🇫🇷 😢 Unbootstrapping France. #6959

julialawrence · 2024-05-09T08:54:01Z

A reference to the issue / Description of it

ministryofjustice/analytical-platform#4222
The code enabling Paris region is breaking secure baseline job for Sprinkler because the account isn't enrolled in eu-west-3 security hub. Once that is fixed, the Paris changes can be reapplied in full.

How does this PR fix the problem?

The Paris region has been removed from the list of bootstrapped regions but because some of the resources have been created, the provider region change needs to persist as switching it back to the eu-west-2 region will stop them being found and destroyed.

Once sprinkler apply ran once, this should be revertable too.

How has this been tested?

It hasn't been unfortunately.

Deployment Plan / Instructions

An apply on sprinkler should be enough to see if this undid the damage. This PR does not need merging.

Checklist (check `x` in `[ ]` of list items)

I have performed a self-review of my own code
All checks have passed
I have made corresponding changes to the documentation
Plan and discussed how it should be deployed to PROD (If needed)

Additional comments (if any)

{Please write here}

… resources.

github-actions · 2024-05-09T08:55:58Z

`Trivy Scan` Success

Show Output

```hcl

Trivy will check the following folders:

</details> #### `Checkov Scan` Success
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:

`CTFLint Scan` Success

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.5.0)
tflint will check the following folders:

`Trivy Scan` Success

Show Output

*****************************

Trivy will check the following folders:

github-actions · 2024-05-09T09:09:26Z

`Trivy Scan` Failed

Show Output

```hcl

Trivy will check the following folders:
terraform/environments/bootstrap/secure-baselines

Running Trivy in terraform/environments/bootstrap/secure-baselines
2024-05-09T09:09:14Z INFO Need to update DB
2024-05-09T09:09:14Z INFO Downloading DB... repository="ghcr.io/aquasecurity/trivy-db:2"
2024-05-09T09:09:16Z INFO Vulnerability scanning is enabled
2024-05-09T09:09:16Z INFO Misconfiguration scanning is enabled
2024-05-09T09:09:16Z INFO Need to update the built-in policies
2024-05-09T09:09:16Z INFO Downloading the built-in policies...
50.41 KiB / 50.41 KiB [-----------------------------------------------------------] 100.00% ? p/s 0s2024-05-09T09:09:17Z INFO Secret scanning is enabled
2024-05-09T09:09:17Z INFO If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-05-09T09:09:17Z INFO Please see also https://aquasecurity.github.io/trivy/v0.51/docs/scanner/secret/#recommendation for faster secret detection
2024-05-09T09:09:19Z INFO Number of language-specific files num=0
2024-05-09T09:09:19Z INFO Detected config files num=8

github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/config.tf (terraform)

Tests: 1 (SUCCESSES: 0, FAILURES: 0, EXCEPTIONS: 1)
Failures: 0 (HIGH: 0, CRITICAL: 0)

github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/modules/backup/main.tf (terraform)

Tests: 8 (SUCCESSES: 4, FAILURES: 4, EXCEPTIONS: 0)
Failures: 4 (HIGH: 4, CRITICAL: 0)

HIGH: Topic encryption does not use a customer managed key.
════════════════════════════════════════
Topics should be encrypted with customer managed KMS keys and not default AWS managed keys, in order to allow granular key management.

See https://avd.aquasec.com/misconfig/avd-aws-0136
────────────────────────────────────────
github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/modules/backup/main.tf:120
via github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/modules/backup/main.tf:119-125 (aws_sns_topic.backup_failure_topic)
via github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/backup.tf:98-107 (module.backup-eu-central-1["enabled"])
via main.tf:7-67 (module.baselines)
────────────────────────────────────────
119 resource "aws_sns_topic" "backup_failure_topic" {
120 [ kms_master_key_id = var.sns_backup_topic_key
121 name = "backup_failure_topic"
122 tags = merge(var.tags, {
123 Description = "This backup topic is so the MP team can subscribe to backup notifications from selected accounts and teams using member-unrestricted accounts can create their own subscriptions"
124 })
125 }
────────────────────────────────────────

HIGH: Topic encryption does not use a customer managed key.
════════════════════════════════════════
Topics should be encrypted with customer managed KMS keys and not default AWS managed keys, in order to allow granular key management.

See https://avd.aquasec.com/misconfig/avd-aws-0136
────────────────────────────────────────
github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/modules/backup/main.tf:120
via github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/modules/backup/main.tf:119-125 (aws_sns_topic.backup_failure_topic)
via github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/backup.tf:164-173 (module.backup-us-east-1["enabled"])
via main.tf:7-67 (module.baselines)
────────────────────────────────────────
119 resource "aws_sns_topic" "backup_failure_topic" {
120 [ kms_master_key_id = var.sns_backup_topic_key
121 name = "backup_failure_topic"
122 tags = merge(var.tags, {
123 Description = "This backup topic is so the MP team can subscribe to backup notifications from selected accounts and teams using member-unrestricted accounts can create their own subscriptions"
124 })
125 }
────────────────────────────────────────

HIGH: Topic encryption does not use a customer managed key.
════════════════════════════════════════
Topics should be encrypted with customer managed KMS keys and not default AWS managed keys, in order to allow granular key management.

See https://avd.aquasec.com/misconfig/avd-aws-0136
────────────────────────────────────────
github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/modules/backup/main.tf:120
via github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/modules/backup/main.tf:119-125 (aws_sns_topic.backup_failure_topic)
via github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/backup.tf:131-140 (module.backup-eu-west-2["enabled"])
via main.tf:7-67 (module.baselines)
────────────────────────────────────────
119 resource "aws_sns_topic" "backup_failure_topic" {
120 [ kms_master_key_id = var.sns_backup_topic_key
121 name = "backup_failure_topic"
122 tags = merge(var.tags, {
123 Description = "This backup topic is so the MP team can subscribe to backup notifications from selected accounts and teams using member-unrestricted accounts can create their own subscriptions"
124 })
125 }
────────────────────────────────────────

HIGH: Topic encryption does not use a customer managed key.
════════════════════════════════════════
Topics should be encrypted with customer managed KMS keys and not default AWS managed keys, in order to allow granular key management.

See https://avd.aquasec.com/misconfig/avd-aws-0136
────────────────────────────────────────
github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/modules/backup/main.tf:120
via github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/modules/backup/main.tf:119-125 (aws_sns_topic.backup_failure_topic)
via github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/backup.tf:120-129 (module.backup-eu-west-1["enabled"])
via main.tf:7-67 (module.baselines)
────────────────────────────────────────
119 resource "aws_sns_topic" "backup_failure_topic" {
120 [ kms_master_key_id = var.sns_backup_topic_key
121 name = "backup_failure_topic"
122 tags = merge(var.tags, {
123 Description = "This backup topic is so the MP team can subscribe to backup notifications from selected accounts and teams using member-unrestricted accounts can create their own subscriptions"
124 })
125 }
────────────────────────────────────────

github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/modules/cloudtrail/main.tf (terraform)

Tests: 5 (SUCCESSES: 4, FAILURES: 0, EXCEPTIONS: 1)
Failures: 0 (HIGH: 0, CRITICAL: 0)

github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/modules/config/main.tf (terraform)

Tests: 8 (SUCCESSES: 4, FAILURES: 4, EXCEPTIONS: 0)
Failures: 4 (HIGH: 4, CRITICAL: 0)

HIGH: Topic encryption does not use a customer managed key.
════════════════════════════════════════
Topics should be encrypted with customer managed KMS keys and not default AWS managed keys, in order to allow granular key management.

See https://avd.aquasec.com/misconfig/avd-aws-0136
────────────────────────────────────────
github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/modules/config/main.tf:40
via github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/modules/config/main.tf:38-42 (aws_sns_topic.default)
via github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/config.tf:334-351 (module.config-eu-central-1["enabled"])
via main.tf:7-67 (module.baselines)
────────────────────────────────────────
38 resource "aws_sns_topic" "default" {
39 name = "config"
40 [ kms_master_key_id = "alias/aws/sns"
41 tags = var.tags
42 }
────────────────────────────────────────

HIGH: Topic encryption does not use a customer managed key.
════════════════════════════════════════
Topics should be encrypted with customer managed KMS keys and not default AWS managed keys, in order to allow granular key management.

See https://avd.aquasec.com/misconfig/avd-aws-0136
────────────────────────────────────────
github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/modules/config/main.tf:40
via github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/modules/config/main.tf:38-42 (aws_sns_topic.default)
via github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/config.tf:372-389 (module.config-eu-west-1["enabled"])
via main.tf:7-67 (module.baselines)
────────────────────────────────────────
38 resource "aws_sns_topic" "default" {
39 name = "config"
40 [ kms_master_key_id = "alias/aws/sns"
41 tags = var.tags
42 }
────────────────────────────────────────

HIGH: Topic encryption does not use a customer managed key.
════════════════════════════════════════
Topics should be encrypted with customer managed KMS keys and not default AWS managed keys, in order to allow granular key management.

See https://avd.aquasec.com/misconfig/avd-aws-0136
────────────────────────────────────────
github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/modules/config/main.tf:40
via github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/modules/config/main.tf:38-42 (aws_sns_topic.default)
via github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/config.tf:391-408 (module.config-eu-west-2["enabled"])
via main.tf:7-67 (module.baselines)
────────────────────────────────────────
38 resource "aws_sns_topic" "default" {
39 name = "config"
40 [ kms_master_key_id = "alias/aws/sns"
41 tags = var.tags
42 }
────────────────────────────────────────

HIGH: Topic encryption does not use a customer managed key.
════════════════════════════════════════
Topics should be encrypted with customer managed KMS keys and not default AWS managed keys, in order to allow granular key management.

See https://avd.aquasec.com/misconfig/avd-aws-0136
────────────────────────────────────────
github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/modules/config/main.tf:40
via github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/modules/config/main.tf:38-42 (aws_sns_topic.default)
via github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/config.tf:448-465 (module.config-us-east-1["enabled"])
via main.tf:7-67 (module.baselines)
────────────────────────────────────────
38 resource "aws_sns_topic" "default" {
39 name = "config"
40 [ kms_master_key_id = "alias/aws/sns"
41 tags = var.tags
42 }
────────────────────────────────────────

trivy_exitcode=1

</details> #### `Checkov Scan` Success
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/bootstrap/secure-baselines

*****************************

Running Checkov in terraform/environments/bootstrap/secure-baselines
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2024-05-09 09:09:22,268 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14:None (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 9, Failed checks: 0, Skipped checks: 0


checkov_exitcode=0

`CTFLint Scan` Success

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.5.0)
tflint will check the following folders:
terraform/environments/bootstrap/secure-baselines

*****************************

Running tflint in terraform/environments/bootstrap/secure-baselines
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=0

`Trivy Scan` Failed

Show Output

*****************************

Trivy will check the following folders:
terraform/environments/bootstrap/secure-baselines

*****************************

Running Trivy in terraform/environments/bootstrap/secure-baselines
2024-05-09T09:09:14Z	INFO	Need to update DB
2024-05-09T09:09:14Z	INFO	Downloading DB...	repository="ghcr.io/aquasecurity/trivy-db:2"
2024-05-09T09:09:16Z	INFO	Vulnerability scanning is enabled
2024-05-09T09:09:16Z	INFO	Misconfiguration scanning is enabled
2024-05-09T09:09:16Z	INFO	Need to update the built-in policies
2024-05-09T09:09:16Z	INFO	Downloading the built-in policies...
50.41 KiB / 50.41 KiB [-----------------------------------------------------------] 100.00% ? p/s 0s2024-05-09T09:09:17Z	INFO	Secret scanning is enabled
2024-05-09T09:09:17Z	INFO	If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-05-09T09:09:17Z	INFO	Please see also https://aquasecurity.github.io/trivy/v0.51/docs/scanner/secret/#recommendation for faster secret detection
2024-05-09T09:09:19Z	INFO	Number of language-specific files	num=0
2024-05-09T09:09:19Z	INFO	Detected config files	num=8

github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/config.tf (terraform)
==========================================================================================================================================
Tests: 1 (SUCCESSES: 0, FAILURES: 0, EXCEPTIONS: 1)
Failures: 0 (HIGH: 0, CRITICAL: 0)


github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/modules/backup/main.tf (terraform)
=======================================================================================================================================================
Tests: 8 (SUCCESSES: 4, FAILURES: 4, EXCEPTIONS: 0)
Failures: 4 (HIGH: 4, CRITICAL: 0)

HIGH: Topic encryption does not use a customer managed key.
════════════════════════════════════════
Topics should be encrypted with customer managed KMS keys and not default AWS managed keys, in order to allow granular key management.

See https://avd.aquasec.com/misconfig/avd-aws-0136
────────────────────────────────────────
 github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/modules/backup/main.tf:120
   via github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/modules/backup/main.tf:119-125 (aws_sns_topic.backup_failure_topic)
    via github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/backup.tf:98-107 (module.backup-eu-central-1["enabled"])
     via main.tf:7-67 (module.baselines)
────────────────────────────────────────
 119   resource "aws_sns_topic" "backup_failure_topic" {
 120 [   kms_master_key_id = var.sns_backup_topic_key
 121     name              = "backup_failure_topic"
 122     tags = merge(var.tags, {
 123       Description = "This backup topic is so the MP team can subscribe to backup notifications from selected accounts and teams using member-unrestricted accounts can create their own subscriptions"
 124     })
 125   }
────────────────────────────────────────


HIGH: Topic encryption does not use a customer managed key.
════════════════════════════════════════
Topics should be encrypted with customer managed KMS keys and not default AWS managed keys, in order to allow granular key management.

See https://avd.aquasec.com/misconfig/avd-aws-0136
────────────────────────────────────────
 github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/modules/backup/main.tf:120
   via github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/modules/backup/main.tf:119-125 (aws_sns_topic.backup_failure_topic)
    via github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/backup.tf:164-173 (module.backup-us-east-1["enabled"])
     via main.tf:7-67 (module.baselines)
────────────────────────────────────────
 119   resource "aws_sns_topic" "backup_failure_topic" {
 120 [   kms_master_key_id = var.sns_backup_topic_key
 121     name              = "backup_failure_topic"
 122     tags = merge(var.tags, {
 123       Description = "This backup topic is so the MP team can subscribe to backup notifications from selected accounts and teams using member-unrestricted accounts can create their own subscriptions"
 124     })
 125   }
────────────────────────────────────────


HIGH: Topic encryption does not use a customer managed key.
════════════════════════════════════════
Topics should be encrypted with customer managed KMS keys and not default AWS managed keys, in order to allow granular key management.

See https://avd.aquasec.com/misconfig/avd-aws-0136
────────────────────────────────────────
 github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/modules/backup/main.tf:120
   via github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/modules/backup/main.tf:119-125 (aws_sns_topic.backup_failure_topic)
    via github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/backup.tf:131-140 (module.backup-eu-west-2["enabled"])
     via main.tf:7-67 (module.baselines)
────────────────────────────────────────
 119   resource "aws_sns_topic" "backup_failure_topic" {
 120 [   kms_master_key_id = var.sns_backup_topic_key
 121     name              = "backup_failure_topic"
 122     tags = merge(var.tags, {
 123       Description = "This backup topic is so the MP team can subscribe to backup notifications from selected accounts and teams using member-unrestricted accounts can create their own subscriptions"
 124     })
 125   }
────────────────────────────────────────


HIGH: Topic encryption does not use a customer managed key.
════════════════════════════════════════
Topics should be encrypted with customer managed KMS keys and not default AWS managed keys, in order to allow granular key management.

See https://avd.aquasec.com/misconfig/avd-aws-0136
────────────────────────────────────────
 github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/modules/backup/main.tf:120
   via github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/modules/backup/main.tf:119-125 (aws_sns_topic.backup_failure_topic)
    via github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/backup.tf:120-129 (module.backup-eu-west-1["enabled"])
     via main.tf:7-67 (module.baselines)
────────────────────────────────────────
 119   resource "aws_sns_topic" "backup_failure_topic" {
 120 [   kms_master_key_id = var.sns_backup_topic_key
 121     name              = "backup_failure_topic"
 122     tags = merge(var.tags, {
 123       Description = "This backup topic is so the MP team can subscribe to backup notifications from selected accounts and teams using member-unrestricted accounts can create their own subscriptions"
 124     })
 125   }
────────────────────────────────────────



github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/modules/cloudtrail/main.tf (terraform)
===========================================================================================================================================================
Tests: 5 (SUCCESSES: 4, FAILURES: 0, EXCEPTIONS: 1)
Failures: 0 (HIGH: 0, CRITICAL: 0)


github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/modules/config/main.tf (terraform)
=======================================================================================================================================================
Tests: 8 (SUCCESSES: 4, FAILURES: 4, EXCEPTIONS: 0)
Failures: 4 (HIGH: 4, CRITICAL: 0)

HIGH: Topic encryption does not use a customer managed key.
════════════════════════════════════════
Topics should be encrypted with customer managed KMS keys and not default AWS managed keys, in order to allow granular key management.

See https://avd.aquasec.com/misconfig/avd-aws-0136
────────────────────────────────────────
 github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/modules/config/main.tf:40
   via github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/modules/config/main.tf:38-42 (aws_sns_topic.default)
    via github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/config.tf:334-351 (module.config-eu-central-1["enabled"])
     via main.tf:7-67 (module.baselines)
────────────────────────────────────────
  38   resource "aws_sns_topic" "default" {
  39     name              = "config"
  40 [   kms_master_key_id = "alias/aws/sns"
  41     tags              = var.tags
  42   }
────────────────────────────────────────


HIGH: Topic encryption does not use a customer managed key.
════════════════════════════════════════
Topics should be encrypted with customer managed KMS keys and not default AWS managed keys, in order to allow granular key management.

See https://avd.aquasec.com/misconfig/avd-aws-0136
────────────────────────────────────────
 github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/modules/config/main.tf:40
   via github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/modules/config/main.tf:38-42 (aws_sns_topic.default)
    via github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/config.tf:372-389 (module.config-eu-west-1["enabled"])
     via main.tf:7-67 (module.baselines)
────────────────────────────────────────
  38   resource "aws_sns_topic" "default" {
  39     name              = "config"
  40 [   kms_master_key_id = "alias/aws/sns"
  41     tags              = var.tags
  42   }
────────────────────────────────────────


HIGH: Topic encryption does not use a customer managed key.
════════════════════════════════════════
Topics should be encrypted with customer managed KMS keys and not default AWS managed keys, in order to allow granular key management.

See https://avd.aquasec.com/misconfig/avd-aws-0136
────────────────────────────────────────
 github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/modules/config/main.tf:40
   via github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/modules/config/main.tf:38-42 (aws_sns_topic.default)
    via github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/config.tf:391-408 (module.config-eu-west-2["enabled"])
     via main.tf:7-67 (module.baselines)
────────────────────────────────────────
  38   resource "aws_sns_topic" "default" {
  39     name              = "config"
  40 [   kms_master_key_id = "alias/aws/sns"
  41     tags              = var.tags
  42   }
────────────────────────────────────────


HIGH: Topic encryption does not use a customer managed key.
════════════════════════════════════════
Topics should be encrypted with customer managed KMS keys and not default AWS managed keys, in order to allow granular key management.

See https://avd.aquasec.com/misconfig/avd-aws-0136
────────────────────────────────────────
 github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/modules/config/main.tf:40
   via github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/modules/config/main.tf:38-42 (aws_sns_topic.default)
    via github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/config.tf:448-465 (module.config-us-east-1["enabled"])
     via main.tf:7-67 (module.baselines)
────────────────────────────────────────
  38   resource "aws_sns_topic" "default" {
  39     name              = "config"
  40 [   kms_master_key_id = "alias/aws/sns"
  41     tags              = var.tags
  42   }
────────────────────────────────────────


trivy_exitcode=1

ASTRobinson · 2024-05-09T11:20:37Z

sprinkler reverted, closing PR

julialawrence added 3 commits May 9, 2024 09:32

Unbootstrapping France.

36bea04

Restores the provider change to allow succesfully deletion of created…

4435a86

… resources.

Reverting readme change.

b2fba8e

julialawrence had a problem deploying to production May 9, 2024 08:54 — with GitHub Actions Failure

Updating bootstrap module to use the right region.

31fb12f

julialawrence temporarily deployed to production May 9, 2024 09:07 — with GitHub Actions Inactive

julialawrence temporarily deployed to production May 9, 2024 09:51 — with GitHub Actions Inactive

julialawrence temporarily deployed to production May 9, 2024 09:52 — with GitHub Actions Inactive

ASTRobinson closed this May 9, 2024

dms1981 mentioned this pull request May 9, 2024

Enabling Bedrock in the Paris Region #6917

Closed

5 tasks

julialawrence mentioned this pull request May 10, 2024

🇫🇷 Enabling Paris II: Rebaselining #6976

Merged

4 tasks

dms1981 deleted the feature/bootstrap-france branch September 30, 2024 20:42

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

🇫🇷 😢 Unbootstrapping France. #6959

🇫🇷 😢 Unbootstrapping France. #6959

julialawrence commented May 9, 2024

github-actions bot commented May 9, 2024

github-actions bot commented May 9, 2024

github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/config.tf (terraform)

github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/modules/backup/main.tf (terraform)

github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/modules/cloudtrail/main.tf (terraform)

github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/modules/config/main.tf (terraform)

ASTRobinson commented May 9, 2024

🇫🇷 😢 Unbootstrapping France. #6959

🇫🇷 😢 Unbootstrapping France. #6959

Conversation

julialawrence commented May 9, 2024

A reference to the issue / Description of it

How does this PR fix the problem?

How has this been tested?

Deployment Plan / Instructions

Checklist (check x in [ ] of list items)

Additional comments (if any)

github-actions bot commented May 9, 2024

Trivy Scan Success

CTFLint Scan Success

Trivy Scan Success

github-actions bot commented May 9, 2024

Trivy Scan Failed

github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/config.tf (terraform)

github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/modules/backup/main.tf (terraform)

github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/modules/cloudtrail/main.tf (terraform)

github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=b5ae2be29aaa29d644b6909af51acefdfaa80e14/modules/config/main.tf (terraform)

CTFLint Scan Success

Trivy Scan Failed

ASTRobinson commented May 9, 2024

Checklist (check `x` in `[ ]` of list items)

`Trivy Scan` Success

`CTFLint Scan` Success

`Trivy Scan` Success

`Trivy Scan` Failed

`CTFLint Scan` Success

`Trivy Scan` Failed