✨ Enable EventBridge -> Cloudwatch #3973

Gary-H9 · 2023-11-13T13:50:31Z

No description provided.

github-actions · 2023-11-13T13:52:31Z

`TFSEC Scan` Success

Show Output

*****************************

TFSEC will check the following folders:

`Checkov Scan` Success

Show Output

*****************************

Checkov will check the following folders:

`CTFLint Scan` Success

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing `terraform` plugin...
Installed `terraform` (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.2.1)
tflint will check the following folders:

github-actions · 2023-11-13T14:05:04Z

`TFSEC Scan` Success

Show Output

*****************************

TFSEC will check the following folders:

`Checkov Scan` Success

Show Output

*****************************

Checkov will check the following folders:

`CTFLint Scan` Success

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing `terraform` plugin...
Installed `terraform` (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.2.1)
tflint will check the following folders:

github-actions · 2023-11-13T14:18:15Z

`TFSEC Scan` Success

Show Output

*****************************

TFSEC will check the following folders:

`Checkov Scan` Success

Show Output

*****************************

Checkov will check the following folders:

`CTFLint Scan` Success

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing `terraform` plugin...
Installed `terraform` (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.2.1)
tflint will check the following folders:

github-actions · 2023-11-13T14:33:23Z

`TFSEC Scan` Success

Show Output

*****************************

TFSEC will check the following folders:

`Checkov Scan` Success

Show Output

*****************************

Checkov will check the following folders:

`CTFLint Scan` Success

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing `terraform` plugin...
Installed `terraform` (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.2.1)
tflint will check the following folders:

github-actions · 2023-11-13T15:29:35Z

`TFSEC Scan` Failed

Show Output

*****************************

TFSEC will check the following folders:
terraform/environments/tipstaff

*****************************

Running TFSEC in terraform/environments/tipstaff
Excluding the following checks: AWS095

======================================================
tfsec is joining the Trivy family

tfsec will continue to remain available 
for the time being, although our engineering 
attention will be directed at Trivy going forward.

You can read more here: 
https://github.com/aquasecurity/tfsec/discussions/1994
======================================================

Result #1 CRITICAL Security group rule allows egress to multiple public internet addresses. 
────────────────────────────────────────────────────────────────────────────────
  ecs.tf:229
────────────────────────────────────────────────────────────────────────────────
  213    resource "aws_security_group" "ecs_service" {
  ...  
  229  [     cidr_blocks = ["0.0.0.0/0"]
  ...  
  231    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-ec2-no-public-egress-sgr
      Impact Your port is egressing data to the internet
  Resolution Set a more restrictive cidr range

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/ec2/no-public-egress-sgr/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group
────────────────────────────────────────────────────────────────────────────────


Results #2-8 CRITICAL Security group rule allows ingress from public internet. (7 similar results)
────────────────────────────────────────────────────────────────────────────────
  load_balancer.tf:19-45
────────────────────────────────────────────────────────────────────────────────
    1    resource "aws_security_group" "tipstaff_lb_sc" {
    .  
   19  ┌     cidr_blocks = [
   20  │       "178.248.34.44/32",
   21  │       "194.33.192.0/25",
   22  │       "195.59.75.0/24",
   23  │       "178.248.34.45/32",
   24  │       "201.33.21.5/32",
   25  └       "178.248.34.46/32",
   ..  
────────────────────────────────────────────────────────────────────────────────
  Individual Causes
  - load_balancer.tf:1-79 (aws_security_group.tipstaff_lb_sc) 7 instances
────────────────────────────────────────────────────────────────────────────────
          ID aws-ec2-no-public-ingress-sgr
      Impact Your port exposed to the internet
  Resolution Set a more restrictive cidr range

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/ec2/no-public-ingress-sgr/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule#cidr_blocks
────────────────────────────────────────────────────────────────────────────────


Result #9 CRITICAL Security group rule allows egress to multiple public internet addresses. 
────────────────────────────────────────────────────────────────────────────────
  load_balancer.tf:69
────────────────────────────────────────────────────────────────────────────────
    1    resource "aws_security_group" "tipstaff_lb_sc" {
    .  
   69  [     cidr_blocks = ["0.0.0.0/0"]
   ..  
   79    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-ec2-no-public-egress-sgr
      Impact Your port is egressing data to the internet
  Resolution Set a more restrictive cidr range

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/ec2/no-public-egress-sgr/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group
────────────────────────────────────────────────────────────────────────────────


Result #10 CRITICAL Security group rule allows egress to multiple public internet addresses. 
────────────────────────────────────────────────────────────────────────────────
  load_balancer.tf:77
────────────────────────────────────────────────────────────────────────────────
    1    resource "aws_security_group" "tipstaff_lb_sc" {
    .  
   77  [     cidr_blocks = ["0.0.0.0/0"]
   ..  
   79    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-ec2-no-public-egress-sgr
      Impact Your port is egressing data to the internet
  Resolution Set a more restrictive cidr range

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/ec2/no-public-egress-sgr/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group
────────────────────────────────────────────────────────────────────────────────


Result #11 CRITICAL Instance is exposed publicly. 
────────────────────────────────────────────────────────────────────────────────
  rds.tf:12
────────────────────────────────────────────────────────────────────────────────
    1    resource "aws_db_instance" "tipstaff_db" {
    .  
   12  [   publicly_accessible         = true (true)
   ..  
   16    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-rds-no-public-db-access
      Impact The database instance is publicly accessible
  Resolution Set the database to not be publicly accessible

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/rds/no-public-db-access/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance
────────────────────────────────────────────────────────────────────────────────


Result #12 CRITICAL Security group rule allows egress to multiple public internet addresses. 
────────────────────────────────────────────────────────────────────────────────
  rds.tf:55
────────────────────────────────────────────────────────────────────────────────
   23    resource "aws_security_group" "postgresql_db_sc" {
   ..  
   55  [     cidr_blocks = ["0.0.0.0/0"]
   ..  
   58    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-ec2-no-public-egress-sgr
      Impact Your port is egressing data to the internet
  Resolution Set a more restrictive cidr range

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/ec2/no-public-egress-sgr/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group
────────────────────────────────────────────────────────────────────────────────


Result #13 HIGH IAM policy document uses wildcarded action 'ecr:*' 
────────────────────────────────────────────────────────────────────────────────
  ecs.tf:148-153
────────────────────────────────────────────────────────────────────────────────
  139    resource "aws_iam_role_policy" "app_execution" {
  ...  
  148  ┌            "Action": [
  149  │               "ecr:*",
  150  │               "logs:CreateLogStream",
  151  │               "logs:PutLogEvents",
  152  │               "secretsmanager:GetSecretValue"
  153  └            ],
  ...  
  160    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-iam-no-policy-wildcards
      Impact Overly permissive policies may grant access to sensitive resources
  Resolution Specify the exact permissions required, and to which resources they should apply instead of using wildcards.

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/iam/no-policy-wildcards/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document
────────────────────────────────────────────────────────────────────────────────


Result #14 HIGH IAM policy document uses sensitive action 'ecr:*' on wildcarded resource '*' 
────────────────────────────────────────────────────────────────────────────────
  ecs.tf:154
────────────────────────────────────────────────────────────────────────────────
  139    resource "aws_iam_role_policy" "app_execution" {
  ...  
  154  [            "Resource": "*",
  ...  
  160    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-iam-no-policy-wildcards
      Impact Overly permissive policies may grant access to sensitive resources
  Resolution Specify the exact permissions required, and to which resources they should apply instead of using wildcards.

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/iam/no-policy-wildcards/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document
────────────────────────────────────────────────────────────────────────────────


Results #15-17 HIGH IAM policy document uses wildcarded action 'logs:CreateLogStream' (3 similar results)
────────────────────────────────────────────────────────────────────────────────
  ecs.tf:199-205
────────────────────────────────────────────────────────────────────────────────
  189    resource "aws_iam_role_policy" "app_task" {
  ...  
  199  ┌         "Action": [
  200  │           "logs:CreateLogStream",
  201  │           "logs:PutLogEvents",
  202  │           "ecr:*",
  203  │           "iam:*",
  204  │           "ec2:*"
  205  └         ],
  ...  
────────────────────────────────────────────────────────────────────────────────
  Individual Causes
  - ecs.tf:189-211 (aws_iam_role_policy.app_task) 3 instances
────────────────────────────────────────────────────────────────────────────────
          ID aws-iam-no-policy-wildcards
      Impact Overly permissive policies may grant access to sensitive resources
  Resolution Specify the exact permissions required, and to which resources they should apply instead of using wildcards.

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/iam/no-policy-wildcards/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document
────────────────────────────────────────────────────────────────────────────────


Result #18 HIGH IAM policy document uses sensitive action 'logs:CreateLogStream' on wildcarded resource '*' 
────────────────────────────────────────────────────────────────────────────────
  ecs.tf:206
────────────────────────────────────────────────────────────────────────────────
  189    resource "aws_iam_role_policy" "app_task" {
  ...  
  206  [        "Resource": "*"
  ...  
  211    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-iam-no-policy-wildcards
      Impact Overly permissive policies may grant access to sensitive resources
  Resolution Specify the exact permissions required, and to which resources they should apply instead of using wildcards.

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/iam/no-policy-wildcards/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document
────────────────────────────────────────────────────────────────────────────────


Result #19 HIGH Image scanning is not enabled. 
────────────────────────────────────────────────────────────────────────────────
  ecs.tf:233-236
────────────────────────────────────────────────────────────────────────────────
  233    resource "aws_ecr_repository" "tipstaff_ecr_repo" {
  234      name         = "tipstaff-ecr-repo"
  235      force_delete = true
  236    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-ecr-enable-image-scans
      Impact The ability to scan images is not being used and vulnerabilities will not be highlighted
  Resolution Enable ECR image scanning

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/ecr/enable-image-scans/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_repository#image_scanning_configuration
────────────────────────────────────────────────────────────────────────────────


Result #20 HIGH Repository tags are mutable. 
────────────────────────────────────────────────────────────────────────────────
  ecs.tf:233-236
────────────────────────────────────────────────────────────────────────────────
  233    resource "aws_ecr_repository" "tipstaff_ecr_repo" {
  234      name         = "tipstaff-ecr-repo"
  235      force_delete = true
  236    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-ecr-enforce-immutable-repository
      Impact Image tags could be overwritten with compromised images
  Resolution Only use immutable images in ECR

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/ecr/enforce-immutable-repository/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_repository
────────────────────────────────────────────────────────────────────────────────


Result #21 HIGH Topic does not have encryption enabled. 
────────────────────────────────────────────────────────────────────────────────
  ecs.tf:314-317
────────────────────────────────────────────────────────────────────────────────
  314    resource "aws_sns_topic" "tipstaff_utilisation_alarm" {
  315      count = local.is-development ? 0 : 1
  316      name  = "tipstaff_utilisation_alarm"
  317    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-sns-enable-topic-encryption
      Impact The SNS topic messages could be read if compromised
  Resolution Turn on SNS Topic encryption

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/sns/enable-topic-encryption/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sns_topic#example-with-server-side-encryption-sse
────────────────────────────────────────────────────────────────────────────────


Result #22 HIGH Application load balancer is not set to drop invalid headers. 
────────────────────────────────────────────────────────────────────────────────
  load_balancer.tf:135-143
────────────────────────────────────────────────────────────────────────────────
  135    resource "aws_lb" "tipstaff_lb" {
  136      name                       = "tipstaff-load-balancer"
  137      load_balancer_type         = "application"
  138      security_groups            = [aws_security_group.tipstaff_lb_sc.id, aws_security_group.tipstaff_lb_sc_pingdom.id]
  139      subnets                    = data.aws_subnets.shared-public.ids
  140      enable_deletion_protection = false
  141      internal                   = false
  142      depends_on                 = [aws_security_group.tipstaff_lb_sc, aws_security_group.tipstaff_lb_sc_pingdom]
  143    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-elb-drop-invalid-headers
      Impact Invalid headers being passed through to the target of the load balance may exploit vulnerabilities
  Resolution Set drop_invalid_header_fields to true

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/elb/drop-invalid-headers/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb#drop_invalid_header_fields
────────────────────────────────────────────────────────────────────────────────


Result #23 HIGH Load balancer is exposed publicly. 
────────────────────────────────────────────────────────────────────────────────
  load_balancer.tf:141
────────────────────────────────────────────────────────────────────────────────
  135    resource "aws_lb" "tipstaff_lb" {
  136      name                       = "tipstaff-load-balancer"
  137      load_balancer_type         = "application"
  138      security_groups            = [aws_security_group.tipstaff_lb_sc.id, aws_security_group.tipstaff_lb_sc_pingdom.id]
  139      subnets                    = data.aws_subnets.shared-public.ids
  140      enable_deletion_protection = false
  141  [   internal                   = false (false)
  142      depends_on                 = [aws_security_group.tipstaff_lb_sc, aws_security_group.tipstaff_lb_sc_pingdom]
  143    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-elb-alb-not-public
      Impact The load balancer is exposed on the internet
  Resolution Switch to an internal load balancer or add a tfsec ignore

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/elb/alb-not-public/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb
────────────────────────────────────────────────────────────────────────────────


Result #24 HIGH Instance does not have storage encryption enabled. 
────────────────────────────────────────────────────────────────────────────────
  rds.tf:1-16
────────────────────────────────────────────────────────────────────────────────
    1  ┌ resource "aws_db_instance" "tipstaff_db" {
    2  │   allocated_storage           = local.application_data.accounts[local.environment].allocated_storage
    3  │   db_name                     = local.application_data.accounts[local.environment].db_name
    4  │   storage_type                = local.application_data.accounts[local.environment].storage_type
    5  │   engine                      = local.application_data.accounts[local.environment].engine
    6  │   identifier                  = local.application_data.accounts[local.environment].identifier
    7  │   engine_version              = local.application_data.accounts[local.environment].engine_version
    8  │   instance_class              = local.application_data.accounts[local.environment].instance_class
    9  └   username                    = local.application_data.accounts[local.environment].db_username
   ..  
────────────────────────────────────────────────────────────────────────────────
          ID aws-rds-encrypt-instance-storage-data
      Impact Data can be read from RDS instances if compromised
  Resolution Enable encryption for RDS instances

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/rds/encrypt-instance-storage-data/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance
────────────────────────────────────────────────────────────────────────────────


Result #25 HIGH Instance has Public Access enabled 
────────────────────────────────────────────────────────────────────────────────
  rds.tf:12
────────────────────────────────────────────────────────────────────────────────
   12      publicly_accessible         = true
────────────────────────────────────────────────────────────────────────────────
  Rego Package builtin.aws.rds.aws0180
     Rego Rule deny
────────────────────────────────────────────────────────────────────────────────


Result #26 MEDIUM Instance has very low backup retention period. 
────────────────────────────────────────────────────────────────────────────────
  rds.tf:1-16
────────────────────────────────────────────────────────────────────────────────
    1  ┌ resource "aws_db_instance" "tipstaff_db" {
    2  │   allocated_storage           = local.application_data.accounts[local.environment].allocated_storage
    3  │   db_name                     = local.application_data.accounts[local.environment].db_name
    4  │   storage_type                = local.application_data.accounts[local.environment].storage_type
    5  │   engine                      = local.application_data.accounts[local.environment].engine
    6  │   identifier                  = local.application_data.accounts[local.environment].identifier
    7  │   engine_version              = local.application_data.accounts[local.environment].engine_version
    8  │   instance_class              = local.application_data.accounts[local.environment].instance_class
    9  └   username                    = local.application_data.accounts[local.environment].db_username
   ..  
────────────────────────────────────────────────────────────────────────────────
          ID aws-rds-specify-backup-retention
      Impact Potential loss of data and short opportunity for recovery
  Resolution Explicitly set the retention period to greater than the default

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/rds/specify-backup-retention/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/rds_cluster#backup_retention_period
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance#backup_retention_period
────────────────────────────────────────────────────────────────────────────────


Result #27 MEDIUM Instance does not have Deletion Protection enabled 
────────────────────────────────────────────────────────────────────────────────
  rds.tf:1-16
────────────────────────────────────────────────────────────────────────────────
    1  ┌ resource "aws_db_instance" "tipstaff_db" {
    2  │   allocated_storage           = local.application_data.accounts[local.environment].allocated_storage
    3  │   db_name                     = local.application_data.accounts[local.environment].db_name
    4  │   storage_type                = local.application_data.accounts[local.environment].storage_type
    5  │   engine                      = local.application_data.accounts[local.environment].engine
    6  │   identifier                  = local.application_data.accounts[local.environment].identifier
    7  │   engine_version              = local.application_data.accounts[local.environment].engine_version
    8  │   instance_class              = local.application_data.accounts[local.environment].instance_class
    9  └   username                    = local.application_data.accounts[local.environment].db_username
   ..  
────────────────────────────────────────────────────────────────────────────────
  Rego Package builtin.aws.rds.aws0177
     Rego Rule deny
────────────────────────────────────────────────────────────────────────────────


Result #28 LOW Security group explicitly uses the default description. 
────────────────────────────────────────────────────────────────────────────────
  ecs.tf:213-231
────────────────────────────────────────────────────────────────────────────────
  213  ┌ resource "aws_security_group" "ecs_service" {
  214  │   name_prefix = "ecs-service-sg-"
  215  │   vpc_id      = data.aws_vpc.shared.id
  216  │ 
  217  │   ingress {
  218  │     from_port       = 80
  219  │     to_port         = 80
  220  │     protocol        = "tcp"
  221  └     description     = "Allow traffic on port 80 from load balancer"
  ...  
────────────────────────────────────────────────────────────────────────────────
          ID aws-ec2-add-description-to-security-group
      Impact Descriptions provide context for the firewall rule reasons
  Resolution Add descriptions for all security groups

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/ec2/add-description-to-security-group/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule
────────────────────────────────────────────────────────────────────────────────


Result #29 LOW Security group rule does not have a description. 
────────────────────────────────────────────────────────────────────────────────
  ecs.tf:225-230
────────────────────────────────────────────────────────────────────────────────
  213    resource "aws_security_group" "ecs_service" {
  ...  
  225  ┌   egress {
  226  │     from_port   = 0
  227  │     to_port     = 0
  228  │     protocol    = "-1"
  229  │     cidr_blocks = ["0.0.0.0/0"]
  230  └   }
  231    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-ec2-add-description-to-security-group-rule
      Impact Descriptions provide context for the firewall rule reasons
  Resolution Add descriptions for all security groups rules

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/ec2/add-description-to-security-group-rule/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule
────────────────────────────────────────────────────────────────────────────────


Result #30 LOW Repository is not encrypted using KMS. 
────────────────────────────────────────────────────────────────────────────────
  ecs.tf:233-236
────────────────────────────────────────────────────────────────────────────────
  233    resource "aws_ecr_repository" "tipstaff_ecr_repo" {
  234      name         = "tipstaff-ecr-repo"
  235      force_delete = true
  236    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-ecr-repository-customer-key
      Impact Using AWS managed keys does not allow for fine grained control
  Resolution Use customer managed keys

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/ecr/repository-customer-key/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_repository#encryption_configuration
────────────────────────────────────────────────────────────────────────────────


Result #31 LOW Log group is not encrypted. 
────────────────────────────────────────────────────────────────────────────────
  ecs.tf:9-12
────────────────────────────────────────────────────────────────────────────────
    9    resource "aws_cloudwatch_log_group" "deployment_logs" {
   10      name              = "/aws/events/deploymentLogs"
   11      retention_in_days = "7"
   12    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-cloudwatch-log-group-customer-key
      Impact Log data may be leaked if the logs are compromised. No auditing of who have viewed the logs.
  Resolution Enable CMK encryption of CloudWatch Log Groups

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/cloudwatch/log-group-customer-key/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group#kms_key_id
────────────────────────────────────────────────────────────────────────────────


Result #32 LOW Security group rule does not have a description. 
────────────────────────────────────────────────────────────────────────────────
  load_balancer.tf:15-46
────────────────────────────────────────────────────────────────────────────────
    1    resource "aws_security_group" "tipstaff_lb_sc" {
    .  
   15  ┌   ingress {
   16  │     from_port = 443
   17  │     to_port   = 443
   18  │     protocol  = "tcp"
   19  │     cidr_blocks = [
   20  │       "178.248.34.44/32",
   21  └       "194.33.192.0/25",
   ..  
────────────────────────────────────────────────────────────────────────────────
          ID aws-ec2-add-description-to-security-group-rule
      Impact Descriptions provide context for the firewall rule reasons
  Resolution Add descriptions for all security groups rules

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/ec2/add-description-to-security-group-rule/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule
────────────────────────────────────────────────────────────────────────────────


Result #33 LOW Security group rule does not have a description. 
────────────────────────────────────────────────────────────────────────────────
  load_balancer.tf:49-62
────────────────────────────────────────────────────────────────────────────────
    1    resource "aws_security_group" "tipstaff_lb_sc" {
    .  
   49  ┌   ingress {
   50  │     from_port = 443
   51  │     to_port   = 443
   52  │     protocol  = "tcp"
   53  │     cidr_blocks = [
   54  │       "194.33.196.47/32",
   55  └       "194.33.192.6/32",
   ..  
────────────────────────────────────────────────────────────────────────────────
          ID aws-ec2-add-description-to-security-group-rule
      Impact Descriptions provide context for the firewall rule reasons
  Resolution Add descriptions for all security groups rules

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/ec2/add-description-to-security-group-rule/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule
────────────────────────────────────────────────────────────────────────────────


Result #34 LOW Security group rule does not have a description. 
────────────────────────────────────────────────────────────────────────────────
  load_balancer.tf:87-132
────────────────────────────────────────────────────────────────────────────────
   81    resource "aws_security_group" "tipstaff_lb_sc_pingdom" {
   82      name        = "load balancer Pingdom security group"
   83      description = "control Pingdom access to the load balancer"
   84      vpc_id      = data.aws_vpc.shared.id
   85    
   86      // Allow all European Pingdom IP addresses
   87  ┌   ingress {
   88  │     from_port = 443
   89  └     to_port   = 443
   ..  
────────────────────────────────────────────────────────────────────────────────
          ID aws-ec2-add-description-to-security-group-rule
      Impact Descriptions provide context for the firewall rule reasons
  Resolution Add descriptions for all security groups rules

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/ec2/add-description-to-security-group-rule/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule
────────────────────────────────────────────────────────────────────────────────


Result #35 LOW Instance does not have performance insights enabled. 
────────────────────────────────────────────────────────────────────────────────
  rds.tf:1-16
────────────────────────────────────────────────────────────────────────────────
    1  ┌ resource "aws_db_instance" "tipstaff_db" {
    2  │   allocated_storage           = local.application_data.accounts[local.environment].allocated_storage
    3  │   db_name                     = local.application_data.accounts[local.environment].db_name
    4  │   storage_type                = local.application_data.accounts[local.environment].storage_type
    5  │   engine                      = local.application_data.accounts[local.environment].engine
    6  │   identifier                  = local.application_data.accounts[local.environment].identifier
    7  │   engine_version              = local.application_data.accounts[local.environment].engine_version
    8  │   instance_class              = local.application_data.accounts[local.environment].instance_class
    9  └   username                    = local.application_data.accounts[local.environment].db_username
   ..  
────────────────────────────────────────────────────────────────────────────────
          ID aws-rds-enable-performance-insights
      Impact Without adequate monitoring, performance related issues may go unreported and potentially lead to compromise.
  Resolution Enable performance insights

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/rds/enable-performance-insights/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/rds_cluster_instance#performance_insights_kms_key_id
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance#performance_insights_kms_key_id
────────────────────────────────────────────────────────────────────────────────


  timings
  ──────────────────────────────────────────
  disk i/o             701.866µs
  parsing              1.170489608s
  adaptation           2.952388ms
  checks               35.156785ms
  total                1.209300647s

  counts
  ──────────────────────────────────────────
  modules downloaded   2
  modules processed    3
  blocks processed     188
  files read           25

  results
  ──────────────────────────────────────────
  passed               47
  ignored              29
  critical             12
  high                 13
  medium               2
  low                  8

  47 passed, 29 ignored, 35 potential problem(s) detected.

tfsec_exitcode=1

`Checkov Scan` Failed

Show Output

*****************************

Checkov will check the following folders:
terraform/environments/tipstaff

*****************************

Running Checkov in terraform/environments/tipstaff
2023-11-13 15:29:32,584 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-pagerduty-integration?ref=v2.0.0:None (for external modules, the --download-external-modules flag is required)
2023-11-13 15:29:32,585 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0:None (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 66, Failed checks: 41, Skipped checks: 0

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: bastion_linux
	File: /ec2_bastion_linux.tf:2-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		2  | module "bastion_linux" {
		3  |   source = "github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0"
		4  | 
		5  |   providers = {
		6  |     aws.share-host   = aws.core-vpc # core-vpc-(environment) holds the networking for all accounts
		7  |     aws.share-tenant = aws          # The default provider (unaliased, `aws`) is the tenant
		8  |   }
		9  |   # s3 - used for logs and user ssh public keys
		10 |   bucket_name          = "bastion-example"
		11 |   bucket_versioning    = true
		12 |   bucket_force_destroy = true
		13 |   # public keys
		14 |   public_key_data = local.public_key_data.keys[local.environment]
		15 |   # logs
		16 |   log_auto_clean       = "Enabled"
		17 |   log_standard_ia_days = 30  # days before moving to IA storage
		18 |   log_glacier_days     = 60  # days before moving to Glacier
		19 |   log_expiry_days      = 180 # days before log expiration
		20 |   # bastion
		21 |   allow_ssh_commands = false
		22 |   app_name           = var.networking[0].application
		23 |   business_unit      = local.vpc_name
		24 |   subnet_set         = local.subnet_set
		25 |   environment        = local.environment
		26 |   region             = "eu-west-2"
		27 | 
		28 |   # Tags
		29 |   tags_common = local.tags
		30 |   tags_prefix = terraform.workspace
		31 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.deployment_logs
	File: /ecs.tf:9-12
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		9  | resource "aws_cloudwatch_log_group" "deployment_logs" {
		10 |   name              = "/aws/events/deploymentLogs"
		11 |   retention_in_days = "7"
		12 | }

Check: CKV_AWS_336: "Ensure ECS containers are limited to read-only access to root filesystems"
	FAILED for resource: aws_ecs_task_definition.tipstaff_task_definition
	File: /ecs.tf:14-80

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_333: "Ensure ECS services do not have public IP addresses assigned to them automatically"
	FAILED for resource: aws_ecs_service.tipstaff_ecs_service
	File: /ecs.tf:82-110

		82  | resource "aws_ecs_service" "tipstaff_ecs_service" {
		83  |   depends_on = [
		84  |     aws_lb_listener.tipstaff_lb
		85  |   ]
		86  | 
		87  |   name                              = var.networking[0].application
		88  |   cluster                           = aws_ecs_cluster.tipstaff_cluster.id
		89  |   task_definition                   = aws_ecs_task_definition.tipstaff_task_definition.arn
		90  |   launch_type                       = "FARGATE"
		91  |   enable_execute_command            = true
		92  |   desired_count                     = 2
		93  |   health_check_grace_period_seconds = 180
		94  | 
		95  |   network_configuration {
		96  |     subnets          = data.aws_subnets.shared-public.ids
		97  |     security_groups  = [aws_security_group.ecs_service.id]
		98  |     assign_public_ip = true
		99  |   }
		100 | 
		101 |   load_balancer {
		102 |     target_group_arn = aws_lb_target_group.tipstaff_target_group.arn
		103 |     container_name   = "tipstaff-container"
		104 |     container_port   = 80
		105 |   }
		106 | 
		107 |   deployment_controller {
		108 |     type = "ECS"
		109 |   }
		110 | }

Check: CKV_AWS_288: "Ensure IAM policies does not allow data exfiltration"
	FAILED for resource: aws_iam_role_policy.app_execution
	File: /ecs.tf:139-160

		139 | resource "aws_iam_role_policy" "app_execution" {
		140 |   name = "execution-${var.networking[0].application}"
		141 |   role = aws_iam_role.app_execution.id
		142 | 
		143 |   policy = <<-EOF
		144 |   {
		145 |     "Version": "2012-10-17",
		146 |     "Statement": [
		147 |       {
		148 |            "Action": [
		149 |               "ecr:*",
		150 |               "logs:CreateLogStream",
		151 |               "logs:PutLogEvents",
		152 |               "secretsmanager:GetSecretValue"
		153 |            ],
		154 |            "Resource": "*",
		155 |            "Effect": "Allow"
		156 |       }
		157 |     ]
		158 |   }
		159 |   EOF
		160 | }

Check: CKV_AWS_289: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: aws_iam_role_policy.app_execution
	File: /ecs.tf:139-160

		139 | resource "aws_iam_role_policy" "app_execution" {
		140 |   name = "execution-${var.networking[0].application}"
		141 |   role = aws_iam_role.app_execution.id
		142 | 
		143 |   policy = <<-EOF
		144 |   {
		145 |     "Version": "2012-10-17",
		146 |     "Statement": [
		147 |       {
		148 |            "Action": [
		149 |               "ecr:*",
		150 |               "logs:CreateLogStream",
		151 |               "logs:PutLogEvents",
		152 |               "secretsmanager:GetSecretValue"
		153 |            ],
		154 |            "Resource": "*",
		155 |            "Effect": "Allow"
		156 |       }
		157 |     ]
		158 |   }
		159 |   EOF
		160 | }

Check: CKV_AWS_355: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_role_policy.app_execution
	File: /ecs.tf:139-160

		139 | resource "aws_iam_role_policy" "app_execution" {
		140 |   name = "execution-${var.networking[0].application}"
		141 |   role = aws_iam_role.app_execution.id
		142 | 
		143 |   policy = <<-EOF
		144 |   {
		145 |     "Version": "2012-10-17",
		146 |     "Statement": [
		147 |       {
		148 |            "Action": [
		149 |               "ecr:*",
		150 |               "logs:CreateLogStream",
		151 |               "logs:PutLogEvents",
		152 |               "secretsmanager:GetSecretValue"
		153 |            ],
		154 |            "Resource": "*",
		155 |            "Effect": "Allow"
		156 |       }
		157 |     ]
		158 |   }
		159 |   EOF
		160 | }

Check: CKV_AWS_290: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_role_policy.app_execution
	File: /ecs.tf:139-160

		139 | resource "aws_iam_role_policy" "app_execution" {
		140 |   name = "execution-${var.networking[0].application}"
		141 |   role = aws_iam_role.app_execution.id
		142 | 
		143 |   policy = <<-EOF
		144 |   {
		145 |     "Version": "2012-10-17",
		146 |     "Statement": [
		147 |       {
		148 |            "Action": [
		149 |               "ecr:*",
		150 |               "logs:CreateLogStream",
		151 |               "logs:PutLogEvents",
		152 |               "secretsmanager:GetSecretValue"
		153 |            ],
		154 |            "Resource": "*",
		155 |            "Effect": "Allow"
		156 |       }
		157 |     ]
		158 |   }
		159 |   EOF
		160 | }

Check: CKV_AWS_286: "Ensure IAM policies does not allow privilege escalation"
	FAILED for resource: aws_iam_role_policy.app_task
	File: /ecs.tf:189-211

		189 | resource "aws_iam_role_policy" "app_task" {
		190 |   name = "task-${var.networking[0].application}"
		191 |   role = aws_iam_role.app_task.id
		192 | 
		193 |   policy = <<-EOF
		194 |   {
		195 |    "Version": "2012-10-17",
		196 |    "Statement": [
		197 |      {
		198 |        "Effect": "Allow",
		199 |         "Action": [
		200 |           "logs:CreateLogStream",
		201 |           "logs:PutLogEvents",
		202 |           "ecr:*",
		203 |           "iam:*",
		204 |           "ec2:*"
		205 |         ],
		206 |        "Resource": "*"
		207 |      }
		208 |    ]
		209 |   }
		210 |   EOF
		211 | }

Check: CKV_AWS_289: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: aws_iam_role_policy.app_task
	File: /ecs.tf:189-211

		189 | resource "aws_iam_role_policy" "app_task" {
		190 |   name = "task-${var.networking[0].application}"
		191 |   role = aws_iam_role.app_task.id
		192 | 
		193 |   policy = <<-EOF
		194 |   {
		195 |    "Version": "2012-10-17",
		196 |    "Statement": [
		197 |      {
		198 |        "Effect": "Allow",
		199 |         "Action": [
		200 |           "logs:CreateLogStream",
		201 |           "logs:PutLogEvents",
		202 |           "ecr:*",
		203 |           "iam:*",
		204 |           "ec2:*"
		205 |         ],
		206 |        "Resource": "*"
		207 |      }
		208 |    ]
		209 |   }
		210 |   EOF
		211 | }

Check: CKV_AWS_355: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_role_policy.app_task
	File: /ecs.tf:189-211

		189 | resource "aws_iam_role_policy" "app_task" {
		190 |   name = "task-${var.networking[0].application}"
		191 |   role = aws_iam_role.app_task.id
		192 | 
		193 |   policy = <<-EOF
		194 |   {
		195 |    "Version": "2012-10-17",
		196 |    "Statement": [
		197 |      {
		198 |        "Effect": "Allow",
		199 |         "Action": [
		200 |           "logs:CreateLogStream",
		201 |           "logs:PutLogEvents",
		202 |           "ecr:*",
		203 |           "iam:*",
		204 |           "ec2:*"
		205 |         ],
		206 |        "Resource": "*"
		207 |      }
		208 |    ]
		209 |   }
		210 |   EOF
		211 | }

Check: CKV_AWS_287: "Ensure IAM policies does not allow credentials exposure"
	FAILED for resource: aws_iam_role_policy.app_task
	File: /ecs.tf:189-211

		189 | resource "aws_iam_role_policy" "app_task" {
		190 |   name = "task-${var.networking[0].application}"
		191 |   role = aws_iam_role.app_task.id
		192 | 
		193 |   policy = <<-EOF
		194 |   {
		195 |    "Version": "2012-10-17",
		196 |    "Statement": [
		197 |      {
		198 |        "Effect": "Allow",
		199 |         "Action": [
		200 |           "logs:CreateLogStream",
		201 |           "logs:PutLogEvents",
		202 |           "ecr:*",
		203 |           "iam:*",
		204 |           "ec2:*"
		205 |         ],
		206 |        "Resource": "*"
		207 |      }
		208 |    ]
		209 |   }
		210 |   EOF
		211 | }

Check: CKV_AWS_290: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_role_policy.app_task
	File: /ecs.tf:189-211

		189 | resource "aws_iam_role_policy" "app_task" {
		190 |   name = "task-${var.networking[0].application}"
		191 |   role = aws_iam_role.app_task.id
		192 | 
		193 |   policy = <<-EOF
		194 |   {
		195 |    "Version": "2012-10-17",
		196 |    "Statement": [
		197 |      {
		198 |        "Effect": "Allow",
		199 |         "Action": [
		200 |           "logs:CreateLogStream",
		201 |           "logs:PutLogEvents",
		202 |           "ecr:*",
		203 |           "iam:*",
		204 |           "ec2:*"
		205 |         ],
		206 |        "Resource": "*"
		207 |      }
		208 |    ]
		209 |   }
		210 |   EOF
		211 | }

Check: CKV_AWS_23: "Ensure every security groups rule has a description"
	FAILED for resource: aws_security_group.ecs_service
	File: /ecs.tf:213-231
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		213 | resource "aws_security_group" "ecs_service" {
		214 |   name_prefix = "ecs-service-sg-"
		215 |   vpc_id      = data.aws_vpc.shared.id
		216 | 
		217 |   ingress {
		218 |     from_port       = 80
		219 |     to_port         = 80
		220 |     protocol        = "tcp"
		221 |     description     = "Allow traffic on port 80 from load balancer"
		222 |     security_groups = [aws_security_group.tipstaff_lb_sc.id]
		223 |   }
		224 | 
		225 |   egress {
		226 |     from_port   = 0
		227 |     to_port     = 0
		228 |     protocol    = "-1"
		229 |     cidr_blocks = ["0.0.0.0/0"]
		230 |   }
		231 | }

Check: CKV_AWS_163: "Ensure ECR image scanning on push is enabled"
	FAILED for resource: aws_ecr_repository.tipstaff_ecr_repo
	File: /ecs.tf:233-236
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-8

		233 | resource "aws_ecr_repository" "tipstaff_ecr_repo" {
		234 |   name         = "tipstaff-ecr-repo"
		235 |   force_delete = true
		236 | }

Check: CKV_AWS_136: "Ensure that ECR repositories are encrypted using KMS"
	FAILED for resource: aws_ecr_repository.tipstaff_ecr_repo
	File: /ecs.tf:233-236
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-ecr-repositories-are-encrypted

		233 | resource "aws_ecr_repository" "tipstaff_ecr_repo" {
		234 |   name         = "tipstaff-ecr-repo"
		235 |   force_delete = true
		236 | }

Check: CKV_AWS_51: "Ensure ECR Image Tags are immutable"
	FAILED for resource: aws_ecr_repository.tipstaff_ecr_repo
	File: /ecs.tf:233-236
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-general-24

		233 | resource "aws_ecr_repository" "tipstaff_ecr_repo" {
		234 |   name         = "tipstaff-ecr-repo"
		235 |   force_delete = true
		236 | }

Check: CKV_AWS_26: "Ensure all data stored in the SNS topic is encrypted"
	FAILED for resource: aws_sns_topic.tipstaff_utilisation_alarm
	File: /ecs.tf:314-317
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-15

		314 | resource "aws_sns_topic" "tipstaff_utilisation_alarm" {
		315 |   count = local.is-development ? 0 : 1
		316 |   name  = "tipstaff_utilisation_alarm"
		317 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: pagerduty_core_alerts_non_prod
	File: /ecs.tf:337-345
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		337 | module "pagerduty_core_alerts_non_prod" {
		338 |   count = local.is-preproduction ? 1 : 0
		339 |   depends_on = [
		340 |     aws_sns_topic.tipstaff_utilisation_alarm
		341 |   ]
		342 |   source                    = "github.com/ministryofjustice/modernisation-platform-terraform-pagerduty-integration?ref=v2.0.0"
		343 |   sns_topics                = [aws_sns_topic.tipstaff_utilisation_alarm[0].name]
		344 |   pagerduty_integration_key = local.pagerduty_integration_keys["tipstaff_non_prod_alarms"]
		345 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: pagerduty_core_alerts_prod
	File: /ecs.tf:348-356
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		348 | module "pagerduty_core_alerts_prod" {
		349 |   count = local.is-production ? 1 : 0
		350 |   depends_on = [
		351 |     aws_sns_topic.tipstaff_utilisation_alarm
		352 |   ]
		353 |   source                    = "github.com/ministryofjustice/modernisation-platform-terraform-pagerduty-integration?ref=v2.0.0"
		354 |   sns_topics                = [aws_sns_topic.tipstaff_utilisation_alarm[0].name]
		355 |   pagerduty_integration_key = local.pagerduty_integration_keys["tipstaff_prod_alarms"]
		356 | }

Check: CKV_AWS_23: "Ensure every security groups rule has a description"
	FAILED for resource: aws_security_group.tipstaff_lb_sc
	File: /load_balancer.tf:1-79
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_23: "Ensure every security groups rule has a description"
	FAILED for resource: aws_security_group.tipstaff_lb_sc_pingdom
	File: /load_balancer.tf:81-133
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_91: "Ensure the ELBv2 (Application/Network) has access logging enabled"
	FAILED for resource: aws_lb.tipstaff_lb
	File: /load_balancer.tf:135-143
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-logging-22

		135 | resource "aws_lb" "tipstaff_lb" {
		136 |   name                       = "tipstaff-load-balancer"
		137 |   load_balancer_type         = "application"
		138 |   security_groups            = [aws_security_group.tipstaff_lb_sc.id, aws_security_group.tipstaff_lb_sc_pingdom.id]
		139 |   subnets                    = data.aws_subnets.shared-public.ids
		140 |   enable_deletion_protection = false
		141 |   internal                   = false
		142 |   depends_on                 = [aws_security_group.tipstaff_lb_sc, aws_security_group.tipstaff_lb_sc_pingdom]
		143 | }

Check: CKV_AWS_150: "Ensure that Load Balancer has deletion protection enabled"
	FAILED for resource: aws_lb.tipstaff_lb
	File: /load_balancer.tf:135-143
	Guide: https://docs.bridgecrew.io/docs/bc_aws_networking_62

		135 | resource "aws_lb" "tipstaff_lb" {
		136 |   name                       = "tipstaff-load-balancer"
		137 |   load_balancer_type         = "application"
		138 |   security_groups            = [aws_security_group.tipstaff_lb_sc.id, aws_security_group.tipstaff_lb_sc_pingdom.id]
		139 |   subnets                    = data.aws_subnets.shared-public.ids
		140 |   enable_deletion_protection = false
		141 |   internal                   = false
		142 |   depends_on                 = [aws_security_group.tipstaff_lb_sc, aws_security_group.tipstaff_lb_sc_pingdom]
		143 | }

Check: CKV_AWS_131: "Ensure that ALB drops HTTP headers"
	FAILED for resource: aws_lb.tipstaff_lb
	File: /load_balancer.tf:135-143
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-alb-drops-http-headers

		135 | resource "aws_lb" "tipstaff_lb" {
		136 |   name                       = "tipstaff-load-balancer"
		137 |   load_balancer_type         = "application"
		138 |   security_groups            = [aws_security_group.tipstaff_lb_sc.id, aws_security_group.tipstaff_lb_sc_pingdom.id]
		139 |   subnets                    = data.aws_subnets.shared-public.ids
		140 |   enable_deletion_protection = false
		141 |   internal                   = false
		142 |   depends_on                 = [aws_security_group.tipstaff_lb_sc, aws_security_group.tipstaff_lb_sc_pingdom]
		143 | }

Check: CKV_AWS_261: "Ensure HTTP HTTPS Target group defines Healthcheck"
	FAILED for resource: aws_lb_target_group.tipstaff_target_group
	File: /load_balancer.tf:145-167
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-kendra-index-server-side-encryption-uses-customer-managed-keys-cmks

		145 | resource "aws_lb_target_group" "tipstaff_target_group" {
		146 |   name                 = "tipstaff-target-group"
		147 |   port                 = 80
		148 |   protocol             = "HTTP"
		149 |   vpc_id               = data.aws_vpc.shared.id
		150 |   target_type          = "ip"
		151 |   deregistration_delay = 30
		152 | 
		153 |   stickiness {
		154 |     type = "lb_cookie"
		155 |   }
		156 | 
		157 |   health_check {
		158 |     healthy_threshold   = "3"
		159 |     interval            = "30"
		160 |     protocol            = "HTTP"
		161 |     port                = "80"
		162 |     unhealthy_threshold = "5"
		163 |     matcher             = "200-302"
		164 |     timeout             = "10"
		165 |   }
		166 | 
		167 | }

Check: CKV_AWS_226: "Ensure DB instance gets all minor upgrades automatically"
	FAILED for resource: aws_db_instance.tipstaff_db
	File: /rds.tf:1-16
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-db-instance-gets-all-minor-upgrades-automatically

		1  | resource "aws_db_instance" "tipstaff_db" {
		2  |   allocated_storage           = local.application_data.accounts[local.environment].allocated_storage
		3  |   db_name                     = local.application_data.accounts[local.environment].db_name
		4  |   storage_type                = local.application_data.accounts[local.environment].storage_type
		5  |   engine                      = local.application_data.accounts[local.environment].engine
		6  |   identifier                  = local.application_data.accounts[local.environment].identifier
		7  |   engine_version              = local.application_data.accounts[local.environment].engine_version
		8  |   instance_class              = local.application_data.accounts[local.environment].instance_class
		9  |   username                    = local.application_data.accounts[local.environment].db_username
		10 |   password                    = random_password.password.result
		11 |   skip_final_snapshot         = true
		12 |   publicly_accessible         = true
		13 |   vpc_security_group_ids      = [aws_security_group.postgresql_db_sc.id]
		14 |   db_subnet_group_name        = aws_db_subnet_group.dbsubnetgroup.name
		15 |   allow_major_version_upgrade = true
		16 | }

Check: CKV_AWS_17: "Ensure all data stored in RDS is not publicly accessible"
	FAILED for resource: aws_db_instance.tipstaff_db
	File: /rds.tf:1-16
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/public-policies/public-2

		1  | resource "aws_db_instance" "tipstaff_db" {
		2  |   allocated_storage           = local.application_data.accounts[local.environment].allocated_storage
		3  |   db_name                     = local.application_data.accounts[local.environment].db_name
		4  |   storage_type                = local.application_data.accounts[local.environment].storage_type
		5  |   engine                      = local.application_data.accounts[local.environment].engine
		6  |   identifier                  = local.application_data.accounts[local.environment].identifier
		7  |   engine_version              = local.application_data.accounts[local.environment].engine_version
		8  |   instance_class              = local.application_data.accounts[local.environment].instance_class
		9  |   username                    = local.application_data.accounts[local.environment].db_username
		10 |   password                    = random_password.password.result
		11 |   skip_final_snapshot         = true
		12 |   publicly_accessible         = true
		13 |   vpc_security_group_ids      = [aws_security_group.postgresql_db_sc.id]
		14 |   db_subnet_group_name        = aws_db_subnet_group.dbsubnetgroup.name
		15 |   allow_major_version_upgrade = true
		16 | }

Check: CKV_AWS_118: "Ensure that enhanced monitoring is enabled for Amazon RDS instances"
	FAILED for resource: aws_db_instance.tipstaff_db
	File: /rds.tf:1-16
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/ensure-that-enhanced-monitoring-is-enabled-for-amazon-rds-instances

		1  | resource "aws_db_instance" "tipstaff_db" {
		2  |   allocated_storage           = local.application_data.accounts[local.environment].allocated_storage
		3  |   db_name                     = local.application_data.accounts[local.environment].db_name
		4  |   storage_type                = local.application_data.accounts[local.environment].storage_type
		5  |   engine                      = local.application_data.accounts[local.environment].engine
		6  |   identifier                  = local.application_data.accounts[local.environment].identifier
		7  |   engine_version              = local.application_data.accounts[local.environment].engine_version
		8  |   instance_class              = local.application_data.accounts[local.environment].instance_class
		9  |   username                    = local.application_data.accounts[local.environment].db_username
		10 |   password                    = random_password.password.result
		11 |   skip_final_snapshot         = true
		12 |   publicly_accessible         = true
		13 |   vpc_security_group_ids      = [aws_security_group.postgresql_db_sc.id]
		14 |   db_subnet_group_name        = aws_db_subnet_group.dbsubnetgroup.name
		15 |   allow_major_version_upgrade = true
		16 | }

Check: CKV_AWS_293: "Ensure that AWS database instances have deletion protection enabled"
	FAILED for resource: aws_db_instance.tipstaff_db
	File: /rds.tf:1-16

		1  | resource "aws_db_instance" "tipstaff_db" {
		2  |   allocated_storage           = local.application_data.accounts[local.environment].allocated_storage
		3  |   db_name                     = local.application_data.accounts[local.environment].db_name
		4  |   storage_type                = local.application_data.accounts[local.environment].storage_type
		5  |   engine                      = local.application_data.accounts[local.environment].engine
		6  |   identifier                  = local.application_data.accounts[local.environment].identifier
		7  |   engine_version              = local.application_data.accounts[local.environment].engine_version
		8  |   instance_class              = local.application_data.accounts[local.environment].instance_class
		9  |   username                    = local.application_data.accounts[local.environment].db_username
		10 |   password                    = random_password.password.result
		11 |   skip_final_snapshot         = true
		12 |   publicly_accessible         = true
		13 |   vpc_security_group_ids      = [aws_security_group.postgresql_db_sc.id]
		14 |   db_subnet_group_name        = aws_db_subnet_group.dbsubnetgroup.name
		15 |   allow_major_version_upgrade = true
		16 | }

Check: CKV_AWS_129: "Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled"
	FAILED for resource: aws_db_instance.tipstaff_db
	File: /rds.tf:1-16
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-that-respective-logs-of-amazon-relational-database-service-amazon-rds-are-enabled

		1  | resource "aws_db_instance" "tipstaff_db" {
		2  |   allocated_storage           = local.application_data.accounts[local.environment].allocated_storage
		3  |   db_name                     = local.application_data.accounts[local.environment].db_name
		4  |   storage_type                = local.application_data.accounts[local.environment].storage_type
		5  |   engine                      = local.application_data.accounts[local.environment].engine
		6  |   identifier                  = local.application_data.accounts[local.environment].identifier
		7  |   engine_version              = local.application_data.accounts[local.environment].engine_version
		8  |   instance_class              = local.application_data.accounts[local.environment].instance_class
		9  |   username                    = local.application_data.accounts[local.environment].db_username
		10 |   password                    = random_password.password.result
		11 |   skip_final_snapshot         = true
		12 |   publicly_accessible         = true
		13 |   vpc_security_group_ids      = [aws_security_group.postgresql_db_sc.id]
		14 |   db_subnet_group_name        = aws_db_subnet_group.dbsubnetgroup.name
		15 |   allow_major_version_upgrade = true
		16 | }

Check: CKV_AWS_157: "Ensure that RDS instances have Multi-AZ enabled"
	FAILED for resource: aws_db_instance.tipstaff_db
	File: /rds.tf:1-16
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-73

		1  | resource "aws_db_instance" "tipstaff_db" {
		2  |   allocated_storage           = local.application_data.accounts[local.environment].allocated_storage
		3  |   db_name                     = local.application_data.accounts[local.environment].db_name
		4  |   storage_type                = local.application_data.accounts[local.environment].storage_type
		5  |   engine                      = local.application_data.accounts[local.environment].engine
		6  |   identifier                  = local.application_data.accounts[local.environment].identifier
		7  |   engine_version              = local.application_data.accounts[local.environment].engine_version
		8  |   instance_class              = local.application_data.accounts[local.environment].instance_class
		9  |   username                    = local.application_data.accounts[local.environment].db_username
		10 |   password                    = random_password.password.result
		11 |   skip_final_snapshot         = true
		12 |   publicly_accessible         = true
		13 |   vpc_security_group_ids      = [aws_security_group.postgresql_db_sc.id]
		14 |   db_subnet_group_name        = aws_db_subnet_group.dbsubnetgroup.name
		15 |   allow_major_version_upgrade = true
		16 | }

Check: CKV_AWS_16: "Ensure all data stored in the RDS is securely encrypted at rest"
	FAILED for resource: aws_db_instance.tipstaff_db
	File: /rds.tf:1-16
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-4

		1  | resource "aws_db_instance" "tipstaff_db" {
		2  |   allocated_storage           = local.application_data.accounts[local.environment].allocated_storage
		3  |   db_name                     = local.application_data.accounts[local.environment].db_name
		4  |   storage_type                = local.application_data.accounts[local.environment].storage_type
		5  |   engine                      = local.application_data.accounts[local.environment].engine
		6  |   identifier                  = local.application_data.accounts[local.environment].identifier
		7  |   engine_version              = local.application_data.accounts[local.environment].engine_version
		8  |   instance_class              = local.application_data.accounts[local.environment].instance_class
		9  |   username                    = local.application_data.accounts[local.environment].db_username
		10 |   password                    = random_password.password.result
		11 |   skip_final_snapshot         = true
		12 |   publicly_accessible         = true
		13 |   vpc_security_group_ids      = [aws_security_group.postgresql_db_sc.id]
		14 |   db_subnet_group_name        = aws_db_subnet_group.dbsubnetgroup.name
		15 |   allow_major_version_upgrade = true
		16 | }

Check: CKV_AWS_353: "Ensure that RDS instances have performance insights enabled"
	FAILED for resource: aws_db_instance.tipstaff_db
	File: /rds.tf:1-16

		1  | resource "aws_db_instance" "tipstaff_db" {
		2  |   allocated_storage           = local.application_data.accounts[local.environment].allocated_storage
		3  |   db_name                     = local.application_data.accounts[local.environment].db_name
		4  |   storage_type                = local.application_data.accounts[local.environment].storage_type
		5  |   engine                      = local.application_data.accounts[local.environment].engine
		6  |   identifier                  = local.application_data.accounts[local.environment].identifier
		7  |   engine_version              = local.application_data.accounts[local.environment].engine_version
		8  |   instance_class              = local.application_data.accounts[local.environment].instance_class
		9  |   username                    = local.application_data.accounts[local.environment].db_username
		10 |   password                    = random_password.password.result
		11 |   skip_final_snapshot         = true
		12 |   publicly_accessible         = true
		13 |   vpc_security_group_ids      = [aws_security_group.postgresql_db_sc.id]
		14 |   db_subnet_group_name        = aws_db_subnet_group.dbsubnetgroup.name
		15 |   allow_major_version_upgrade = true
		16 | }

Check: CKV_AWS_354: "Ensure RDS Performance Insights are encrypted using KMS CMKs"
	FAILED for resource: aws_db_instance.tipstaff_db
	File: /rds.tf:1-16

		1  | resource "aws_db_instance" "tipstaff_db" {
		2  |   allocated_storage           = local.application_data.accounts[local.environment].allocated_storage
		3  |   db_name                     = local.application_data.accounts[local.environment].db_name
		4  |   storage_type                = local.application_data.accounts[local.environment].storage_type
		5  |   engine                      = local.application_data.accounts[local.environment].engine
		6  |   identifier                  = local.application_data.accounts[local.environment].identifier
		7  |   engine_version              = local.application_data.accounts[local.environment].engine_version
		8  |   instance_class              = local.application_data.accounts[local.environment].instance_class
		9  |   username                    = local.application_data.accounts[local.environment].db_username
		10 |   password                    = random_password.password.result
		11 |   skip_final_snapshot         = true
		12 |   publicly_accessible         = true
		13 |   vpc_security_group_ids      = [aws_security_group.postgresql_db_sc.id]
		14 |   db_subnet_group_name        = aws_db_subnet_group.dbsubnetgroup.name
		15 |   allow_major_version_upgrade = true
		16 | }

Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.rds_db_credentials
	File: /secrets.tf:12-15
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		12 | resource "aws_secretsmanager_secret" "rds_db_credentials" {
		13 |   name                    = "rds-password"
		14 |   recovery_window_in_days = 0
		15 | }

Check: CKV_AWS_192: "Ensure WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell"
	FAILED for resource: aws_wafv2_web_acl.tipstaff_web_acl
	File: /waf.tf:1-36
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-waf-prevents-message-lookup-in-log4j2

		1  | resource "aws_wafv2_web_acl" "tipstaff_web_acl" {
		2  |   name  = "tipstaff-web-acl"
		3  |   scope = "REGIONAL"
		4  | 
		5  |   default_action {
		6  |     allow {}
		7  |   }
		8  | 
		9  |   rule {
		10 |     name     = "common-rule-set"
		11 |     priority = 1
		12 | 
		13 |     override_action {
		14 |       none {}
		15 |     }
		16 | 
		17 |     statement {
		18 |       managed_rule_group_statement {
		19 |         name        = "AWSManagedRulesCommonRuleSet"
		20 |         vendor_name = "AWS"
		21 |       }
		22 |     }
		23 | 
		24 |     visibility_config {
		25 |       cloudwatch_metrics_enabled = true
		26 |       metric_name                = "AWSManagedRulesCommonRuleSetMetrics"
		27 |       sampled_requests_enabled   = true
		28 |     }
		29 |   }
		30 | 
		31 |   visibility_config {
		32 |     cloudwatch_metrics_enabled = true
		33 |     metric_name                = "tipstaff-web-acl"
		34 |     sampled_requests_enabled   = true
		35 |   }
		36 | }

Check: CKV2_AWS_60: "Ensure RDS instance with copy tags to snapshots is enabled"
	FAILED for resource: aws_db_instance.tipstaff_db
	File: /rds.tf:1-16

		1  | resource "aws_db_instance" "tipstaff_db" {
		2  |   allocated_storage           = local.application_data.accounts[local.environment].allocated_storage
		3  |   db_name                     = local.application_data.accounts[local.environment].db_name
		4  |   storage_type                = local.application_data.accounts[local.environment].storage_type
		5  |   engine                      = local.application_data.accounts[local.environment].engine
		6  |   identifier                  = local.application_data.accounts[local.environment].identifier
		7  |   engine_version              = local.application_data.accounts[local.environment].engine_version
		8  |   instance_class              = local.application_data.accounts[local.environment].instance_class
		9  |   username                    = local.application_data.accounts[local.environment].db_username
		10 |   password                    = random_password.password.result
		11 |   skip_final_snapshot         = true
		12 |   publicly_accessible         = true
		13 |   vpc_security_group_ids      = [aws_security_group.postgresql_db_sc.id]
		14 |   db_subnet_group_name        = aws_db_subnet_group.dbsubnetgroup.name
		15 |   allow_major_version_upgrade = true
		16 | }

Check: CKV2_AWS_31: "Ensure WAF2 has a Logging Configuration"
	FAILED for resource: aws_wafv2_web_acl.tipstaff_web_acl
	File: /waf.tf:1-36
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-logging-33

		1  | resource "aws_wafv2_web_acl" "tipstaff_web_acl" {
		2  |   name  = "tipstaff-web-acl"
		3  |   scope = "REGIONAL"
		4  | 
		5  |   default_action {
		6  |     allow {}
		7  |   }
		8  | 
		9  |   rule {
		10 |     name     = "common-rule-set"
		11 |     priority = 1
		12 | 
		13 |     override_action {
		14 |       none {}
		15 |     }
		16 | 
		17 |     statement {
		18 |       managed_rule_group_statement {
		19 |         name        = "AWSManagedRulesCommonRuleSet"
		20 |         vendor_name = "AWS"
		21 |       }
		22 |     }
		23 | 
		24 |     visibility_config {
		25 |       cloudwatch_metrics_enabled = true
		26 |       metric_name                = "AWSManagedRulesCommonRuleSetMetrics"
		27 |       sampled_requests_enabled   = true
		28 |     }
		29 |   }
		30 | 
		31 |   visibility_config {
		32 |     cloudwatch_metrics_enabled = true
		33 |     metric_name                = "tipstaff-web-acl"
		34 |     sampled_requests_enabled   = true
		35 |   }
		36 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.rds_db_credentials
	File: /secrets.tf:12-15

		12 | resource "aws_secretsmanager_secret" "rds_db_credentials" {
		13 |   name                    = "rds-password"
		14 |   recovery_window_in_days = 0
		15 | }

Check: CKV2_AWS_40: "Ensure AWS IAM policy does not allow full IAM privileges"
	FAILED for resource: aws_iam_role_policy.app_task
	File: /ecs.tf:189-211

		189 | resource "aws_iam_role_policy" "app_task" {
		190 |   name = "task-${var.networking[0].application}"
		191 |   role = aws_iam_role.app_task.id
		192 | 
		193 |   policy = <<-EOF
		194 |   {
		195 |    "Version": "2012-10-17",
		196 |    "Statement": [
		197 |      {
		198 |        "Effect": "Allow",
		199 |         "Action": [
		200 |           "logs:CreateLogStream",
		201 |           "logs:PutLogEvents",
		202 |           "ecr:*",
		203 |           "iam:*",
		204 |           "ec2:*"
		205 |         ],
		206 |        "Resource": "*"
		207 |      }
		208 |    ]
		209 |   }
		210 |   EOF
		211 | }


checkov_exitcode=1

`CTFLint Scan` Failed

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing `terraform` plugin...
Installed `terraform` (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.2.1)
tflint will check the following folders:
terraform/environments/tipstaff

*****************************

Running tflint in terraform/environments/tipstaff
Excluding the following checks: terraform_unused_declarations
13 issue(s) found:

Warning: Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/tipstaff/ecs.tf line 39:
  39:           value = "${aws_db_instance.tipstaff_db.address}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.2.1/docs/rules/terraform_deprecated_interpolation.md

Warning: Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/tipstaff/ecs.tf line 43:
  43:           value = "${local.application_data.accounts[local.environment].rds_port}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.2.1/docs/rules/terraform_deprecated_interpolation.md

Warning: Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/tipstaff/ecs.tf line 47:
  47:           value = "${aws_db_instance.tipstaff_db.username}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.2.1/docs/rules/terraform_deprecated_interpolation.md

Warning: Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/tipstaff/ecs.tf line 51:
  51:           value = "${aws_db_instance.tipstaff_db.password}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.2.1/docs/rules/terraform_deprecated_interpolation.md

Warning: Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/tipstaff/ecs.tf line 55:
  55:           value = "${aws_db_instance.tipstaff_db.db_name}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.2.1/docs/rules/terraform_deprecated_interpolation.md

Warning: Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/tipstaff/ecs.tf line 59:
  59:           value = "${local.application_data.accounts[local.environment].support_email}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.2.1/docs/rules/terraform_deprecated_interpolation.md

Warning: Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/tipstaff/ecs.tf line 63:
  63:           value = "${local.application_data.accounts[local.environment].support_team}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.2.1/docs/rules/terraform_deprecated_interpolation.md

Warning: Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/tipstaff/ecs.tf line 67:
  67:           value = "${local.application_data.accounts[local.environment].curserver}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.2.1/docs/rules/terraform_deprecated_interpolation.md

Warning: Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/tipstaff/ecs.tf line 71:
  71:           value = "${local.application_data.accounts[local.environment].client_id}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.2.1/docs/rules/terraform_deprecated_interpolation.md

Warning: Missing version constraint for provider "github" in "required_providers" (terraform_required_providers)

  on terraform/environments/tipstaff/providers.tf line 8:
   8: data "github_ip_ranges" "github_actions_ips" {}

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.2.1/docs/rules/terraform_required_providers.md

Warning: Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/tipstaff/rds.tf line 81:
  81:     always_run = "${timestamp()}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.2.1/docs/rules/terraform_deprecated_interpolation.md

Warning: Missing version constraint for provider "random" in "required_providers" (terraform_required_providers)

  on terraform/environments/tipstaff/secrets.tf line 3:
   3: resource "random_password" "password" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.2.1/docs/rules/terraform_required_providers.md

Warning: Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/tipstaff/secrets.tf line 19:
  19:   secret_string = jsonencode({ "TIPSTAFF_DB_PASSWORD" : "${random_password.password.result}" })

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.2.1/docs/rules/terraform_deprecated_interpolation.md

tflint_exitcode=2

github-actions · 2023-11-13T15:36:08Z

`TFSEC Scan` Failed

Show Output

*****************************

TFSEC will check the following folders:
terraform/environments/tipstaff

*****************************

Running TFSEC in terraform/environments/tipstaff
Excluding the following checks: AWS095

======================================================
tfsec is joining the Trivy family

tfsec will continue to remain available 
for the time being, although our engineering 
attention will be directed at Trivy going forward.

You can read more here: 
https://github.com/aquasecurity/tfsec/discussions/1994
======================================================

Result #1 CRITICAL Security group rule allows egress to multiple public internet addresses. 
────────────────────────────────────────────────────────────────────────────────
  ecs.tf:229
────────────────────────────────────────────────────────────────────────────────
  213    resource "aws_security_group" "ecs_service" {
  ...  
  229  [     cidr_blocks = ["0.0.0.0/0"]
  ...  
  231    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-ec2-no-public-egress-sgr
      Impact Your port is egressing data to the internet
  Resolution Set a more restrictive cidr range

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/ec2/no-public-egress-sgr/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group
────────────────────────────────────────────────────────────────────────────────


Results #2-8 CRITICAL Security group rule allows ingress from public internet. (7 similar results)
────────────────────────────────────────────────────────────────────────────────
  load_balancer.tf:19-45
────────────────────────────────────────────────────────────────────────────────
    1    resource "aws_security_group" "tipstaff_lb_sc" {
    .  
   19  ┌     cidr_blocks = [
   20  │       "178.248.34.44/32",
   21  │       "194.33.192.0/25",
   22  │       "195.59.75.0/24",
   23  │       "178.248.34.45/32",
   24  │       "201.33.21.5/32",
   25  └       "178.248.34.46/32",
   ..  
────────────────────────────────────────────────────────────────────────────────
  Individual Causes
  - load_balancer.tf:1-79 (aws_security_group.tipstaff_lb_sc) 7 instances
────────────────────────────────────────────────────────────────────────────────
          ID aws-ec2-no-public-ingress-sgr
      Impact Your port exposed to the internet
  Resolution Set a more restrictive cidr range

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/ec2/no-public-ingress-sgr/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule#cidr_blocks
────────────────────────────────────────────────────────────────────────────────


Result #9 CRITICAL Security group rule allows egress to multiple public internet addresses. 
────────────────────────────────────────────────────────────────────────────────
  load_balancer.tf:69
────────────────────────────────────────────────────────────────────────────────
    1    resource "aws_security_group" "tipstaff_lb_sc" {
    .  
   69  [     cidr_blocks = ["0.0.0.0/0"]
   ..  
   79    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-ec2-no-public-egress-sgr
      Impact Your port is egressing data to the internet
  Resolution Set a more restrictive cidr range

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/ec2/no-public-egress-sgr/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group
────────────────────────────────────────────────────────────────────────────────


Result #10 CRITICAL Security group rule allows egress to multiple public internet addresses. 
────────────────────────────────────────────────────────────────────────────────
  load_balancer.tf:77
────────────────────────────────────────────────────────────────────────────────
    1    resource "aws_security_group" "tipstaff_lb_sc" {
    .  
   77  [     cidr_blocks = ["0.0.0.0/0"]
   ..  
   79    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-ec2-no-public-egress-sgr
      Impact Your port is egressing data to the internet
  Resolution Set a more restrictive cidr range

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/ec2/no-public-egress-sgr/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group
────────────────────────────────────────────────────────────────────────────────


Result #11 CRITICAL Instance is exposed publicly. 
────────────────────────────────────────────────────────────────────────────────
  rds.tf:12
────────────────────────────────────────────────────────────────────────────────
    1    resource "aws_db_instance" "tipstaff_db" {
    .  
   12  [   publicly_accessible         = true (true)
   ..  
   16    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-rds-no-public-db-access
      Impact The database instance is publicly accessible
  Resolution Set the database to not be publicly accessible

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/rds/no-public-db-access/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance
────────────────────────────────────────────────────────────────────────────────


Result #12 CRITICAL Security group rule allows egress to multiple public internet addresses. 
────────────────────────────────────────────────────────────────────────────────
  rds.tf:55
────────────────────────────────────────────────────────────────────────────────
   23    resource "aws_security_group" "postgresql_db_sc" {
   ..  
   55  [     cidr_blocks = ["0.0.0.0/0"]
   ..  
   58    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-ec2-no-public-egress-sgr
      Impact Your port is egressing data to the internet
  Resolution Set a more restrictive cidr range

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/ec2/no-public-egress-sgr/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group
────────────────────────────────────────────────────────────────────────────────


Result #13 HIGH IAM policy document uses wildcarded action 'ecr:*' 
────────────────────────────────────────────────────────────────────────────────
  ecs.tf:148-153
────────────────────────────────────────────────────────────────────────────────
  139    resource "aws_iam_role_policy" "app_execution" {
  ...  
  148  ┌            "Action": [
  149  │               "ecr:*",
  150  │               "logs:CreateLogStream",
  151  │               "logs:PutLogEvents",
  152  │               "secretsmanager:GetSecretValue"
  153  └            ],
  ...  
  160    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-iam-no-policy-wildcards
      Impact Overly permissive policies may grant access to sensitive resources
  Resolution Specify the exact permissions required, and to which resources they should apply instead of using wildcards.

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/iam/no-policy-wildcards/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document
────────────────────────────────────────────────────────────────────────────────


Result #14 HIGH IAM policy document uses sensitive action 'ecr:*' on wildcarded resource '*' 
────────────────────────────────────────────────────────────────────────────────
  ecs.tf:154
────────────────────────────────────────────────────────────────────────────────
  139    resource "aws_iam_role_policy" "app_execution" {
  ...  
  154  [            "Resource": "*",
  ...  
  160    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-iam-no-policy-wildcards
      Impact Overly permissive policies may grant access to sensitive resources
  Resolution Specify the exact permissions required, and to which resources they should apply instead of using wildcards.

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/iam/no-policy-wildcards/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document
────────────────────────────────────────────────────────────────────────────────


Results #15-17 HIGH IAM policy document uses wildcarded action 'logs:CreateLogStream' (3 similar results)
────────────────────────────────────────────────────────────────────────────────
  ecs.tf:199-205
────────────────────────────────────────────────────────────────────────────────
  189    resource "aws_iam_role_policy" "app_task" {
  ...  
  199  ┌         "Action": [
  200  │           "logs:CreateLogStream",
  201  │           "logs:PutLogEvents",
  202  │           "ecr:*",
  203  │           "iam:*",
  204  │           "ec2:*"
  205  └         ],
  ...  
────────────────────────────────────────────────────────────────────────────────
  Individual Causes
  - ecs.tf:189-211 (aws_iam_role_policy.app_task) 3 instances
────────────────────────────────────────────────────────────────────────────────
          ID aws-iam-no-policy-wildcards
      Impact Overly permissive policies may grant access to sensitive resources
  Resolution Specify the exact permissions required, and to which resources they should apply instead of using wildcards.

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/iam/no-policy-wildcards/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document
────────────────────────────────────────────────────────────────────────────────


Result #18 HIGH IAM policy document uses sensitive action 'logs:CreateLogStream' on wildcarded resource '*' 
────────────────────────────────────────────────────────────────────────────────
  ecs.tf:206
────────────────────────────────────────────────────────────────────────────────
  189    resource "aws_iam_role_policy" "app_task" {
  ...  
  206  [        "Resource": "*"
  ...  
  211    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-iam-no-policy-wildcards
      Impact Overly permissive policies may grant access to sensitive resources
  Resolution Specify the exact permissions required, and to which resources they should apply instead of using wildcards.

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/iam/no-policy-wildcards/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document
────────────────────────────────────────────────────────────────────────────────


Result #19 HIGH Image scanning is not enabled. 
────────────────────────────────────────────────────────────────────────────────
  ecs.tf:233-236
────────────────────────────────────────────────────────────────────────────────
  233    resource "aws_ecr_repository" "tipstaff_ecr_repo" {
  234      name         = "tipstaff-ecr-repo"
  235      force_delete = true
  236    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-ecr-enable-image-scans
      Impact The ability to scan images is not being used and vulnerabilities will not be highlighted
  Resolution Enable ECR image scanning

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/ecr/enable-image-scans/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_repository#image_scanning_configuration
────────────────────────────────────────────────────────────────────────────────


Result #20 HIGH Repository tags are mutable. 
────────────────────────────────────────────────────────────────────────────────
  ecs.tf:233-236
────────────────────────────────────────────────────────────────────────────────
  233    resource "aws_ecr_repository" "tipstaff_ecr_repo" {
  234      name         = "tipstaff-ecr-repo"
  235      force_delete = true
  236    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-ecr-enforce-immutable-repository
      Impact Image tags could be overwritten with compromised images
  Resolution Only use immutable images in ECR

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/ecr/enforce-immutable-repository/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_repository
────────────────────────────────────────────────────────────────────────────────


Result #21 HIGH Topic does not have encryption enabled. 
────────────────────────────────────────────────────────────────────────────────
  ecs.tf:314-317
────────────────────────────────────────────────────────────────────────────────
  314    resource "aws_sns_topic" "tipstaff_utilisation_alarm" {
  315      count = local.is-development ? 0 : 1
  316      name  = "tipstaff_utilisation_alarm"
  317    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-sns-enable-topic-encryption
      Impact The SNS topic messages could be read if compromised
  Resolution Turn on SNS Topic encryption

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/sns/enable-topic-encryption/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sns_topic#example-with-server-side-encryption-sse
────────────────────────────────────────────────────────────────────────────────


Result #22 HIGH Application load balancer is not set to drop invalid headers. 
────────────────────────────────────────────────────────────────────────────────
  load_balancer.tf:135-143
────────────────────────────────────────────────────────────────────────────────
  135    resource "aws_lb" "tipstaff_lb" {
  136      name                       = "tipstaff-load-balancer"
  137      load_balancer_type         = "application"
  138      security_groups            = [aws_security_group.tipstaff_lb_sc.id, aws_security_group.tipstaff_lb_sc_pingdom.id]
  139      subnets                    = data.aws_subnets.shared-public.ids
  140      enable_deletion_protection = false
  141      internal                   = false
  142      depends_on                 = [aws_security_group.tipstaff_lb_sc, aws_security_group.tipstaff_lb_sc_pingdom]
  143    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-elb-drop-invalid-headers
      Impact Invalid headers being passed through to the target of the load balance may exploit vulnerabilities
  Resolution Set drop_invalid_header_fields to true

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/elb/drop-invalid-headers/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb#drop_invalid_header_fields
────────────────────────────────────────────────────────────────────────────────


Result #23 HIGH Load balancer is exposed publicly. 
────────────────────────────────────────────────────────────────────────────────
  load_balancer.tf:141
────────────────────────────────────────────────────────────────────────────────
  135    resource "aws_lb" "tipstaff_lb" {
  136      name                       = "tipstaff-load-balancer"
  137      load_balancer_type         = "application"
  138      security_groups            = [aws_security_group.tipstaff_lb_sc.id, aws_security_group.tipstaff_lb_sc_pingdom.id]
  139      subnets                    = data.aws_subnets.shared-public.ids
  140      enable_deletion_protection = false
  141  [   internal                   = false (false)
  142      depends_on                 = [aws_security_group.tipstaff_lb_sc, aws_security_group.tipstaff_lb_sc_pingdom]
  143    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-elb-alb-not-public
      Impact The load balancer is exposed on the internet
  Resolution Switch to an internal load balancer or add a tfsec ignore

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/elb/alb-not-public/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb
────────────────────────────────────────────────────────────────────────────────


Result #24 HIGH Instance does not have storage encryption enabled. 
────────────────────────────────────────────────────────────────────────────────
  rds.tf:1-16
────────────────────────────────────────────────────────────────────────────────
    1  ┌ resource "aws_db_instance" "tipstaff_db" {
    2  │   allocated_storage           = local.application_data.accounts[local.environment].allocated_storage
    3  │   db_name                     = local.application_data.accounts[local.environment].db_name
    4  │   storage_type                = local.application_data.accounts[local.environment].storage_type
    5  │   engine                      = local.application_data.accounts[local.environment].engine
    6  │   identifier                  = local.application_data.accounts[local.environment].identifier
    7  │   engine_version              = local.application_data.accounts[local.environment].engine_version
    8  │   instance_class              = local.application_data.accounts[local.environment].instance_class
    9  └   username                    = local.application_data.accounts[local.environment].db_username
   ..  
────────────────────────────────────────────────────────────────────────────────
          ID aws-rds-encrypt-instance-storage-data
      Impact Data can be read from RDS instances if compromised
  Resolution Enable encryption for RDS instances

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/rds/encrypt-instance-storage-data/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance
────────────────────────────────────────────────────────────────────────────────


Result #25 HIGH Instance has Public Access enabled 
────────────────────────────────────────────────────────────────────────────────
  rds.tf:12
────────────────────────────────────────────────────────────────────────────────
   12      publicly_accessible         = true
────────────────────────────────────────────────────────────────────────────────
  Rego Package builtin.aws.rds.aws0180
     Rego Rule deny
────────────────────────────────────────────────────────────────────────────────


Result #26 MEDIUM Instance has very low backup retention period. 
────────────────────────────────────────────────────────────────────────────────
  rds.tf:1-16
────────────────────────────────────────────────────────────────────────────────
    1  ┌ resource "aws_db_instance" "tipstaff_db" {
    2  │   allocated_storage           = local.application_data.accounts[local.environment].allocated_storage
    3  │   db_name                     = local.application_data.accounts[local.environment].db_name
    4  │   storage_type                = local.application_data.accounts[local.environment].storage_type
    5  │   engine                      = local.application_data.accounts[local.environment].engine
    6  │   identifier                  = local.application_data.accounts[local.environment].identifier
    7  │   engine_version              = local.application_data.accounts[local.environment].engine_version
    8  │   instance_class              = local.application_data.accounts[local.environment].instance_class
    9  └   username                    = local.application_data.accounts[local.environment].db_username
   ..  
────────────────────────────────────────────────────────────────────────────────
          ID aws-rds-specify-backup-retention
      Impact Potential loss of data and short opportunity for recovery
  Resolution Explicitly set the retention period to greater than the default

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/rds/specify-backup-retention/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/rds_cluster#backup_retention_period
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance#backup_retention_period
────────────────────────────────────────────────────────────────────────────────


Result #27 MEDIUM Instance does not have Deletion Protection enabled 
────────────────────────────────────────────────────────────────────────────────
  rds.tf:1-16
────────────────────────────────────────────────────────────────────────────────
    1  ┌ resource "aws_db_instance" "tipstaff_db" {
    2  │   allocated_storage           = local.application_data.accounts[local.environment].allocated_storage
    3  │   db_name                     = local.application_data.accounts[local.environment].db_name
    4  │   storage_type                = local.application_data.accounts[local.environment].storage_type
    5  │   engine                      = local.application_data.accounts[local.environment].engine
    6  │   identifier                  = local.application_data.accounts[local.environment].identifier
    7  │   engine_version              = local.application_data.accounts[local.environment].engine_version
    8  │   instance_class              = local.application_data.accounts[local.environment].instance_class
    9  └   username                    = local.application_data.accounts[local.environment].db_username
   ..  
────────────────────────────────────────────────────────────────────────────────
  Rego Package builtin.aws.rds.aws0177
     Rego Rule deny
────────────────────────────────────────────────────────────────────────────────


Result #28 LOW Security group explicitly uses the default description. 
────────────────────────────────────────────────────────────────────────────────
  ecs.tf:213-231
────────────────────────────────────────────────────────────────────────────────
  213  ┌ resource "aws_security_group" "ecs_service" {
  214  │   name_prefix = "ecs-service-sg-"
  215  │   vpc_id      = data.aws_vpc.shared.id
  216  │ 
  217  │   ingress {
  218  │     from_port       = 80
  219  │     to_port         = 80
  220  │     protocol        = "tcp"
  221  └     description     = "Allow traffic on port 80 from load balancer"
  ...  
────────────────────────────────────────────────────────────────────────────────
          ID aws-ec2-add-description-to-security-group
      Impact Descriptions provide context for the firewall rule reasons
  Resolution Add descriptions for all security groups

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/ec2/add-description-to-security-group/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule
────────────────────────────────────────────────────────────────────────────────


Result #29 LOW Security group rule does not have a description. 
────────────────────────────────────────────────────────────────────────────────
  ecs.tf:225-230
────────────────────────────────────────────────────────────────────────────────
  213    resource "aws_security_group" "ecs_service" {
  ...  
  225  ┌   egress {
  226  │     from_port   = 0
  227  │     to_port     = 0
  228  │     protocol    = "-1"
  229  │     cidr_blocks = ["0.0.0.0/0"]
  230  └   }
  231    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-ec2-add-description-to-security-group-rule
      Impact Descriptions provide context for the firewall rule reasons
  Resolution Add descriptions for all security groups rules

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/ec2/add-description-to-security-group-rule/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule
────────────────────────────────────────────────────────────────────────────────


Result #30 LOW Repository is not encrypted using KMS. 
────────────────────────────────────────────────────────────────────────────────
  ecs.tf:233-236
────────────────────────────────────────────────────────────────────────────────
  233    resource "aws_ecr_repository" "tipstaff_ecr_repo" {
  234      name         = "tipstaff-ecr-repo"
  235      force_delete = true
  236    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-ecr-repository-customer-key
      Impact Using AWS managed keys does not allow for fine grained control
  Resolution Use customer managed keys

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/ecr/repository-customer-key/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_repository#encryption_configuration
────────────────────────────────────────────────────────────────────────────────


Result #31 LOW Log group is not encrypted. 
────────────────────────────────────────────────────────────────────────────────
  ecs.tf:9-12
────────────────────────────────────────────────────────────────────────────────
    9    resource "aws_cloudwatch_log_group" "deployment_logs" {
   10      name              = "/aws/events/deploymentLogs"
   11      retention_in_days = "7"
   12    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-cloudwatch-log-group-customer-key
      Impact Log data may be leaked if the logs are compromised. No auditing of who have viewed the logs.
  Resolution Enable CMK encryption of CloudWatch Log Groups

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/cloudwatch/log-group-customer-key/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group#kms_key_id
────────────────────────────────────────────────────────────────────────────────


Result #32 LOW Security group rule does not have a description. 
────────────────────────────────────────────────────────────────────────────────
  load_balancer.tf:15-46
────────────────────────────────────────────────────────────────────────────────
    1    resource "aws_security_group" "tipstaff_lb_sc" {
    .  
   15  ┌   ingress {
   16  │     from_port = 443
   17  │     to_port   = 443
   18  │     protocol  = "tcp"
   19  │     cidr_blocks = [
   20  │       "178.248.34.44/32",
   21  └       "194.33.192.0/25",
   ..  
────────────────────────────────────────────────────────────────────────────────
          ID aws-ec2-add-description-to-security-group-rule
      Impact Descriptions provide context for the firewall rule reasons
  Resolution Add descriptions for all security groups rules

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/ec2/add-description-to-security-group-rule/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule
────────────────────────────────────────────────────────────────────────────────


Result #33 LOW Security group rule does not have a description. 
────────────────────────────────────────────────────────────────────────────────
  load_balancer.tf:49-62
────────────────────────────────────────────────────────────────────────────────
    1    resource "aws_security_group" "tipstaff_lb_sc" {
    .  
   49  ┌   ingress {
   50  │     from_port = 443
   51  │     to_port   = 443
   52  │     protocol  = "tcp"
   53  │     cidr_blocks = [
   54  │       "194.33.196.47/32",
   55  └       "194.33.192.6/32",
   ..  
────────────────────────────────────────────────────────────────────────────────
          ID aws-ec2-add-description-to-security-group-rule
      Impact Descriptions provide context for the firewall rule reasons
  Resolution Add descriptions for all security groups rules

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/ec2/add-description-to-security-group-rule/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule
────────────────────────────────────────────────────────────────────────────────


Result #34 LOW Security group rule does not have a description. 
────────────────────────────────────────────────────────────────────────────────
  load_balancer.tf:87-132
────────────────────────────────────────────────────────────────────────────────
   81    resource "aws_security_group" "tipstaff_lb_sc_pingdom" {
   82      name        = "load balancer Pingdom security group"
   83      description = "control Pingdom access to the load balancer"
   84      vpc_id      = data.aws_vpc.shared.id
   85    
   86      // Allow all European Pingdom IP addresses
   87  ┌   ingress {
   88  │     from_port = 443
   89  └     to_port   = 443
   ..  
────────────────────────────────────────────────────────────────────────────────
          ID aws-ec2-add-description-to-security-group-rule
      Impact Descriptions provide context for the firewall rule reasons
  Resolution Add descriptions for all security groups rules

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/ec2/add-description-to-security-group-rule/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule
────────────────────────────────────────────────────────────────────────────────


Result #35 LOW Instance does not have performance insights enabled. 
────────────────────────────────────────────────────────────────────────────────
  rds.tf:1-16
────────────────────────────────────────────────────────────────────────────────
    1  ┌ resource "aws_db_instance" "tipstaff_db" {
    2  │   allocated_storage           = local.application_data.accounts[local.environment].allocated_storage
    3  │   db_name                     = local.application_data.accounts[local.environment].db_name
    4  │   storage_type                = local.application_data.accounts[local.environment].storage_type
    5  │   engine                      = local.application_data.accounts[local.environment].engine
    6  │   identifier                  = local.application_data.accounts[local.environment].identifier
    7  │   engine_version              = local.application_data.accounts[local.environment].engine_version
    8  │   instance_class              = local.application_data.accounts[local.environment].instance_class
    9  └   username                    = local.application_data.accounts[local.environment].db_username
   ..  
────────────────────────────────────────────────────────────────────────────────
          ID aws-rds-enable-performance-insights
      Impact Without adequate monitoring, performance related issues may go unreported and potentially lead to compromise.
  Resolution Enable performance insights

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/rds/enable-performance-insights/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/rds_cluster_instance#performance_insights_kms_key_id
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance#performance_insights_kms_key_id
────────────────────────────────────────────────────────────────────────────────


  timings
  ──────────────────────────────────────────
  disk i/o             620.702µs
  parsing              1.165568731s
  adaptation           3.368409ms
  checks               47.860833ms
  total                1.217418675s

  counts
  ──────────────────────────────────────────
  modules downloaded   2
  modules processed    3
  blocks processed     188
  files read           25

  results
  ──────────────────────────────────────────
  passed               47
  ignored              29
  critical             12
  high                 13
  medium               2
  low                  8

  47 passed, 29 ignored, 35 potential problem(s) detected.

tfsec_exitcode=1

`Checkov Scan` Failed

Show Output

*****************************

Checkov will check the following folders:
terraform/environments/tipstaff

*****************************

Running Checkov in terraform/environments/tipstaff
2023-11-13 15:36:05,509 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-pagerduty-integration?ref=v2.0.0:None (for external modules, the --download-external-modules flag is required)
2023-11-13 15:36:05,510 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0:None (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 66, Failed checks: 41, Skipped checks: 0

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: bastion_linux
	File: /ec2_bastion_linux.tf:2-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		2  | module "bastion_linux" {
		3  |   source = "github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0"
		4  | 
		5  |   providers = {
		6  |     aws.share-host   = aws.core-vpc # core-vpc-(environment) holds the networking for all accounts
		7  |     aws.share-tenant = aws          # The default provider (unaliased, `aws`) is the tenant
		8  |   }
		9  |   # s3 - used for logs and user ssh public keys
		10 |   bucket_name          = "bastion-example"
		11 |   bucket_versioning    = true
		12 |   bucket_force_destroy = true
		13 |   # public keys
		14 |   public_key_data = local.public_key_data.keys[local.environment]
		15 |   # logs
		16 |   log_auto_clean       = "Enabled"
		17 |   log_standard_ia_days = 30  # days before moving to IA storage
		18 |   log_glacier_days     = 60  # days before moving to Glacier
		19 |   log_expiry_days      = 180 # days before log expiration
		20 |   # bastion
		21 |   allow_ssh_commands = false
		22 |   app_name           = var.networking[0].application
		23 |   business_unit      = local.vpc_name
		24 |   subnet_set         = local.subnet_set
		25 |   environment        = local.environment
		26 |   region             = "eu-west-2"
		27 | 
		28 |   # Tags
		29 |   tags_common = local.tags
		30 |   tags_prefix = terraform.workspace
		31 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.deployment_logs
	File: /ecs.tf:9-12
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		9  | resource "aws_cloudwatch_log_group" "deployment_logs" {
		10 |   name              = "/aws/events/deploymentLogs"
		11 |   retention_in_days = "7"
		12 | }

Check: CKV_AWS_336: "Ensure ECS containers are limited to read-only access to root filesystems"
	FAILED for resource: aws_ecs_task_definition.tipstaff_task_definition
	File: /ecs.tf:14-80

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_333: "Ensure ECS services do not have public IP addresses assigned to them automatically"
	FAILED for resource: aws_ecs_service.tipstaff_ecs_service
	File: /ecs.tf:82-110

		82  | resource "aws_ecs_service" "tipstaff_ecs_service" {
		83  |   depends_on = [
		84  |     aws_lb_listener.tipstaff_lb
		85  |   ]
		86  | 
		87  |   name                              = var.networking[0].application
		88  |   cluster                           = aws_ecs_cluster.tipstaff_cluster.id
		89  |   task_definition                   = aws_ecs_task_definition.tipstaff_task_definition.arn
		90  |   launch_type                       = "FARGATE"
		91  |   enable_execute_command            = true
		92  |   desired_count                     = 2
		93  |   health_check_grace_period_seconds = 180
		94  | 
		95  |   network_configuration {
		96  |     subnets          = data.aws_subnets.shared-public.ids
		97  |     security_groups  = [aws_security_group.ecs_service.id]
		98  |     assign_public_ip = true
		99  |   }
		100 | 
		101 |   load_balancer {
		102 |     target_group_arn = aws_lb_target_group.tipstaff_target_group.arn
		103 |     container_name   = "tipstaff-container"
		104 |     container_port   = 80
		105 |   }
		106 | 
		107 |   deployment_controller {
		108 |     type = "ECS"
		109 |   }
		110 | }

Check: CKV_AWS_288: "Ensure IAM policies does not allow data exfiltration"
	FAILED for resource: aws_iam_role_policy.app_execution
	File: /ecs.tf:139-160

		139 | resource "aws_iam_role_policy" "app_execution" {
		140 |   name = "execution-${var.networking[0].application}"
		141 |   role = aws_iam_role.app_execution.id
		142 | 
		143 |   policy = <<-EOF
		144 |   {
		145 |     "Version": "2012-10-17",
		146 |     "Statement": [
		147 |       {
		148 |            "Action": [
		149 |               "ecr:*",
		150 |               "logs:CreateLogStream",
		151 |               "logs:PutLogEvents",
		152 |               "secretsmanager:GetSecretValue"
		153 |            ],
		154 |            "Resource": "*",
		155 |            "Effect": "Allow"
		156 |       }
		157 |     ]
		158 |   }
		159 |   EOF
		160 | }

Check: CKV_AWS_289: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: aws_iam_role_policy.app_execution
	File: /ecs.tf:139-160

		139 | resource "aws_iam_role_policy" "app_execution" {
		140 |   name = "execution-${var.networking[0].application}"
		141 |   role = aws_iam_role.app_execution.id
		142 | 
		143 |   policy = <<-EOF
		144 |   {
		145 |     "Version": "2012-10-17",
		146 |     "Statement": [
		147 |       {
		148 |            "Action": [
		149 |               "ecr:*",
		150 |               "logs:CreateLogStream",
		151 |               "logs:PutLogEvents",
		152 |               "secretsmanager:GetSecretValue"
		153 |            ],
		154 |            "Resource": "*",
		155 |            "Effect": "Allow"
		156 |       }
		157 |     ]
		158 |   }
		159 |   EOF
		160 | }

Check: CKV_AWS_355: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_role_policy.app_execution
	File: /ecs.tf:139-160

		139 | resource "aws_iam_role_policy" "app_execution" {
		140 |   name = "execution-${var.networking[0].application}"
		141 |   role = aws_iam_role.app_execution.id
		142 | 
		143 |   policy = <<-EOF
		144 |   {
		145 |     "Version": "2012-10-17",
		146 |     "Statement": [
		147 |       {
		148 |            "Action": [
		149 |               "ecr:*",
		150 |               "logs:CreateLogStream",
		151 |               "logs:PutLogEvents",
		152 |               "secretsmanager:GetSecretValue"
		153 |            ],
		154 |            "Resource": "*",
		155 |            "Effect": "Allow"
		156 |       }
		157 |     ]
		158 |   }
		159 |   EOF
		160 | }

Check: CKV_AWS_290: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_role_policy.app_execution
	File: /ecs.tf:139-160

		139 | resource "aws_iam_role_policy" "app_execution" {
		140 |   name = "execution-${var.networking[0].application}"
		141 |   role = aws_iam_role.app_execution.id
		142 | 
		143 |   policy = <<-EOF
		144 |   {
		145 |     "Version": "2012-10-17",
		146 |     "Statement": [
		147 |       {
		148 |            "Action": [
		149 |               "ecr:*",
		150 |               "logs:CreateLogStream",
		151 |               "logs:PutLogEvents",
		152 |               "secretsmanager:GetSecretValue"
		153 |            ],
		154 |            "Resource": "*",
		155 |            "Effect": "Allow"
		156 |       }
		157 |     ]
		158 |   }
		159 |   EOF
		160 | }

Check: CKV_AWS_286: "Ensure IAM policies does not allow privilege escalation"
	FAILED for resource: aws_iam_role_policy.app_task
	File: /ecs.tf:189-211

		189 | resource "aws_iam_role_policy" "app_task" {
		190 |   name = "task-${var.networking[0].application}"
		191 |   role = aws_iam_role.app_task.id
		192 | 
		193 |   policy = <<-EOF
		194 |   {
		195 |    "Version": "2012-10-17",
		196 |    "Statement": [
		197 |      {
		198 |        "Effect": "Allow",
		199 |         "Action": [
		200 |           "logs:CreateLogStream",
		201 |           "logs:PutLogEvents",
		202 |           "ecr:*",
		203 |           "iam:*",
		204 |           "ec2:*"
		205 |         ],
		206 |        "Resource": "*"
		207 |      }
		208 |    ]
		209 |   }
		210 |   EOF
		211 | }

Check: CKV_AWS_289: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: aws_iam_role_policy.app_task
	File: /ecs.tf:189-211

		189 | resource "aws_iam_role_policy" "app_task" {
		190 |   name = "task-${var.networking[0].application}"
		191 |   role = aws_iam_role.app_task.id
		192 | 
		193 |   policy = <<-EOF
		194 |   {
		195 |    "Version": "2012-10-17",
		196 |    "Statement": [
		197 |      {
		198 |        "Effect": "Allow",
		199 |         "Action": [
		200 |           "logs:CreateLogStream",
		201 |           "logs:PutLogEvents",
		202 |           "ecr:*",
		203 |           "iam:*",
		204 |           "ec2:*"
		205 |         ],
		206 |        "Resource": "*"
		207 |      }
		208 |    ]
		209 |   }
		210 |   EOF
		211 | }

Check: CKV_AWS_355: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_role_policy.app_task
	File: /ecs.tf:189-211

		189 | resource "aws_iam_role_policy" "app_task" {
		190 |   name = "task-${var.networking[0].application}"
		191 |   role = aws_iam_role.app_task.id
		192 | 
		193 |   policy = <<-EOF
		194 |   {
		195 |    "Version": "2012-10-17",
		196 |    "Statement": [
		197 |      {
		198 |        "Effect": "Allow",
		199 |         "Action": [
		200 |           "logs:CreateLogStream",
		201 |           "logs:PutLogEvents",
		202 |           "ecr:*",
		203 |           "iam:*",
		204 |           "ec2:*"
		205 |         ],
		206 |        "Resource": "*"
		207 |      }
		208 |    ]
		209 |   }
		210 |   EOF
		211 | }

Check: CKV_AWS_287: "Ensure IAM policies does not allow credentials exposure"
	FAILED for resource: aws_iam_role_policy.app_task
	File: /ecs.tf:189-211

		189 | resource "aws_iam_role_policy" "app_task" {
		190 |   name = "task-${var.networking[0].application}"
		191 |   role = aws_iam_role.app_task.id
		192 | 
		193 |   policy = <<-EOF
		194 |   {
		195 |    "Version": "2012-10-17",
		196 |    "Statement": [
		197 |      {
		198 |        "Effect": "Allow",
		199 |         "Action": [
		200 |           "logs:CreateLogStream",
		201 |           "logs:PutLogEvents",
		202 |           "ecr:*",
		203 |           "iam:*",
		204 |           "ec2:*"
		205 |         ],
		206 |        "Resource": "*"
		207 |      }
		208 |    ]
		209 |   }
		210 |   EOF
		211 | }

Check: CKV_AWS_290: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_role_policy.app_task
	File: /ecs.tf:189-211

		189 | resource "aws_iam_role_policy" "app_task" {
		190 |   name = "task-${var.networking[0].application}"
		191 |   role = aws_iam_role.app_task.id
		192 | 
		193 |   policy = <<-EOF
		194 |   {
		195 |    "Version": "2012-10-17",
		196 |    "Statement": [
		197 |      {
		198 |        "Effect": "Allow",
		199 |         "Action": [
		200 |           "logs:CreateLogStream",
		201 |           "logs:PutLogEvents",
		202 |           "ecr:*",
		203 |           "iam:*",
		204 |           "ec2:*"
		205 |         ],
		206 |        "Resource": "*"
		207 |      }
		208 |    ]
		209 |   }
		210 |   EOF
		211 | }

Check: CKV_AWS_23: "Ensure every security groups rule has a description"
	FAILED for resource: aws_security_group.ecs_service
	File: /ecs.tf:213-231
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		213 | resource "aws_security_group" "ecs_service" {
		214 |   name_prefix = "ecs-service-sg-"
		215 |   vpc_id      = data.aws_vpc.shared.id
		216 | 
		217 |   ingress {
		218 |     from_port       = 80
		219 |     to_port         = 80
		220 |     protocol        = "tcp"
		221 |     description     = "Allow traffic on port 80 from load balancer"
		222 |     security_groups = [aws_security_group.tipstaff_lb_sc.id]
		223 |   }
		224 | 
		225 |   egress {
		226 |     from_port   = 0
		227 |     to_port     = 0
		228 |     protocol    = "-1"
		229 |     cidr_blocks = ["0.0.0.0/0"]
		230 |   }
		231 | }

Check: CKV_AWS_163: "Ensure ECR image scanning on push is enabled"
	FAILED for resource: aws_ecr_repository.tipstaff_ecr_repo
	File: /ecs.tf:233-236
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-8

		233 | resource "aws_ecr_repository" "tipstaff_ecr_repo" {
		234 |   name         = "tipstaff-ecr-repo"
		235 |   force_delete = true
		236 | }

Check: CKV_AWS_136: "Ensure that ECR repositories are encrypted using KMS"
	FAILED for resource: aws_ecr_repository.tipstaff_ecr_repo
	File: /ecs.tf:233-236
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-ecr-repositories-are-encrypted

		233 | resource "aws_ecr_repository" "tipstaff_ecr_repo" {
		234 |   name         = "tipstaff-ecr-repo"
		235 |   force_delete = true
		236 | }

Check: CKV_AWS_51: "Ensure ECR Image Tags are immutable"
	FAILED for resource: aws_ecr_repository.tipstaff_ecr_repo
	File: /ecs.tf:233-236
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-general-24

		233 | resource "aws_ecr_repository" "tipstaff_ecr_repo" {
		234 |   name         = "tipstaff-ecr-repo"
		235 |   force_delete = true
		236 | }

Check: CKV_AWS_26: "Ensure all data stored in the SNS topic is encrypted"
	FAILED for resource: aws_sns_topic.tipstaff_utilisation_alarm
	File: /ecs.tf:314-317
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-15

		314 | resource "aws_sns_topic" "tipstaff_utilisation_alarm" {
		315 |   count = local.is-development ? 0 : 1
		316 |   name  = "tipstaff_utilisation_alarm"
		317 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: pagerduty_core_alerts_non_prod
	File: /ecs.tf:337-345
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		337 | module "pagerduty_core_alerts_non_prod" {
		338 |   count = local.is-preproduction ? 1 : 0
		339 |   depends_on = [
		340 |     aws_sns_topic.tipstaff_utilisation_alarm
		341 |   ]
		342 |   source                    = "github.com/ministryofjustice/modernisation-platform-terraform-pagerduty-integration?ref=v2.0.0"
		343 |   sns_topics                = [aws_sns_topic.tipstaff_utilisation_alarm[0].name]
		344 |   pagerduty_integration_key = local.pagerduty_integration_keys["tipstaff_non_prod_alarms"]
		345 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: pagerduty_core_alerts_prod
	File: /ecs.tf:348-356
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		348 | module "pagerduty_core_alerts_prod" {
		349 |   count = local.is-production ? 1 : 0
		350 |   depends_on = [
		351 |     aws_sns_topic.tipstaff_utilisation_alarm
		352 |   ]
		353 |   source                    = "github.com/ministryofjustice/modernisation-platform-terraform-pagerduty-integration?ref=v2.0.0"
		354 |   sns_topics                = [aws_sns_topic.tipstaff_utilisation_alarm[0].name]
		355 |   pagerduty_integration_key = local.pagerduty_integration_keys["tipstaff_prod_alarms"]
		356 | }

Check: CKV_AWS_23: "Ensure every security groups rule has a description"
	FAILED for resource: aws_security_group.tipstaff_lb_sc
	File: /load_balancer.tf:1-79
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_23: "Ensure every security groups rule has a description"
	FAILED for resource: aws_security_group.tipstaff_lb_sc_pingdom
	File: /load_balancer.tf:81-133
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_91: "Ensure the ELBv2 (Application/Network) has access logging enabled"
	FAILED for resource: aws_lb.tipstaff_lb
	File: /load_balancer.tf:135-143
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-logging-22

		135 | resource "aws_lb" "tipstaff_lb" {
		136 |   name                       = "tipstaff-load-balancer"
		137 |   load_balancer_type         = "application"
		138 |   security_groups            = [aws_security_group.tipstaff_lb_sc.id, aws_security_group.tipstaff_lb_sc_pingdom.id]
		139 |   subnets                    = data.aws_subnets.shared-public.ids
		140 |   enable_deletion_protection = false
		141 |   internal                   = false
		142 |   depends_on                 = [aws_security_group.tipstaff_lb_sc, aws_security_group.tipstaff_lb_sc_pingdom]
		143 | }

Check: CKV_AWS_150: "Ensure that Load Balancer has deletion protection enabled"
	FAILED for resource: aws_lb.tipstaff_lb
	File: /load_balancer.tf:135-143
	Guide: https://docs.bridgecrew.io/docs/bc_aws_networking_62

		135 | resource "aws_lb" "tipstaff_lb" {
		136 |   name                       = "tipstaff-load-balancer"
		137 |   load_balancer_type         = "application"
		138 |   security_groups            = [aws_security_group.tipstaff_lb_sc.id, aws_security_group.tipstaff_lb_sc_pingdom.id]
		139 |   subnets                    = data.aws_subnets.shared-public.ids
		140 |   enable_deletion_protection = false
		141 |   internal                   = false
		142 |   depends_on                 = [aws_security_group.tipstaff_lb_sc, aws_security_group.tipstaff_lb_sc_pingdom]
		143 | }

Check: CKV_AWS_131: "Ensure that ALB drops HTTP headers"
	FAILED for resource: aws_lb.tipstaff_lb
	File: /load_balancer.tf:135-143
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-alb-drops-http-headers

		135 | resource "aws_lb" "tipstaff_lb" {
		136 |   name                       = "tipstaff-load-balancer"
		137 |   load_balancer_type         = "application"
		138 |   security_groups            = [aws_security_group.tipstaff_lb_sc.id, aws_security_group.tipstaff_lb_sc_pingdom.id]
		139 |   subnets                    = data.aws_subnets.shared-public.ids
		140 |   enable_deletion_protection = false
		141 |   internal                   = false
		142 |   depends_on                 = [aws_security_group.tipstaff_lb_sc, aws_security_group.tipstaff_lb_sc_pingdom]
		143 | }

Check: CKV_AWS_261: "Ensure HTTP HTTPS Target group defines Healthcheck"
	FAILED for resource: aws_lb_target_group.tipstaff_target_group
	File: /load_balancer.tf:145-167
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-kendra-index-server-side-encryption-uses-customer-managed-keys-cmks

		145 | resource "aws_lb_target_group" "tipstaff_target_group" {
		146 |   name                 = "tipstaff-target-group"
		147 |   port                 = 80
		148 |   protocol             = "HTTP"
		149 |   vpc_id               = data.aws_vpc.shared.id
		150 |   target_type          = "ip"
		151 |   deregistration_delay = 30
		152 | 
		153 |   stickiness {
		154 |     type = "lb_cookie"
		155 |   }
		156 | 
		157 |   health_check {
		158 |     healthy_threshold   = "3"
		159 |     interval            = "30"
		160 |     protocol            = "HTTP"
		161 |     port                = "80"
		162 |     unhealthy_threshold = "5"
		163 |     matcher             = "200-302"
		164 |     timeout             = "10"
		165 |   }
		166 | 
		167 | }

Check: CKV_AWS_226: "Ensure DB instance gets all minor upgrades automatically"
	FAILED for resource: aws_db_instance.tipstaff_db
	File: /rds.tf:1-16
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-db-instance-gets-all-minor-upgrades-automatically

		1  | resource "aws_db_instance" "tipstaff_db" {
		2  |   allocated_storage           = local.application_data.accounts[local.environment].allocated_storage
		3  |   db_name                     = local.application_data.accounts[local.environment].db_name
		4  |   storage_type                = local.application_data.accounts[local.environment].storage_type
		5  |   engine                      = local.application_data.accounts[local.environment].engine
		6  |   identifier                  = local.application_data.accounts[local.environment].identifier
		7  |   engine_version              = local.application_data.accounts[local.environment].engine_version
		8  |   instance_class              = local.application_data.accounts[local.environment].instance_class
		9  |   username                    = local.application_data.accounts[local.environment].db_username
		10 |   password                    = random_password.password.result
		11 |   skip_final_snapshot         = true
		12 |   publicly_accessible         = true
		13 |   vpc_security_group_ids      = [aws_security_group.postgresql_db_sc.id]
		14 |   db_subnet_group_name        = aws_db_subnet_group.dbsubnetgroup.name
		15 |   allow_major_version_upgrade = true
		16 | }

Check: CKV_AWS_17: "Ensure all data stored in RDS is not publicly accessible"
	FAILED for resource: aws_db_instance.tipstaff_db
	File: /rds.tf:1-16
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/public-policies/public-2

		1  | resource "aws_db_instance" "tipstaff_db" {
		2  |   allocated_storage           = local.application_data.accounts[local.environment].allocated_storage
		3  |   db_name                     = local.application_data.accounts[local.environment].db_name
		4  |   storage_type                = local.application_data.accounts[local.environment].storage_type
		5  |   engine                      = local.application_data.accounts[local.environment].engine
		6  |   identifier                  = local.application_data.accounts[local.environment].identifier
		7  |   engine_version              = local.application_data.accounts[local.environment].engine_version
		8  |   instance_class              = local.application_data.accounts[local.environment].instance_class
		9  |   username                    = local.application_data.accounts[local.environment].db_username
		10 |   password                    = random_password.password.result
		11 |   skip_final_snapshot         = true
		12 |   publicly_accessible         = true
		13 |   vpc_security_group_ids      = [aws_security_group.postgresql_db_sc.id]
		14 |   db_subnet_group_name        = aws_db_subnet_group.dbsubnetgroup.name
		15 |   allow_major_version_upgrade = true
		16 | }

Check: CKV_AWS_118: "Ensure that enhanced monitoring is enabled for Amazon RDS instances"
	FAILED for resource: aws_db_instance.tipstaff_db
	File: /rds.tf:1-16
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/ensure-that-enhanced-monitoring-is-enabled-for-amazon-rds-instances

		1  | resource "aws_db_instance" "tipstaff_db" {
		2  |   allocated_storage           = local.application_data.accounts[local.environment].allocated_storage
		3  |   db_name                     = local.application_data.accounts[local.environment].db_name
		4  |   storage_type                = local.application_data.accounts[local.environment].storage_type
		5  |   engine                      = local.application_data.accounts[local.environment].engine
		6  |   identifier                  = local.application_data.accounts[local.environment].identifier
		7  |   engine_version              = local.application_data.accounts[local.environment].engine_version
		8  |   instance_class              = local.application_data.accounts[local.environment].instance_class
		9  |   username                    = local.application_data.accounts[local.environment].db_username
		10 |   password                    = random_password.password.result
		11 |   skip_final_snapshot         = true
		12 |   publicly_accessible         = true
		13 |   vpc_security_group_ids      = [aws_security_group.postgresql_db_sc.id]
		14 |   db_subnet_group_name        = aws_db_subnet_group.dbsubnetgroup.name
		15 |   allow_major_version_upgrade = true
		16 | }

Check: CKV_AWS_293: "Ensure that AWS database instances have deletion protection enabled"
	FAILED for resource: aws_db_instance.tipstaff_db
	File: /rds.tf:1-16

		1  | resource "aws_db_instance" "tipstaff_db" {
		2  |   allocated_storage           = local.application_data.accounts[local.environment].allocated_storage
		3  |   db_name                     = local.application_data.accounts[local.environment].db_name
		4  |   storage_type                = local.application_data.accounts[local.environment].storage_type
		5  |   engine                      = local.application_data.accounts[local.environment].engine
		6  |   identifier                  = local.application_data.accounts[local.environment].identifier
		7  |   engine_version              = local.application_data.accounts[local.environment].engine_version
		8  |   instance_class              = local.application_data.accounts[local.environment].instance_class
		9  |   username                    = local.application_data.accounts[local.environment].db_username
		10 |   password                    = random_password.password.result
		11 |   skip_final_snapshot         = true
		12 |   publicly_accessible         = true
		13 |   vpc_security_group_ids      = [aws_security_group.postgresql_db_sc.id]
		14 |   db_subnet_group_name        = aws_db_subnet_group.dbsubnetgroup.name
		15 |   allow_major_version_upgrade = true
		16 | }

Check: CKV_AWS_129: "Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled"
	FAILED for resource: aws_db_instance.tipstaff_db
	File: /rds.tf:1-16
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-that-respective-logs-of-amazon-relational-database-service-amazon-rds-are-enabled

		1  | resource "aws_db_instance" "tipstaff_db" {
		2  |   allocated_storage           = local.application_data.accounts[local.environment].allocated_storage
		3  |   db_name                     = local.application_data.accounts[local.environment].db_name
		4  |   storage_type                = local.application_data.accounts[local.environment].storage_type
		5  |   engine                      = local.application_data.accounts[local.environment].engine
		6  |   identifier                  = local.application_data.accounts[local.environment].identifier
		7  |   engine_version              = local.application_data.accounts[local.environment].engine_version
		8  |   instance_class              = local.application_data.accounts[local.environment].instance_class
		9  |   username                    = local.application_data.accounts[local.environment].db_username
		10 |   password                    = random_password.password.result
		11 |   skip_final_snapshot         = true
		12 |   publicly_accessible         = true
		13 |   vpc_security_group_ids      = [aws_security_group.postgresql_db_sc.id]
		14 |   db_subnet_group_name        = aws_db_subnet_group.dbsubnetgroup.name
		15 |   allow_major_version_upgrade = true
		16 | }

Check: CKV_AWS_157: "Ensure that RDS instances have Multi-AZ enabled"
	FAILED for resource: aws_db_instance.tipstaff_db
	File: /rds.tf:1-16
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-73

		1  | resource "aws_db_instance" "tipstaff_db" {
		2  |   allocated_storage           = local.application_data.accounts[local.environment].allocated_storage
		3  |   db_name                     = local.application_data.accounts[local.environment].db_name
		4  |   storage_type                = local.application_data.accounts[local.environment].storage_type
		5  |   engine                      = local.application_data.accounts[local.environment].engine
		6  |   identifier                  = local.application_data.accounts[local.environment].identifier
		7  |   engine_version              = local.application_data.accounts[local.environment].engine_version
		8  |   instance_class              = local.application_data.accounts[local.environment].instance_class
		9  |   username                    = local.application_data.accounts[local.environment].db_username
		10 |   password                    = random_password.password.result
		11 |   skip_final_snapshot         = true
		12 |   publicly_accessible         = true
		13 |   vpc_security_group_ids      = [aws_security_group.postgresql_db_sc.id]
		14 |   db_subnet_group_name        = aws_db_subnet_group.dbsubnetgroup.name
		15 |   allow_major_version_upgrade = true
		16 | }

Check: CKV_AWS_16: "Ensure all data stored in the RDS is securely encrypted at rest"
	FAILED for resource: aws_db_instance.tipstaff_db
	File: /rds.tf:1-16
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-4

		1  | resource "aws_db_instance" "tipstaff_db" {
		2  |   allocated_storage           = local.application_data.accounts[local.environment].allocated_storage
		3  |   db_name                     = local.application_data.accounts[local.environment].db_name
		4  |   storage_type                = local.application_data.accounts[local.environment].storage_type
		5  |   engine                      = local.application_data.accounts[local.environment].engine
		6  |   identifier                  = local.application_data.accounts[local.environment].identifier
		7  |   engine_version              = local.application_data.accounts[local.environment].engine_version
		8  |   instance_class              = local.application_data.accounts[local.environment].instance_class
		9  |   username                    = local.application_data.accounts[local.environment].db_username
		10 |   password                    = random_password.password.result
		11 |   skip_final_snapshot         = true
		12 |   publicly_accessible         = true
		13 |   vpc_security_group_ids      = [aws_security_group.postgresql_db_sc.id]
		14 |   db_subnet_group_name        = aws_db_subnet_group.dbsubnetgroup.name
		15 |   allow_major_version_upgrade = true
		16 | }

Check: CKV_AWS_353: "Ensure that RDS instances have performance insights enabled"
	FAILED for resource: aws_db_instance.tipstaff_db
	File: /rds.tf:1-16

		1  | resource "aws_db_instance" "tipstaff_db" {
		2  |   allocated_storage           = local.application_data.accounts[local.environment].allocated_storage
		3  |   db_name                     = local.application_data.accounts[local.environment].db_name
		4  |   storage_type                = local.application_data.accounts[local.environment].storage_type
		5  |   engine                      = local.application_data.accounts[local.environment].engine
		6  |   identifier                  = local.application_data.accounts[local.environment].identifier
		7  |   engine_version              = local.application_data.accounts[local.environment].engine_version
		8  |   instance_class              = local.application_data.accounts[local.environment].instance_class
		9  |   username                    = local.application_data.accounts[local.environment].db_username
		10 |   password                    = random_password.password.result
		11 |   skip_final_snapshot         = true
		12 |   publicly_accessible         = true
		13 |   vpc_security_group_ids      = [aws_security_group.postgresql_db_sc.id]
		14 |   db_subnet_group_name        = aws_db_subnet_group.dbsubnetgroup.name
		15 |   allow_major_version_upgrade = true
		16 | }

Check: CKV_AWS_354: "Ensure RDS Performance Insights are encrypted using KMS CMKs"
	FAILED for resource: aws_db_instance.tipstaff_db
	File: /rds.tf:1-16

		1  | resource "aws_db_instance" "tipstaff_db" {
		2  |   allocated_storage           = local.application_data.accounts[local.environment].allocated_storage
		3  |   db_name                     = local.application_data.accounts[local.environment].db_name
		4  |   storage_type                = local.application_data.accounts[local.environment].storage_type
		5  |   engine                      = local.application_data.accounts[local.environment].engine
		6  |   identifier                  = local.application_data.accounts[local.environment].identifier
		7  |   engine_version              = local.application_data.accounts[local.environment].engine_version
		8  |   instance_class              = local.application_data.accounts[local.environment].instance_class
		9  |   username                    = local.application_data.accounts[local.environment].db_username
		10 |   password                    = random_password.password.result
		11 |   skip_final_snapshot         = true
		12 |   publicly_accessible         = true
		13 |   vpc_security_group_ids      = [aws_security_group.postgresql_db_sc.id]
		14 |   db_subnet_group_name        = aws_db_subnet_group.dbsubnetgroup.name
		15 |   allow_major_version_upgrade = true
		16 | }

Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.rds_db_credentials
	File: /secrets.tf:12-15
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		12 | resource "aws_secretsmanager_secret" "rds_db_credentials" {
		13 |   name                    = "rds-password"
		14 |   recovery_window_in_days = 0
		15 | }

Check: CKV_AWS_192: "Ensure WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell"
	FAILED for resource: aws_wafv2_web_acl.tipstaff_web_acl
	File: /waf.tf:1-36
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-waf-prevents-message-lookup-in-log4j2

		1  | resource "aws_wafv2_web_acl" "tipstaff_web_acl" {
		2  |   name  = "tipstaff-web-acl"
		3  |   scope = "REGIONAL"
		4  | 
		5  |   default_action {
		6  |     allow {}
		7  |   }
		8  | 
		9  |   rule {
		10 |     name     = "common-rule-set"
		11 |     priority = 1
		12 | 
		13 |     override_action {
		14 |       none {}
		15 |     }
		16 | 
		17 |     statement {
		18 |       managed_rule_group_statement {
		19 |         name        = "AWSManagedRulesCommonRuleSet"
		20 |         vendor_name = "AWS"
		21 |       }
		22 |     }
		23 | 
		24 |     visibility_config {
		25 |       cloudwatch_metrics_enabled = true
		26 |       metric_name                = "AWSManagedRulesCommonRuleSetMetrics"
		27 |       sampled_requests_enabled   = true
		28 |     }
		29 |   }
		30 | 
		31 |   visibility_config {
		32 |     cloudwatch_metrics_enabled = true
		33 |     metric_name                = "tipstaff-web-acl"
		34 |     sampled_requests_enabled   = true
		35 |   }
		36 | }

Check: CKV2_AWS_60: "Ensure RDS instance with copy tags to snapshots is enabled"
	FAILED for resource: aws_db_instance.tipstaff_db
	File: /rds.tf:1-16

		1  | resource "aws_db_instance" "tipstaff_db" {
		2  |   allocated_storage           = local.application_data.accounts[local.environment].allocated_storage
		3  |   db_name                     = local.application_data.accounts[local.environment].db_name
		4  |   storage_type                = local.application_data.accounts[local.environment].storage_type
		5  |   engine                      = local.application_data.accounts[local.environment].engine
		6  |   identifier                  = local.application_data.accounts[local.environment].identifier
		7  |   engine_version              = local.application_data.accounts[local.environment].engine_version
		8  |   instance_class              = local.application_data.accounts[local.environment].instance_class
		9  |   username                    = local.application_data.accounts[local.environment].db_username
		10 |   password                    = random_password.password.result
		11 |   skip_final_snapshot         = true
		12 |   publicly_accessible         = true
		13 |   vpc_security_group_ids      = [aws_security_group.postgresql_db_sc.id]
		14 |   db_subnet_group_name        = aws_db_subnet_group.dbsubnetgroup.name
		15 |   allow_major_version_upgrade = true
		16 | }

Check: CKV2_AWS_31: "Ensure WAF2 has a Logging Configuration"
	FAILED for resource: aws_wafv2_web_acl.tipstaff_web_acl
	File: /waf.tf:1-36
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-logging-33

		1  | resource "aws_wafv2_web_acl" "tipstaff_web_acl" {
		2  |   name  = "tipstaff-web-acl"
		3  |   scope = "REGIONAL"
		4  | 
		5  |   default_action {
		6  |     allow {}
		7  |   }
		8  | 
		9  |   rule {
		10 |     name     = "common-rule-set"
		11 |     priority = 1
		12 | 
		13 |     override_action {
		14 |       none {}
		15 |     }
		16 | 
		17 |     statement {
		18 |       managed_rule_group_statement {
		19 |         name        = "AWSManagedRulesCommonRuleSet"
		20 |         vendor_name = "AWS"
		21 |       }
		22 |     }
		23 | 
		24 |     visibility_config {
		25 |       cloudwatch_metrics_enabled = true
		26 |       metric_name                = "AWSManagedRulesCommonRuleSetMetrics"
		27 |       sampled_requests_enabled   = true
		28 |     }
		29 |   }
		30 | 
		31 |   visibility_config {
		32 |     cloudwatch_metrics_enabled = true
		33 |     metric_name                = "tipstaff-web-acl"
		34 |     sampled_requests_enabled   = true
		35 |   }
		36 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.rds_db_credentials
	File: /secrets.tf:12-15

		12 | resource "aws_secretsmanager_secret" "rds_db_credentials" {
		13 |   name                    = "rds-password"
		14 |   recovery_window_in_days = 0
		15 | }

Check: CKV2_AWS_40: "Ensure AWS IAM policy does not allow full IAM privileges"
	FAILED for resource: aws_iam_role_policy.app_task
	File: /ecs.tf:189-211

		189 | resource "aws_iam_role_policy" "app_task" {
		190 |   name = "task-${var.networking[0].application}"
		191 |   role = aws_iam_role.app_task.id
		192 | 
		193 |   policy = <<-EOF
		194 |   {
		195 |    "Version": "2012-10-17",
		196 |    "Statement": [
		197 |      {
		198 |        "Effect": "Allow",
		199 |         "Action": [
		200 |           "logs:CreateLogStream",
		201 |           "logs:PutLogEvents",
		202 |           "ecr:*",
		203 |           "iam:*",
		204 |           "ec2:*"
		205 |         ],
		206 |        "Resource": "*"
		207 |      }
		208 |    ]
		209 |   }
		210 |   EOF
		211 | }


checkov_exitcode=1

`CTFLint Scan` Failed

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing `terraform` plugin...
Installed `terraform` (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.2.1)
tflint will check the following folders:
terraform/environments/tipstaff

*****************************

Running tflint in terraform/environments/tipstaff
Excluding the following checks: terraform_unused_declarations
13 issue(s) found:

Warning: Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/tipstaff/ecs.tf line 39:
  39:           value = "${aws_db_instance.tipstaff_db.address}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.2.1/docs/rules/terraform_deprecated_interpolation.md

Warning: Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/tipstaff/ecs.tf line 43:
  43:           value = "${local.application_data.accounts[local.environment].rds_port}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.2.1/docs/rules/terraform_deprecated_interpolation.md

Warning: Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/tipstaff/ecs.tf line 47:
  47:           value = "${aws_db_instance.tipstaff_db.username}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.2.1/docs/rules/terraform_deprecated_interpolation.md

Warning: Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/tipstaff/ecs.tf line 51:
  51:           value = "${aws_db_instance.tipstaff_db.password}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.2.1/docs/rules/terraform_deprecated_interpolation.md

Warning: Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/tipstaff/ecs.tf line 55:
  55:           value = "${aws_db_instance.tipstaff_db.db_name}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.2.1/docs/rules/terraform_deprecated_interpolation.md

Warning: Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/tipstaff/ecs.tf line 59:
  59:           value = "${local.application_data.accounts[local.environment].support_email}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.2.1/docs/rules/terraform_deprecated_interpolation.md

Warning: Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/tipstaff/ecs.tf line 63:
  63:           value = "${local.application_data.accounts[local.environment].support_team}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.2.1/docs/rules/terraform_deprecated_interpolation.md

Warning: Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/tipstaff/ecs.tf line 67:
  67:           value = "${local.application_data.accounts[local.environment].curserver}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.2.1/docs/rules/terraform_deprecated_interpolation.md

Warning: Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/tipstaff/ecs.tf line 71:
  71:           value = "${local.application_data.accounts[local.environment].client_id}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.2.1/docs/rules/terraform_deprecated_interpolation.md

Warning: Missing version constraint for provider "github" in "required_providers" (terraform_required_providers)

  on terraform/environments/tipstaff/providers.tf line 8:
   8: data "github_ip_ranges" "github_actions_ips" {}

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.2.1/docs/rules/terraform_required_providers.md

Warning: Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/tipstaff/rds.tf line 81:
  81:     always_run = "${timestamp()}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.2.1/docs/rules/terraform_deprecated_interpolation.md

Warning: Missing version constraint for provider "random" in "required_providers" (terraform_required_providers)

  on terraform/environments/tipstaff/secrets.tf line 3:
   3: resource "random_password" "password" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.2.1/docs/rules/terraform_required_providers.md

Warning: Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/tipstaff/secrets.tf line 19:
  19:   secret_string = jsonencode({ "TIPSTAFF_DB_PASSWORD" : "${random_password.password.result}" })

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.2.1/docs/rules/terraform_deprecated_interpolation.md

tflint_exitcode=2

Signed-off-by: Jacob Woffenden <[email protected]>

github-actions · 2023-11-13T16:55:29Z

`TFSEC Scan` Success

Show Output

*****************************

TFSEC will check the following folders:

`Checkov Scan` Success

Show Output

*****************************

Checkov will check the following folders:

`CTFLint Scan` Success

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing `terraform` plugin...
Installed `terraform` (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.2.1)
tflint will check the following folders:

github-actions · 2023-11-13T16:56:07Z

`TFSEC Scan` Success

Show Output

*****************************

TFSEC will check the following folders:

`Checkov Scan` Success

Show Output

*****************************

Checkov will check the following folders:

`CTFLint Scan` Success

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing `terraform` plugin...
Installed `terraform` (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.2.1)
tflint will check the following folders:

Signed-off-by: Jacob Woffenden <[email protected]>

github-actions · 2023-11-13T17:02:10Z

`TFSEC Scan` Success

Show Output

*****************************

TFSEC will check the following folders:

`Checkov Scan` Success

Show Output

*****************************

Checkov will check the following folders:

`CTFLint Scan` Success

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing `terraform` plugin...
Installed `terraform` (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.2.1)
tflint will check the following folders:

Signed-off-by: Jacob Woffenden <[email protected]>

github-actions · 2023-11-13T17:13:30Z

`TFSEC Scan` Success

Show Output

*****************************

TFSEC will check the following folders:

`Checkov Scan` Success

Show Output

*****************************

Checkov will check the following folders:

`CTFLint Scan` Success

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing `terraform` plugin...
Installed `terraform` (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.2.1)
tflint will check the following folders:

github-actions · 2023-11-13T17:13:47Z

`TFSEC Scan` Success

Show Output

*****************************

TFSEC will check the following folders:

`Checkov Scan` Success

Show Output

*****************************

Checkov will check the following folders:

`CTFLint Scan` Success

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing `terraform` plugin...
Installed `terraform` (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.2.1)
tflint will check the following folders:

Signed-off-by: Jacob Woffenden <[email protected]>

github-actions · 2023-11-13T17:16:49Z

`TFSEC Scan` Success

Show Output

*****************************

TFSEC will check the following folders:

`Checkov Scan` Success

Show Output

*****************************

Checkov will check the following folders:

`CTFLint Scan` Success

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing `terraform` plugin...
Installed `terraform` (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.2.1)
tflint will check the following folders:

github-actions · 2023-11-13T17:23:01Z

`TFSEC Scan` Success

Show Output

*****************************

TFSEC will check the following folders:

`Checkov Scan` Success

Show Output

*****************************

Checkov will check the following folders:

`CTFLint Scan` Success

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing `terraform` plugin...
Installed `terraform` (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.2.1)
tflint will check the following folders:

✨ Enable EventBridge -> Cloudwatch

0df17f7

Gary-H9 requested a review from a team as a code owner November 13, 2023 13:50

Gary-H9 requested a review from a team November 13, 2023 13:50

Gary-H9 requested review from a team as code owners November 13, 2023 13:50

github-actions bot added the environments-repository Used to exclude PRs from this repo in our Slack PR update label Nov 13, 2023

Gary-H9 had a problem deploying to data-platform-apps-and-tools-development November 13, 2023 13:51 — with GitHub Actions Failure

✏️ Corrections

ae384fc

Gary-H9 had a problem deploying to data-platform-apps-and-tools-development November 13, 2023 14:04 — with GitHub Actions Failure

🔧 Add Cloudwatch Event Bus Data block etc

c6d7921

Gary-H9 added 2 commits November 13, 2023 14:29

🔧 Update prod event source name

b8e929c

🔧 Update event source local

d6d06ae

Gary-H9 had a problem deploying to data-platform-apps-and-tools-development November 13, 2023 14:31 — with GitHub Actions Failure

🧪 Testing condition

c033576

Gary-H9 temporarily deployed to data-platform-apps-and-tools-development November 13, 2023 15:28 — with GitHub Actions Inactive

🔧 Remove *

0951135

Gary-H9 temporarily deployed to data-platform-apps-and-tools-development November 13, 2023 15:34 — with GitHub Actions Inactive

🔧 Remove KMS - troubleshooting

894ec4e

Gary-H9 temporarily deployed to data-platform-apps-and-tools-development November 13, 2023 16:07 — with GitHub Actions Inactive

Add permissions that AWS console adds for you 🤡

47c340a

Signed-off-by: Jacob Woffenden <[email protected]>

jacobwoffenden had a problem deploying to data-platform-apps-and-tools-development November 13, 2023 16:53 — with GitHub Actions Failure

Remove rouge }

a23a5d1

Signed-off-by: Jacob Woffenden <[email protected]>

jacobwoffenden temporarily deployed to data-platform-apps-and-tools-development November 13, 2023 16:55 — with GitHub Actions Inactive

Update Auth0 event source name for prod

b809bf9

Signed-off-by: Jacob Woffenden <[email protected]>

jacobwoffenden temporarily deployed to data-platform-apps-and-tools-development November 13, 2023 17:01 — with GitHub Actions Inactive

jacobwoffenden temporarily deployed to data-platform-apps-and-tools-development November 13, 2023 17:04 — with GitHub Actions Inactive

jacobwoffenden had a problem deploying to data-platform-apps-and-tools-development November 13, 2023 17:08 — with GitHub Actions Failure

Jacob Woffenden added 2 commits November 13, 2023 17:10

remove cloudwatch logs

c5fbf5c

Signed-off-by: Jacob Woffenden <[email protected]>

remove rule

cabcc42

Signed-off-by: Jacob Woffenden <[email protected]>

jacobwoffenden temporarily deployed to data-platform-apps-and-tools-development November 13, 2023 17:12 — with GitHub Actions Inactive

add it back

cfc0010

Signed-off-by: Jacob Woffenden <[email protected]>

jacobwoffenden temporarily deployed to data-platform-apps-and-tools-development November 13, 2023 17:16 — with GitHub Actions Inactive

jacobwoffenden had a problem deploying to data-platform-apps-and-tools-development November 13, 2023 17:19 — with GitHub Actions Failure

🔧 Remove loop

d6ea66e

Gary-H9 temporarily deployed to data-platform-apps-and-tools-development November 13, 2023 17:22 — with GitHub Actions Inactive

jacobwoffenden approved these changes Nov 13, 2023

View reviewed changes

Gary-H9 merged commit 823ca91 into main Nov 13, 2023
12 checks passed

Gary-H9 deleted the eventbridge-logstream branch November 13, 2023 17:25

Gary-H9 mentioned this pull request Nov 14, 2023

Implement Auth0 Log Collection in Modernisation Platform ministryofjustice/analytical-platform#1742

Closed

5 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

✨ Enable EventBridge -> Cloudwatch #3973

✨ Enable EventBridge -> Cloudwatch #3973

Gary-H9 commented Nov 13, 2023

github-actions bot commented Nov 13, 2023

github-actions bot commented Nov 13, 2023

github-actions bot commented Nov 13, 2023

github-actions bot commented Nov 13, 2023

github-actions bot commented Nov 13, 2023

github-actions bot commented Nov 13, 2023

github-actions bot commented Nov 13, 2023

github-actions bot commented Nov 13, 2023

github-actions bot commented Nov 13, 2023

github-actions bot commented Nov 13, 2023

github-actions bot commented Nov 13, 2023

github-actions bot commented Nov 13, 2023

github-actions bot commented Nov 13, 2023

✨ Enable EventBridge -> Cloudwatch #3973

✨ Enable EventBridge -> Cloudwatch #3973

Conversation

Gary-H9 commented Nov 13, 2023

github-actions bot commented Nov 13, 2023

TFSEC Scan Success

Checkov Scan Success

CTFLint Scan Success

github-actions bot commented Nov 13, 2023

TFSEC Scan Success

Checkov Scan Success

CTFLint Scan Success

github-actions bot commented Nov 13, 2023

TFSEC Scan Success

Checkov Scan Success

CTFLint Scan Success

github-actions bot commented Nov 13, 2023

TFSEC Scan Success

Checkov Scan Success

CTFLint Scan Success

github-actions bot commented Nov 13, 2023

TFSEC Scan Failed

Checkov Scan Failed

CTFLint Scan Failed

github-actions bot commented Nov 13, 2023

TFSEC Scan Failed

Checkov Scan Failed

CTFLint Scan Failed

github-actions bot commented Nov 13, 2023

TFSEC Scan Success

Checkov Scan Success

CTFLint Scan Success

github-actions bot commented Nov 13, 2023

TFSEC Scan Success

Checkov Scan Success

CTFLint Scan Success

github-actions bot commented Nov 13, 2023

TFSEC Scan Success

Checkov Scan Success

CTFLint Scan Success

github-actions bot commented Nov 13, 2023

TFSEC Scan Success

Checkov Scan Success

CTFLint Scan Success

github-actions bot commented Nov 13, 2023

TFSEC Scan Success

Checkov Scan Success

CTFLint Scan Success

github-actions bot commented Nov 13, 2023

TFSEC Scan Success

Checkov Scan Success

CTFLint Scan Success

github-actions bot commented Nov 13, 2023

TFSEC Scan Success

Checkov Scan Success

CTFLint Scan Success

`TFSEC Scan` Success

`Checkov Scan` Success

`CTFLint Scan` Success

`TFSEC Scan` Success

`Checkov Scan` Success

`CTFLint Scan` Success

`TFSEC Scan` Success

`Checkov Scan` Success

`CTFLint Scan` Success

`TFSEC Scan` Success

`Checkov Scan` Success

`CTFLint Scan` Success

`TFSEC Scan` Failed

`Checkov Scan` Failed

`CTFLint Scan` Failed

`TFSEC Scan` Failed

`Checkov Scan` Failed

`CTFLint Scan` Failed

`TFSEC Scan` Success

`Checkov Scan` Success

`CTFLint Scan` Success

`TFSEC Scan` Success

`Checkov Scan` Success

`CTFLint Scan` Success

`TFSEC Scan` Success

`Checkov Scan` Success

`CTFLint Scan` Success

`TFSEC Scan` Success

`Checkov Scan` Success

`CTFLint Scan` Success

`TFSEC Scan` Success

`Checkov Scan` Success

`CTFLint Scan` Success

`TFSEC Scan` Success

`Checkov Scan` Success

`CTFLint Scan` Success

`TFSEC Scan` Success

`Checkov Scan` Success

`CTFLint Scan` Success