arn = aws_sns_topic.bucket_arn.arn
		24 | 
		25 |   tags = var.tags
		26 | }

Check: CKV2_AWS_62: "Ensure S3 buckets should have event notifications enabled"
	FAILED for resource: module.s3.aws_s3_bucket.replication
	File: /main.tf:239-253

		239 | resource "aws_s3_bucket" "replication" {
		240 |   #checkov:skip=CKV_AWS_144: "Replication not required on replication bucket"
		241 |   #checkov:skip=CKV_AWS_18: "Logging handled in logging configuration resource"
		242 |   #checkov:skip=CKV_AWS_21: "Versioning handled in versioning configuration resource"
		243 |   #checkov:skip=CKV_AWS_145: "Encryption handled in encryption configuration resource"
		244 | 
		245 |   count = var.replication_enabled ? 1 : 0
		246 | 
		247 |   provider      = aws.bucket-replication
		248 |   bucket        = (var.bucket_name != null) ? "${var.bucket_name}-replication" : null
		249 |   bucket_prefix = (var.bucket_prefix != null) ? "${var.bucket_prefix}-replication" : null
		250 |   force_destroy = var.force_destroy
		251 |   bucket_arn = aws_sns_topic.bucket_arn.arn
		252 |   tags          = var.tags
		253 | }

Check: CKV2_AWS_62: "Ensure S3 buckets should have event notifications enabled"
	FAILED for resource: module.s3_with_AES256.aws_s3_bucket.default
	File: /main.tf:13-26

		13 | resource "aws_s3_bucket" "default" {
		14 |   #checkov:skip=CKV_AWS_144: "Replication handled in replication configuration resource"
		15 |   #checkov:skip=CKV_AWS_18: "Logging handled in logging configuration resource"
		16 |   #checkov:skip=CKV_AWS_21: "Versioning handled in Versioning configuration resource"
		17 |   #checkov:skip=CKV_AWS_145: "Encryption handled in encryption configuration resource"
		18 |   
		19 | 
		20 |   bucket        = var.bucket_name
		21 |   bucket_prefix = var.bucket_prefix
		22 |   force_destroy = var.force_destroy
		23 |   bucket_arn = aws_sns_topic.bucket_arn.arn
		24 | 
		25 |   tags = var.tags
		26 | }

Check: CKV2_AWS_62: "Ensure S3 buckets should have event notifications enabled"
	FAILED for resource: module.s3_with_AES256.aws_s3_bucket.replication
	File: /main.tf:239-253

		239 | resource "aws_s3_bucket" "replication" {
		240 |   #checkov:skip=CKV_AWS_144: "Replication not required on replication bucket"
		241 |   #checkov:skip=CKV_AWS_18: "Logging handled in logging configuration resource"
		242 |   #checkov:skip=CKV_AWS_21: "Versioning handled in versioning configuration resource"
		243 |   #checkov:skip=CKV_AWS_145: "Encryption handled in encryption configuration resource"
		244 | 
		245 |   count = var.replication_enabled ? 1 : 0
		246 | 
		247 |   provider      = aws.bucket-replication
		248 |   bucket        = (var.bucket_name != null) ? "${var.bucket_name}-replication" : null
		249 |   bucket_prefix = (var.bucket_prefix != null) ? "${var.bucket_prefix}-replication" : null
		250 |   force_destroy = var.force_destroy
		251 |   bucket_arn = aws_sns_topic.bucket_arn.arn
		252 |   tags          = var.tags
		253 | }

github_actions scan results:

Passed checks: 175, Failed checks: 1, Skipped checks: 0

Check: CKV2_GHA_1: "Ensure top-level permissions are not set to write-all"
	FAILED for resource: on(Generate Terraform README docs)
	File: /.github/workflows/documentation.yml:0-1

checkov_exitcode=1

CTFLint Scan Failed

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing `terraform` plugin...
Installed `terraform` (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.2.1)
tflint will check the following folders:
.

*****************************

Running tflint in .
1 issue(s) found:

Warning: data "aws_sns_topic" "bucket-arn" is declared but not used (terraform_unused_declarations)

  on main.tf line 3:
   3: data "aws_sns_topic" "bucket-arn" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.2.1/docs/rules/terraform_unused_declarations.md

tflint_exitcode=2