🔑 Replace Key + IP #6185

Gary-H9 · 2024-05-21T13:16:48Z

As per request of the BOLD team.

github-actions · 2024-05-21T13:19:14Z

`Trivy Scan` Success

Show Output

```hcl

Trivy will check the following folders:
terraform/environments/analytical-platform-ingestion

Running Trivy in terraform/environments/analytical-platform-ingestion
2024-05-21T13:19:00Z INFO Need to update DB
2024-05-21T13:19:00Z INFO Downloading DB... repository="ghcr.io/aquasecurity/trivy-db:2"
2024-05-21T13:19:01Z INFO Vulnerability scanning is enabled
2024-05-21T13:19:01Z INFO Misconfiguration scanning is enabled
2024-05-21T13:19:01Z INFO Need to update the built-in policies
2024-05-21T13:19:01Z INFO Downloading the built-in policies...
50.41 KiB / 50.41 KiB [-----------------------------------------------------------] 100.00% ? p/s 0s2024-05-21T13:19:02Z INFO Secret scanning is enabled
2024-05-21T13:19:02Z INFO If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-05-21T13:19:02Z INFO Please see also https://aquasecurity.github.io/trivy/v0.51/docs/scanner/secret/#recommendation for faster secret detection
2024-05-21T13:19:09Z INFO Number of language-specific files num=0
2024-05-21T13:19:09Z INFO Detected config files num=15

git::https:/github.com/terraform-aws-modules/terraform-aws-lambda?ref=c42e75877ec6eed0e2142f7724aa661cffbb5cb8/iam.tf (terraform)

Tests: 4 (SUCCESSES: 0, FAILURES: 0, EXCEPTIONS: 4)
Failures: 0 (HIGH: 0, CRITICAL: 0)

terraform-aws-modules/lambda/aws/iam.tf (terraform)

Tests: 8 (SUCCESSES: 0, FAILURES: 0, EXCEPTIONS: 8)
Failures: 0 (HIGH: 0, CRITICAL: 0)

trivy_exitcode=0

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/analytical-platform-ingestion

*****************************

Running Checkov in terraform/environments/analytical-platform-ingestion
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2024-05-21 13:19:12,186 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/s3-bucket/aws//modules/notification:4.1.0 (for external modules, the --download-external-modules flag is required)
2024-05-21 13:19:12,187 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/iam/aws//modules/iam-assumable-role:5.37.1 (for external modules, the --download-external-modules flag is required)
2024-05-21 13:19:12,187 [MainThread  ] [WARNI]  Failed to download module ministryofjustice/observability-platform-tenant/aws:1.0.0 (for external modules, the --download-external-modules flag is required)
2024-05-21 13:19:12,187 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/vpc/aws//modules/vpc-endpoints:~> 5.0 (for external modules, the --download-external-modules flag is required)
2024-05-21 13:19:12,187 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/iam/aws//modules/iam-policy:5.37.1 (for external modules, the --download-external-modules flag is required)
2024-05-21 13:19:12,187 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/vpc/aws:~> 5.0 (for external modules, the --download-external-modules flag is required)
2024-05-21 13:19:12,187 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/sns/aws:6.0.1 (for external modules, the --download-external-modules flag is required)
2024-05-21 13:19:12,188 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/security-group/aws:~> 5.0 (for external modules, the --download-external-modules flag is required)
2024-05-21 13:19:12,188 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/kms/aws:2.2.1 (for external modules, the --download-external-modules flag is required)
2024-05-21 13:19:12,188 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/lambda/aws:7.2.5 (for external modules, the --download-external-modules flag is required)
2024-05-21 13:19:12,188 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/cloudwatch/aws//modules/log-group:5.3.1 (for external modules, the --download-external-modules flag is required)
2024-05-21 13:19:12,188 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/s3-bucket/aws:4.1.0 (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 102, Failed checks: 40, Skipped checks: 52

Check: CKV_TF_2: "Ensure Terraform module sources use a tag with a version number"
	FAILED for resource: transfer_structured_logs
	File: /cloudwatch-log-groups.tf:1-10

		1  | module "transfer_structured_logs" {
		2  |   #checkov:skip=CKV_TF_1:Module registry does not support commit hashes for versions
		3  | 
		4  |   source  = "terraform-aws-modules/cloudwatch/aws//modules/log-group"
		5  |   version = "5.3.1"
		6  | 
		7  |   name              = "/aws/transfer-structured-logs"
		8  |   kms_key_id        = module.transfer_logs_kms.key_arn
		9  |   retention_in_days = 400
		10 | }

Check: CKV_TF_2: "Ensure Terraform module sources use a tag with a version number"
	FAILED for resource: transfer_server_iam_policy
	File: /iam-policies.tf:16-25

		16 | module "transfer_server_iam_policy" {
		17 |   #checkov:skip=CKV_TF_1:Module registry does not support commit hashes for versions
		18 | 
		19 |   source  = "terraform-aws-modules/iam/aws//modules/iam-policy"
		20 |   version = "5.37.1"
		21 | 
		22 |   name_prefix = "transfer-server"
		23 | 
		24 |   policy = data.aws_iam_policy_document.transfer_server.json
		25 | }

Check: CKV_TF_2: "Ensure Terraform module sources use a tag with a version number"
	FAILED for resource: transfer_server_iam_role
	File: /iam-roles.tf:1-18

		1  | module "transfer_server_iam_role" {
		2  |   #checkov:skip=CKV_TF_1:Module registry does not support commit hashes for versions
		3  | 
		4  |   source  = "terraform-aws-modules/iam/aws//modules/iam-assumable-role"
		5  |   version = "5.37.1"
		6  | 
		7  |   create_role = true
		8  | 
		9  |   role_name_prefix  = "transfer-server"
		10 |   role_requires_mfa = false
		11 | 
		12 |   trusted_role_services = ["transfer.amazonaws.com"]
		13 | 
		14 |   custom_role_policy_arns = [
		15 |     module.transfer_server_iam_policy.arn,
		16 |     "arn:aws:iam::aws:policy/service-role/AWSTransferLoggingAccess"
		17 |   ]
		18 | }

Check: CKV_TF_2: "Ensure Terraform module sources use a tag with a version number"
	FAILED for resource: transfer_logs_kms
	File: /kms-keys.tf:1-39

		1  | module "transfer_logs_kms" {
		2  |   #checkov:skip=CKV_TF_1:Module registry does not support commit hashes for versions
		3  | 
		4  |   source  = "terraform-aws-modules/kms/aws"
		5  |   version = "2.2.1"
		6  | 
		7  |   aliases               = ["logs/transfer"]
		8  |   description           = "CloudWatch Logs for the Transfer Server"
		9  |   enable_default_policy = true
		10 |   key_statements = [
		11 |     {
		12 |       sid = "AllowCloudWatchLogs"
		13 |       actions = [
		14 |         "kms:Encrypt*",
		15 |         "kms:Decrypt*",
		16 |         "kms:ReEncrypt*",
		17 |         "kms:GenerateDataKey*",
		18 |         "kms:Describe*"
		19 |       ]
		20 |       resources = ["*"]
		21 |       effect    = "Allow"
		22 |       principals = [
		23 |         {
		24 |           type        = "Service"
		25 |           identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		26 |         }
		27 |       ]
		28 |       conditions = [
		29 |         {
		30 |           test     = "ArnEquals"
		31 |           variable = "kms:EncryptionContext:aws:logs:arn"
		32 |           values   = ["arn:aws:logs:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:log-group:/aws/transfer-structured-logs"]
		33 |         }
		34 |       ]
		35 |     }
		36 |   ]
		37 | 
		38 |   deletion_window_in_days = 7
		39 | }

Check: CKV_TF_2: "Ensure Terraform module sources use a tag with a version number"
	FAILED for resource: s3_landing_kms
	File: /kms-keys.tf:41-52

		41 | module "s3_landing_kms" {
		42 |   #checkov:skip=CKV_TF_1:Module registry does not support commit hashes for versions
		43 | 
		44 |   source  = "terraform-aws-modules/kms/aws"
		45 |   version = "2.2.1"
		46 | 
		47 |   aliases               = ["s3/landing"]
		48 |   description           = "Family SFTP Server, Landing S3 KMS Key"
		49 |   enable_default_policy = true
		50 | 
		51 |   deletion_window_in_days = 7
		52 | }

Check: CKV_TF_2: "Ensure Terraform module sources use a tag with a version number"
	FAILED for resource: s3_processed_kms
	File: /kms-keys.tf:54-65

		54 | module "s3_processed_kms" {
		55 |   #checkov:skip=CKV_TF_1:Module registry does not support commit hashes for versions
		56 | 
		57 |   source  = "terraform-aws-modules/kms/aws"
		58 |   version = "2.2.1"
		59 | 
		60 |   aliases               = ["s3/processed"]
		61 |   description           = "Family SFTP Server, Processed S3 KMS Key"
		62 |   enable_default_policy = true
		63 | 
		64 |   deletion_window_in_days = 7
		65 | }

Check: CKV_TF_2: "Ensure Terraform module sources use a tag with a version number"
	FAILED for resource: s3_quarantine_kms
	File: /kms-keys.tf:67-78

		67 | module "s3_quarantine_kms" {
		68 |   #checkov:skip=CKV_TF_1:Module registry does not support commit hashes for versions
		69 | 
		70 |   source  = "terraform-aws-modules/kms/aws"
		71 |   version = "2.2.1"
		72 | 
		73 |   aliases               = ["s3/quarantine"]
		74 |   description           = "Family SFTP Server, Quarantine S3 KMS Key"
		75 |   enable_default_policy = true
		76 | 
		77 |   deletion_window_in_days = 7
		78 | }

Check: CKV_TF_2: "Ensure Terraform module sources use a tag with a version number"
	FAILED for resource: s3_definitions_kms
	File: /kms-keys.tf:80-91

		80 | module "s3_definitions_kms" {
		81 |   #checkov:skip=CKV_TF_1:Module registry does not support commit hashes for versions
		82 | 
		83 |   source  = "terraform-aws-modules/kms/aws"
		84 |   version = "2.2.1"
		85 | 
		86 |   aliases               = ["s3/definitions"]
		87 |   description           = "Ingestion Scanning ClamAV S3 KMS Key"
		88 |   enable_default_policy = true
		89 | 
		90 |   deletion_window_in_days = 7
		91 | }

Check: CKV_TF_2: "Ensure Terraform module sources use a tag with a version number"
	FAILED for resource: s3_bold_egress_kms
	File: /kms-keys.tf:93-120

		93  | module "s3_bold_egress_kms" {
		94  |   #checkov:skip=CKV_TF_1:Module registry does not support commit hashes for versions
		95  | 
		96  |   source  = "terraform-aws-modules/kms/aws"
		97  |   version = "2.2.1"
		98  | 
		99  |   aliases               = ["s3/bold-egress"]
		100 |   description           = "Used in the Bold Egress Solution"
		101 |   enable_default_policy = true
		102 |   key_statements = [
		103 |     {
		104 |       sid = "AllowAnalyticalPlatformDataEngineeringProduction"
		105 |       actions = [
		106 |         "kms:Encrypt",
		107 |         "kms:GenerateDataKey"
		108 |       ]
		109 |       resources = ["*"]
		110 |       effect    = "Allow"
		111 |       principals = [
		112 |         {
		113 |           type        = "AWS"
		114 |           identifiers = ["arn:aws:iam::593291632749:role/mojap-data-production-bold-egress-${local.environment}"]
		115 |         }
		116 |       ]
		117 |     }
		118 |   ]
		119 |   deletion_window_in_days = 7
		120 | }

Check: CKV_TF_2: "Ensure Terraform module sources use a tag with a version number"
	FAILED for resource: quarantined_sns_kms
	File: /kms-keys.tf:122-150

		122 | module "quarantined_sns_kms" {
		123 |   #checkov:skip=CKV_TF_1:Module registry does not support commit hashes for versions
		124 | 
		125 |   source  = "terraform-aws-modules/kms/aws"
		126 |   version = "2.2.1"
		127 | 
		128 |   aliases               = ["sns/quarantined"]
		129 |   description           = "Key for quarantined notifications"
		130 |   enable_default_policy = true
		131 |   key_statements = [
		132 |     {
		133 |       sid = "AllowS3"
		134 |       actions = [
		135 |         "kms:Decrypt",
		136 |         "kms:GenerateDataKey"
		137 |       ]
		138 |       resources = ["*"]
		139 |       effect    = "Allow"
		140 |       principals = [
		141 |         {
		142 |           type        = "Service"
		143 |           identifiers = ["s3.amazonaws.com"]
		144 |         }
		145 |       ]
		146 |     }
		147 |   ]
		148 | 
		149 |   deletion_window_in_days = 7
		150 | }

Check: CKV_TF_2: "Ensure Terraform module sources use a tag with a version number"
	FAILED for resource: transferred_sns_kms
	File: /kms-keys.tf:152-163

		152 | module "transferred_sns_kms" {
		153 |   #checkov:skip=CKV_TF_1:Module registry does not support commit hashes for versions
		154 | 
		155 |   source  = "terraform-aws-modules/kms/aws"
		156 |   version = "2.2.1"
		157 | 
		158 |   aliases               = ["sns/transferred"]
		159 |   description           = "Key for transferred notifications"
		160 |   enable_default_policy = true
		161 | 
		162 |   deletion_window_in_days = 7
		163 | }

Check: CKV_TF_2: "Ensure Terraform module sources use a tag with a version number"
	FAILED for resource: govuk_notify_kms
	File: /kms-keys.tf:165-176

		165 | module "govuk_notify_kms" {
		166 |   #checkov:skip=CKV_TF_1:Module registry does not support commit hashes for versions
		167 | 
		168 |   source  = "terraform-aws-modules/kms/aws"
		169 |   version = "2.2.1"
		170 | 
		171 |   aliases               = ["secretsmanager/govuk-notify"]
		172 |   description           = "Key for GOV.UK Notify data"
		173 |   enable_default_policy = true
		174 | 
		175 |   deletion_window_in_days = 7
		176 | }

Check: CKV_TF_2: "Ensure Terraform module sources use a tag with a version number"
	FAILED for resource: supplier_data_kms
	File: /kms-keys.tf:178-189

		178 | module "supplier_data_kms" {
		179 |   #checkov:skip=CKV_TF_1:Module registry does not support commit hashes for versions
		180 | 
		181 |   source  = "terraform-aws-modules/kms/aws"
		182 |   version = "2.2.1"
		183 | 
		184 |   aliases               = ["secretsmanager/supplier-data"]
		185 |   description           = "Key for SFTP supplier data"
		186 |   enable_default_policy = true
		187 | 
		188 |   deletion_window_in_days = 7
		189 | }

Check: CKV_TF_2: "Ensure Terraform module sources use a tag with a version number"
	FAILED for resource: slack_token_kms
	File: /kms-keys.tf:191-202

		191 | module "slack_token_kms" {
		192 |   #checkov:skip=CKV_TF_1:Module registry does not support commit hashes for versions
		193 | 
		194 |   source  = "terraform-aws-modules/kms/aws"
		195 |   version = "2.2.1"
		196 | 
		197 |   aliases               = ["secretsmanager/slack-token"]
		198 |   description           = "Slack token for notifications"
		199 |   enable_default_policy = true
		200 | 
		201 |   deletion_window_in_days = 7
		202 | }

Check: CKV_TF_2: "Ensure Terraform module sources use a tag with a version number"
	FAILED for resource: definition_upload_lambda
	File: /lambda-functions.tf:1-57

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_TF_2: "Ensure Terraform module sources use a tag with a version number"
	FAILED for resource: scan_lambda
	File: /lambda-functions.tf:59-132

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_TF_2: "Ensure Terraform module sources use a tag with a version number"
	FAILED for resource: transfer_lambda
	File: /lambda-functions.tf:134-241

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_TF_2: "Ensure Terraform module sources use a tag with a version number"
	FAILED for resource: notify_quarantined_lambda
	File: /lambda-functions.tf:243-307

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_TF_2: "Ensure Terraform module sources use a tag with a version number"
	FAILED for resource: notify_transferred_lambda
	File: /lambda-functions.tf:309-370

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_TF_2: "Ensure Terraform module sources use a tag with a version number"
	FAILED for resource: module.sftp_users_with_egress.policy
	File: /modules/transfer-family/user-with-egress/main.tf:46-55
	Calling File: /transfer-user.tf:17-33

		46 | module "policy" {
		47 |   #checkov:skip=CKV_TF_1:Module registry does not support commit hashes for versions
		48 | 
		49 |   source  = "terraform-aws-modules/iam/aws//modules/iam-policy"
		50 |   version = "5.37.1"
		51 | 
		52 |   name_prefix = "transfer-user-${var.name}"
		53 | 
		54 |   policy = data.aws_iam_policy_document.this.json
		55 | }

Check: CKV_TF_2: "Ensure Terraform module sources use a tag with a version number"
	FAILED for resource: module.sftp_users_with_egress.role
	File: /modules/transfer-family/user-with-egress/main.tf:57-71
	Calling File: /transfer-user.tf:17-33

		57 | module "role" {
		58 |   #checkov:skip=CKV_TF_1:Module registry does not support commit hashes for versions
		59 | 
		60 |   source  = "terraform-aws-modules/iam/aws//modules/iam-assumable-role"
		61 |   version = "5.37.1"
		62 | 
		63 |   create_role = true
		64 | 
		65 |   role_name         = "transfer-user-${var.name}"
		66 |   role_requires_mfa = false
		67 | 
		68 |   trusted_role_services = ["transfer.amazonaws.com"]
		69 | 
		70 |   custom_role_policy_arns = [module.policy.arn]
		71 | }

Check: CKV_TF_2: "Ensure Terraform module sources use a tag with a version number"
	FAILED for resource: module.sftp_users.policy
	File: /modules/transfer-family/user/main.tf:33-42
	Calling File: /transfer-user.tf:1-15

		33 | module "policy" {
		34 |   #checkov:skip=CKV_TF_1:Module registry does not support commit hashes for versions
		35 | 
		36 |   source  = "terraform-aws-modules/iam/aws//modules/iam-policy"
		37 |   version = "5.37.1"
		38 | 
		39 |   name_prefix = "transfer-user-${var.name}"
		40 | 
		41 |   policy = data.aws_iam_policy_document.this.json
		42 | }

Check: CKV_TF_2: "Ensure Terraform module sources use a tag with a version number"
	FAILED for resource: module.sftp_users.role
	File: /modules/transfer-family/user/main.tf:44-58
	Calling File: /transfer-user.tf:1-15

		44 | module "role" {
		45 |   #checkov:skip=CKV_TF_1:Module registry does not support commit hashes for versions
		46 | 
		47 |   source  = "terraform-aws-modules/iam/aws//modules/iam-assumable-role"
		48 |   version = "5.37.1"
		49 | 
		50 |   create_role = true
		51 | 
		52 |   role_name         = "transfer-user-${var.name}"
		53 |   role_requires_mfa = false
		54 | 
		55 |   trusted_role_services = ["transfer.amazonaws.com"]
		56 | 
		57 |   custom_role_policy_arns = [module.policy.arn]
		58 | }

Check: CKV_TF_2: "Ensure Terraform module sources use a tag with a version number"
	FAILED for resource: observability_platform_tenant
	File: /observability-platform.tf:1-11

		1  | module "observability_platform_tenant" {
		2  |   #checkov:skip=CKV_TF_1:Module registry does not support commit hashes for versions
		3  | 
		4  |   source  = "ministryofjustice/observability-platform-tenant/aws"
		5  |   version = "1.0.0"
		6  | 
		7  |   observability_platform_account_id = local.environment_management.account_ids["observability-platform-${local.environment_configuration.observability_platform}"]
		8  |   enable_xray                       = true
		9  | 
		10 |   tags = local.tags
		11 | }

Check: CKV_TF_2: "Ensure Terraform module sources use a tag with a version number"
	FAILED for resource: ingestion_landing_bucket_notification
	File: /s3-notifications.tf:1-16

		1  | module "ingestion_landing_bucket_notification" {
		2  |   #checkov:skip=CKV_TF_1:Module registry does not support commit hashes for versions
		3  | 
		4  |   source  = "terraform-aws-modules/s3-bucket/aws//modules/notification"
		5  |   version = "4.1.0"
		6  | 
		7  |   bucket = module.landing_bucket.s3_bucket_id
		8  | 
		9  |   lambda_notifications = {
		10 |     ingestion_scan = {
		11 |       function_name = module.scan_lambda.lambda_function_name
		12 |       function_arn  = module.scan_lambda.lambda_function_arn
		13 |       events        = ["s3:ObjectCreated:*"]
		14 |     }
		15 |   }
		16 | }

Check: CKV_TF_2: "Ensure Terraform module sources use a tag with a version number"
	FAILED for resource: ingestion_transfer_bucket_notification
	File: /s3-notifications.tf:18-33

		18 | module "ingestion_transfer_bucket_notification" {
		19 |   #checkov:skip=CKV_TF_1:Module registry does not support commit hashes for versions
		20 | 
		21 |   source  = "terraform-aws-modules/s3-bucket/aws//modules/notification"
		22 |   version = "4.1.0"
		23 | 
		24 |   bucket = module.processed_bucket.s3_bucket_id
		25 | 
		26 |   lambda_notifications = {
		27 |     ingestion_notify = {
		28 |       function_name = module.transfer_lambda.lambda_function_name
		29 |       function_arn  = module.transfer_lambda.lambda_function_arn
		30 |       events        = ["s3:ObjectCreated:*"]
		31 |     }
		32 |   }
		33 | }

Check: CKV_TF_2: "Ensure Terraform module sources use a tag with a version number"
	FAILED for resource: ingestion_quarantine_bucket_notification
	File: /s3-notifications.tf:35-51

		35 | module "ingestion_quarantine_bucket_notification" {
		36 |   #checkov:skip=CKV_TF_1:Module registry does not support commit hashes for versions
		37 | 
		38 |   source  = "terraform-aws-modules/s3-bucket/aws//modules/notification"
		39 |   version = "4.1.0"
		40 | 
		41 |   bucket = module.quarantine_bucket.s3_bucket_id
		42 | 
		43 |   create_sns_policy = false
		44 | 
		45 |   sns_notifications = {
		46 |     quarantine_sns = {
		47 |       topic_arn = module.quarantined_topic.topic_arn
		48 |       events    = ["s3:ObjectCreated:*"]
		49 |     }
		50 |   }
		51 | }

Check: CKV_TF_2: "Ensure Terraform module sources use a tag with a version number"
	FAILED for resource: landing_bucket
	File: /s3.tf:1-19

		1  | module "landing_bucket" {
		2  |   #checkov:skip=CKV_TF_1:Module registry does not support commit hashes for versions
		3  | 
		4  |   source  = "terraform-aws-modules/s3-bucket/aws"
		5  |   version = "4.1.0"
		6  | 
		7  |   bucket = "mojap-ingestion-${local.environment}-landing"
		8  | 
		9  |   force_destroy = true
		10 | 
		11 |   server_side_encryption_configuration = {
		12 |     rule = {
		13 |       apply_server_side_encryption_by_default = {
		14 |         kms_master_key_id = module.s3_landing_kms.key_arn
		15 |         sse_algorithm     = "aws:kms"
		16 |       }
		17 |     }
		18 |   }
		19 | }

Check: CKV_TF_2: "Ensure Terraform module sources use a tag with a version number"
	FAILED for resource: quarantine_bucket
	File: /s3.tf:42-74

		42 | module "quarantine_bucket" {
		43 |   #checkov:skip=CKV_TF_1:Module registry does not support commit hashes for versions
		44 | 
		45 |   source  = "terraform-aws-modules/s3-bucket/aws"
		46 |   version = "4.1.0"
		47 | 
		48 |   bucket = "mojap-ingestion-${local.environment}-quarantine"
		49 | 
		50 |   force_destroy = true
		51 | 
		52 |   attach_policy = true
		53 |   policy        = data.aws_iam_policy_document.quarantine_bucket_policy.json
		54 | 
		55 |   server_side_encryption_configuration = {
		56 |     rule = {
		57 |       apply_server_side_encryption_by_default = {
		58 |         kms_master_key_id = module.s3_quarantine_kms.key_arn
		59 |         sse_algorithm     = "aws:kms"
		60 |       }
		61 |     }
		62 |   }
		63 | 
		64 |   lifecycle_rule = [
		65 |     {
		66 |       id      = "delete-infected-objects-after-90-days"
		67 |       enabled = true
		68 | 
		69 |       expiration = {
		70 |         days = 90
		71 |       }
		72 |     }
		73 |   ]
		74 | }

Check: CKV_TF_2: "Ensure Terraform module sources use a tag with a version number"
	FAILED for resource: definitions_bucket
	File: /s3.tf:76-94

		76 | module "definitions_bucket" {
		77 |   #checkov:skip=CKV_TF_1:Module registry does not support commit hashes for versions
		78 | 
		79 |   source  = "terraform-aws-modules/s3-bucket/aws"
		80 |   version = "4.1.0"
		81 | 
		82 |   bucket = "mojap-ingestion-${local.environment}-definitions"
		83 | 
		84 |   force_destroy = true
		85 | 
		86 |   server_side_encryption_configuration = {
		87 |     rule = {
		88 |       apply_server_side_encryption_by_default = {
		89 |         kms_master_key_id = module.s3_definitions_kms.key_arn
		90 |         sse_algorithm     = "aws:kms"
		91 |       }
		92 |     }
		93 |   }
		94 | }

Check: CKV_TF_2: "Ensure Terraform module sources use a tag with a version number"
	FAILED for resource: processed_bucket
	File: /s3.tf:96-114

		96  | module "processed_bucket" {
		97  |   #checkov:skip=CKV_TF_1:Module registry does not support commit hashes for versions
		98  | 
		99  |   source  = "terraform-aws-modules/s3-bucket/aws"
		100 |   version = "4.1.0"
		101 | 
		102 |   bucket = "mojap-ingestion-${local.environment}-processed"
		103 | 
		104 |   force_destroy = true
		105 | 
		106 |   server_side_encryption_configuration = {
		107 |     rule = {
		108 |       apply_server_side_encryption_by_default = {
		109 |         kms_master_key_id = module.s3_processed_kms.key_arn
		110 |         sse_algorithm     = "aws:kms"
		111 |       }
		112 |     }
		113 |   }
		114 | }

Check: CKV_TF_2: "Ensure Terraform module sources use a tag with a version number"
	FAILED for resource: bold_egress_bucket
	File: /s3.tf:137-162

		137 | module "bold_egress_bucket" {
		138 |   #checkov:skip=CKV_TF_1:Module registry does not support commit hashes for versions
		139 | 
		140 |   source  = "terraform-aws-modules/s3-bucket/aws"
		141 |   version = "4.1.0"
		142 | 
		143 |   bucket = "mojap-ingestion-${local.environment}-bold-egress"
		144 | 
		145 |   force_destroy = true
		146 | 
		147 |   versioning = {
		148 |     enabled = true
		149 |   }
		150 | 
		151 |   attach_policy = true
		152 |   policy        = data.aws_iam_policy_document.bold_egress_bucket_policy.json
		153 | 
		154 |   server_side_encryption_configuration = {
		155 |     rule = {
		156 |       apply_server_side_encryption_by_default = {
		157 |         kms_master_key_id = module.s3_bold_egress_kms.key_arn
		158 |         sse_algorithm     = "aws:kms"
		159 |       }
		160 |     }
		161 |   }
		162 | }

Check: CKV_TF_2: "Ensure Terraform module sources use a tag with a version number"
	FAILED for resource: definition_upload_lambda_security_group
	File: /security-groups.tf:17-33

		17 | module "definition_upload_lambda_security_group" {
		18 |   #checkov:skip=CKV_TF_1:Module registry does not support commit hashes for versions
		19 | 
		20 |   source  = "terraform-aws-modules/security-group/aws"
		21 |   version = "~> 5.0"
		22 | 
		23 |   name        = "${local.application_name}-${local.environment}-definition-upload-lambda"
		24 |   description = "Security Group for Definition Upload Lambda"
		25 | 
		26 |   vpc_id = module.vpc.vpc_id
		27 | 
		28 |   egress_cidr_blocks     = ["0.0.0.0/0"]
		29 |   egress_rules           = ["all-all"]
		30 |   egress_prefix_list_ids = [data.aws_prefix_list.s3.id]
		31 | 
		32 |   tags = local.tags
		33 | }

Check: CKV_TF_2: "Ensure Terraform module sources use a tag with a version number"
	FAILED for resource: transfer_lambda_security_group
	File: /security-groups.tf:35-51

		35 | module "transfer_lambda_security_group" {
		36 |   #checkov:skip=CKV_TF_1:Module registry does not support commit hashes for versions
		37 | 
		38 |   source  = "terraform-aws-modules/security-group/aws"
		39 |   version = "~> 5.0"
		40 | 
		41 |   name        = "${local.application_name}-${local.environment}-transfer-lambda"
		42 |   description = "Security Group for Transfer Lambda"
		43 | 
		44 |   vpc_id = module.vpc.vpc_id
		45 | 
		46 |   egress_cidr_blocks     = ["0.0.0.0/0"]
		47 |   egress_rules           = ["all-all"]
		48 |   egress_prefix_list_ids = [data.aws_prefix_list.s3.id]
		49 | 
		50 |   tags = local.tags
		51 | }

Check: CKV_TF_2: "Ensure Terraform module sources use a tag with a version number"
	FAILED for resource: scan_lambda_security_group
	File: /security-groups.tf:53-69

		53 | module "scan_lambda_security_group" {
		54 |   #checkov:skip=CKV_TF_1:Module registry does not support commit hashes for versions
		55 | 
		56 |   source  = "terraform-aws-modules/security-group/aws"
		57 |   version = "~> 5.0"
		58 | 
		59 |   name        = "${local.application_name}-${local.environment}-scan-lambda"
		60 |   description = "Security Group for Scan Lambda"
		61 | 
		62 |   vpc_id = module.vpc.vpc_id
		63 | 
		64 |   egress_cidr_blocks     = ["0.0.0.0/0"]
		65 |   egress_rules           = ["all-all"]
		66 |   egress_prefix_list_ids = [data.aws_prefix_list.s3.id]
		67 | 
		68 |   tags = local.tags
		69 | }

Check: CKV_TF_2: "Ensure Terraform module sources use a tag with a version number"
	FAILED for resource: quarantined_topic
	File: /sns.tf:1-41

		1  | module "quarantined_topic" {
		2  |   #checkov:skip=CKV_TF_1:Module registry does not support commit hashes for versions
		3  | 
		4  |   source  = "terraform-aws-modules/sns/aws"
		5  |   version = "6.0.1"
		6  | 
		7  |   name              = "quarantined"
		8  |   display_name      = "quarantined"
		9  |   signature_version = 2
		10 | 
		11 |   kms_master_key_id = module.quarantined_sns_kms.key_id
		12 | 
		13 |   topic_policy_statements = {
		14 |     AllowQuarantineS3 = {
		15 |       actions = ["sns:Publish"]
		16 |       principals = [{
		17 |         type        = "Service"
		18 |         identifiers = ["s3.amazonaws.com"]
		19 |       }]
		20 |       conditions = [
		21 |         {
		22 |           test     = "ArnEquals"
		23 |           variable = "aws:SourceArn"
		24 |           values   = [module.quarantine_bucket.s3_bucket_arn]
		25 |         },
		26 |         {
		27 |           test     = "StringEquals"
		28 |           variable = "aws:SourceAccount"
		29 |           values   = [data.aws_caller_identity.current.account_id]
		30 |         }
		31 |       ]
		32 |     }
		33 |   }
		34 | 
		35 |   subscriptions = {
		36 |     lambda = {
		37 |       protocol = "lambda"
		38 |       endpoint = module.notify_quarantined_lambda.lambda_function_arn
		39 |     }
		40 |   }
		41 | }

Check: CKV_TF_2: "Ensure Terraform module sources use a tag with a version number"
	FAILED for resource: transferred_topic
	File: /sns.tf:43-60

		43 | module "transferred_topic" {
		44 |   #checkov:skip=CKV_TF_1:Module registry does not support commit hashes for versions
		45 |   source  = "terraform-aws-modules/sns/aws"
		46 |   version = "6.0.1"
		47 | 
		48 |   name              = "transferred"
		49 |   display_name      = "transferred"
		50 |   signature_version = 2
		51 | 
		52 |   kms_master_key_id = module.transferred_sns_kms.key_id
		53 | 
		54 |   subscriptions = {
		55 |     lambda = {
		56 |       protocol = "lambda"
		57 |       endpoint = module.notify_transferred_lambda.lambda_function_arn
		58 |     }
		59 |   }
		60 | }

Check: CKV_TF_2: "Ensure Terraform module sources use a tag with a version number"
	FAILED for resource: transfer_family_service_role
	File: /transform-iam-roles.tf:1-15

		1  | module "transfer_family_service_role" {
		2  |   #checkov:skip=CKV_TF_1:Module registry does not support commit hashes for versions
		3  | 
		4  |   source  = "terraform-aws-modules/iam/aws//modules/iam-assumable-role"
		5  |   version = "5.37.1"
		6  | 
		7  |   create_role = true
		8  | 
		9  |   role_name         = "transfer-family-service-role"
		10 |   role_requires_mfa = false
		11 | 
		12 |   trusted_role_services = ["transfer.amazonaws.com"]
		13 | 
		14 |   custom_role_policy_arns = ["arn:aws:iam::aws:policy/service-role/AWSTransferLoggingAccess"]
		15 | }

Check: CKV_TF_2: "Ensure Terraform module sources use a tag with a version number"
	FAILED for resource: vpc_endpoints
	File: /vpc-endpoints.tf:1-53

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_TF_2: "Ensure Terraform module sources use a tag with a version number"
	FAILED for resource: vpc
	File: /vpc.tf:1-22

		1  | module "vpc" {
		2  |   #checkov:skip=CKV_TF_1:Module registry does not support commit hashes for versions
		3  | 
		4  |   source  = "terraform-aws-modules/vpc/aws"
		5  |   version = "~> 5.0"
		6  | 
		7  |   name            = "${local.application_name}-${local.environment}"
		8  |   azs             = slice(data.aws_availability_zones.available.names, 0, 3)
		9  |   cidr            = local.environment_configuration.vpc_cidr
		10 |   public_subnets  = local.environment_configuration.vpc_public_subnets
		11 |   private_subnets = local.environment_configuration.vpc_private_subnets
		12 | 
		13 |   enable_nat_gateway     = local.environment_configuration.vpc_enable_nat_gateway
		14 |   one_nat_gateway_per_az = local.environment_configuration.vpc_one_nat_gateway_per_az
		15 | 
		16 |   enable_flow_log                      = true
		17 |   create_flow_log_cloudwatch_log_group = true
		18 |   create_flow_log_cloudwatch_iam_role  = true
		19 |   flow_log_max_aggregation_interval    = 60
		20 | 
		21 |   tags = local.tags
		22 | }


checkov_exitcode=1

`CTFLint Scan` Success

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.5.0)
tflint will check the following folders:
terraform/environments/analytical-platform-ingestion

*****************************

Running tflint in terraform/environments/analytical-platform-ingestion
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=0

`Trivy Scan` Success

Show Output

*****************************

Trivy will check the following folders:
terraform/environments/analytical-platform-ingestion

*****************************

Running Trivy in terraform/environments/analytical-platform-ingestion
2024-05-21T13:19:00Z	INFO	Need to update DB
2024-05-21T13:19:00Z	INFO	Downloading DB...	repository="ghcr.io/aquasecurity/trivy-db:2"
2024-05-21T13:19:01Z	INFO	Vulnerability scanning is enabled
2024-05-21T13:19:01Z	INFO	Misconfiguration scanning is enabled
2024-05-21T13:19:01Z	INFO	Need to update the built-in policies
2024-05-21T13:19:01Z	INFO	Downloading the built-in policies...
50.41 KiB / 50.41 KiB [-----------------------------------------------------------] 100.00% ? p/s 0s2024-05-21T13:19:02Z	INFO	Secret scanning is enabled
2024-05-21T13:19:02Z	INFO	If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-05-21T13:19:02Z	INFO	Please see also https://aquasecurity.github.io/trivy/v0.51/docs/scanner/secret/#recommendation for faster secret detection
2024-05-21T13:19:09Z	INFO	Number of language-specific files	num=0
2024-05-21T13:19:09Z	INFO	Detected config files	num=15

git::https:/github.com/terraform-aws-modules/terraform-aws-lambda?ref=c42e75877ec6eed0e2142f7724aa661cffbb5cb8/iam.tf (terraform)
=================================================================================================================================
Tests: 4 (SUCCESSES: 0, FAILURES: 0, EXCEPTIONS: 4)
Failures: 0 (HIGH: 0, CRITICAL: 0)


terraform-aws-modules/lambda/aws/iam.tf (terraform)
===================================================
Tests: 8 (SUCCESSES: 0, FAILURES: 0, EXCEPTIONS: 8)
Failures: 0 (HIGH: 0, CRITICAL: 0)

trivy_exitcode=0

github-actions · 2024-06-13T18:58:06Z

`Trivy Scan` Success

Show Output

```hcl

Trivy will check the following folders:
terraform/environments/analytical-platform-ingestion

Running Trivy in terraform/environments/analytical-platform-ingestion
2024-06-13T18:57:49Z INFO Need to update DB
2024-06-13T18:57:49Z INFO Downloading DB... repository="ghcr.io/aquasecurity/trivy-db:2"
2024-06-13T18:57:52Z INFO Vulnerability scanning is enabled
2024-06-13T18:57:52Z INFO Misconfiguration scanning is enabled
2024-06-13T18:57:52Z INFO Need to update the built-in policies
2024-06-13T18:57:52Z INFO Downloading the built-in policies...
53.79 KiB / 53.79 KiB [-----------------------------------------------------------] 100.00% ? p/s 0s2024-06-13T18:57:52Z INFO Secret scanning is enabled
2024-06-13T18:57:52Z INFO If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-06-13T18:57:52Z INFO Please see also https://aquasecurity.github.io/trivy/v0.52/docs/scanner/secret/#recommendation for faster secret detection
2024-06-13T18:58:01Z INFO Number of language-specific files num=0
2024-06-13T18:58:01Z INFO Detected config files num=15

git::https:/github.com/terraform-aws-modules/terraform-aws-lambda?ref=c42e75877ec6eed0e2142f7724aa661cffbb5cb8/iam.tf (terraform)

Tests: 4 (SUCCESSES: 0, FAILURES: 0, EXCEPTIONS: 4)
Failures: 0 (HIGH: 0, CRITICAL: 0)

terraform-aws-modules/lambda/aws/iam.tf (terraform)

Tests: 8 (SUCCESSES: 0, FAILURES: 0, EXCEPTIONS: 8)
Failures: 0 (HIGH: 0, CRITICAL: 0)

trivy_exitcode=0

</details> #### `Checkov Scan` Success
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/analytical-platform-ingestion

*****************************

Running Checkov in terraform/environments/analytical-platform-ingestion
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2024-06-13 18:58:03,717 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/s3-bucket/aws//modules/notification:4.1.0 (for external modules, the --download-external-modules flag is required)
2024-06-13 18:58:03,718 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/iam/aws//modules/iam-assumable-role:5.37.1 (for external modules, the --download-external-modules flag is required)
2024-06-13 18:58:03,718 [MainThread  ] [WARNI]  Failed to download module ministryofjustice/observability-platform-tenant/aws:1.0.0 (for external modules, the --download-external-modules flag is required)
2024-06-13 18:58:03,718 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/vpc/aws//modules/vpc-endpoints:~> 5.0 (for external modules, the --download-external-modules flag is required)
2024-06-13 18:58:03,718 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/iam/aws//modules/iam-policy:5.37.1 (for external modules, the --download-external-modules flag is required)
2024-06-13 18:58:03,718 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/vpc/aws:~> 5.0 (for external modules, the --download-external-modules flag is required)
2024-06-13 18:58:03,718 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/sns/aws:6.0.1 (for external modules, the --download-external-modules flag is required)
2024-06-13 18:58:03,718 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/security-group/aws:~> 5.0 (for external modules, the --download-external-modules flag is required)
2024-06-13 18:58:03,719 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/kms/aws:2.2.1 (for external modules, the --download-external-modules flag is required)
2024-06-13 18:58:03,719 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/lambda/aws:7.2.5 (for external modules, the --download-external-modules flag is required)
2024-06-13 18:58:03,719 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/cloudwatch/aws//modules/log-group:5.3.1 (for external modules, the --download-external-modules flag is required)
2024-06-13 18:58:03,719 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/s3-bucket/aws:4.1.0 (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 142, Failed checks: 0, Skipped checks: 52


checkov_exitcode=0

`CTFLint Scan` Success

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.5.0)
tflint will check the following folders:
terraform/environments/analytical-platform-ingestion

*****************************

Running tflint in terraform/environments/analytical-platform-ingestion
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=0

`Trivy Scan` Success

Show Output

*****************************

Trivy will check the following folders:
terraform/environments/analytical-platform-ingestion

*****************************

Running Trivy in terraform/environments/analytical-platform-ingestion
2024-06-13T18:57:49Z	INFO	Need to update DB
2024-06-13T18:57:49Z	INFO	Downloading DB...	repository="ghcr.io/aquasecurity/trivy-db:2"
2024-06-13T18:57:52Z	INFO	Vulnerability scanning is enabled
2024-06-13T18:57:52Z	INFO	Misconfiguration scanning is enabled
2024-06-13T18:57:52Z	INFO	Need to update the built-in policies
2024-06-13T18:57:52Z	INFO	Downloading the built-in policies...
53.79 KiB / 53.79 KiB [-----------------------------------------------------------] 100.00% ? p/s 0s2024-06-13T18:57:52Z	INFO	Secret scanning is enabled
2024-06-13T18:57:52Z	INFO	If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-06-13T18:57:52Z	INFO	Please see also https://aquasecurity.github.io/trivy/v0.52/docs/scanner/secret/#recommendation for faster secret detection
2024-06-13T18:58:01Z	INFO	Number of language-specific files	num=0
2024-06-13T18:58:01Z	INFO	Detected config files	num=15

git::https:/github.com/terraform-aws-modules/terraform-aws-lambda?ref=c42e75877ec6eed0e2142f7724aa661cffbb5cb8/iam.tf (terraform)
=================================================================================================================================
Tests: 4 (SUCCESSES: 0, FAILURES: 0, EXCEPTIONS: 4)
Failures: 0 (HIGH: 0, CRITICAL: 0)


terraform-aws-modules/lambda/aws/iam.tf (terraform)
===================================================
Tests: 8 (SUCCESSES: 0, FAILURES: 0, EXCEPTIONS: 8)
Failures: 0 (HIGH: 0, CRITICAL: 0)

trivy_exitcode=0

github-actions · 2024-06-13T19:08:10Z

`Trivy Scan` Success

Show Output

```hcl

Trivy will check the following folders:
terraform/environments/analytical-platform-ingestion

Running Trivy in terraform/environments/analytical-platform-ingestion
2024-06-13T19:07:58Z INFO Need to update DB
2024-06-13T19:07:58Z INFO Downloading DB... repository="ghcr.io/aquasecurity/trivy-db:2"
2024-06-13T19:08:00Z INFO Vulnerability scanning is enabled
2024-06-13T19:08:00Z INFO Misconfiguration scanning is enabled
2024-06-13T19:08:00Z INFO Need to update the built-in policies
2024-06-13T19:08:00Z INFO Downloading the built-in policies...
53.79 KiB / 53.79 KiB [-----------------------------------------------------------] 100.00% ? p/s 0s2024-06-13T19:08:00Z INFO Secret scanning is enabled
2024-06-13T19:08:00Z INFO If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-06-13T19:08:00Z INFO Please see also https://aquasecurity.github.io/trivy/v0.52/docs/scanner/secret/#recommendation for faster secret detection
2024-06-13T19:08:06Z INFO Number of language-specific files num=0
2024-06-13T19:08:06Z INFO Detected config files num=15

git::https:/github.com/terraform-aws-modules/terraform-aws-lambda?ref=c42e75877ec6eed0e2142f7724aa661cffbb5cb8/iam.tf (terraform)

Tests: 4 (SUCCESSES: 0, FAILURES: 0, EXCEPTIONS: 4)
Failures: 0 (HIGH: 0, CRITICAL: 0)

terraform-aws-modules/lambda/aws/iam.tf (terraform)

Tests: 8 (SUCCESSES: 0, FAILURES: 0, EXCEPTIONS: 8)
Failures: 0 (HIGH: 0, CRITICAL: 0)

trivy_exitcode=0

</details> #### `Checkov Scan` Success
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/analytical-platform-ingestion

*****************************

Running Checkov in terraform/environments/analytical-platform-ingestion
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2024-06-13 19:08:08,618 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/s3-bucket/aws//modules/notification:4.1.0 (for external modules, the --download-external-modules flag is required)
2024-06-13 19:08:08,618 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/iam/aws//modules/iam-assumable-role:5.37.1 (for external modules, the --download-external-modules flag is required)
2024-06-13 19:08:08,619 [MainThread  ] [WARNI]  Failed to download module ministryofjustice/observability-platform-tenant/aws:1.0.0 (for external modules, the --download-external-modules flag is required)
2024-06-13 19:08:08,619 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/vpc/aws//modules/vpc-endpoints:~> 5.0 (for external modules, the --download-external-modules flag is required)
2024-06-13 19:08:08,619 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/iam/aws//modules/iam-policy:5.37.1 (for external modules, the --download-external-modules flag is required)
2024-06-13 19:08:08,619 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/vpc/aws:~> 5.0 (for external modules, the --download-external-modules flag is required)
2024-06-13 19:08:08,619 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/sns/aws:6.0.1 (for external modules, the --download-external-modules flag is required)
2024-06-13 19:08:08,619 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/security-group/aws:~> 5.0 (for external modules, the --download-external-modules flag is required)
2024-06-13 19:08:08,619 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/kms/aws:2.2.1 (for external modules, the --download-external-modules flag is required)
2024-06-13 19:08:08,619 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/lambda/aws:7.2.5 (for external modules, the --download-external-modules flag is required)
2024-06-13 19:08:08,619 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/cloudwatch/aws//modules/log-group:5.3.1 (for external modules, the --download-external-modules flag is required)
2024-06-13 19:08:08,619 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/s3-bucket/aws:4.1.0 (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 142, Failed checks: 0, Skipped checks: 52


checkov_exitcode=0

`CTFLint Scan` Success

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.5.0)
tflint will check the following folders:
terraform/environments/analytical-platform-ingestion

*****************************

Running tflint in terraform/environments/analytical-platform-ingestion
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=0

`Trivy Scan` Success

Show Output

*****************************

Trivy will check the following folders:
terraform/environments/analytical-platform-ingestion

*****************************

Running Trivy in terraform/environments/analytical-platform-ingestion
2024-06-13T19:07:58Z	INFO	Need to update DB
2024-06-13T19:07:58Z	INFO	Downloading DB...	repository="ghcr.io/aquasecurity/trivy-db:2"
2024-06-13T19:08:00Z	INFO	Vulnerability scanning is enabled
2024-06-13T19:08:00Z	INFO	Misconfiguration scanning is enabled
2024-06-13T19:08:00Z	INFO	Need to update the built-in policies
2024-06-13T19:08:00Z	INFO	Downloading the built-in policies...
53.79 KiB / 53.79 KiB [-----------------------------------------------------------] 100.00% ? p/s 0s2024-06-13T19:08:00Z	INFO	Secret scanning is enabled
2024-06-13T19:08:00Z	INFO	If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-06-13T19:08:00Z	INFO	Please see also https://aquasecurity.github.io/trivy/v0.52/docs/scanner/secret/#recommendation for faster secret detection
2024-06-13T19:08:06Z	INFO	Number of language-specific files	num=0
2024-06-13T19:08:06Z	INFO	Detected config files	num=15

git::https:/github.com/terraform-aws-modules/terraform-aws-lambda?ref=c42e75877ec6eed0e2142f7724aa661cffbb5cb8/iam.tf (terraform)
=================================================================================================================================
Tests: 4 (SUCCESSES: 0, FAILURES: 0, EXCEPTIONS: 4)
Failures: 0 (HIGH: 0, CRITICAL: 0)


terraform-aws-modules/lambda/aws/iam.tf (terraform)
===================================================
Tests: 8 (SUCCESSES: 0, FAILURES: 0, EXCEPTIONS: 8)
Failures: 0 (HIGH: 0, CRITICAL: 0)

trivy_exitcode=0

AntFMoJ · 2024-06-14T06:55:54Z

LGTM

Replace Key + IP

373067d

Gary-H9 requested review from a team as code owners May 21, 2024 13:16

github-actions bot added the environments-repository Used to exclude PRs from this repo in our Slack PR update label May 21, 2024

Gary-H9 temporarily deployed to analytical-platform-ingestion-development May 21, 2024 13:18 — with GitHub Actions Inactive

Merge branch 'main' into update-key-and-ip

01649d5

jacobwoffenden temporarily deployed to analytical-platform-ingestion-development June 13, 2024 18:56 — with GitHub Actions Inactive

Remove unused IPs

d5ca824

jacobwoffenden deployed to analytical-platform-ingestion-development June 13, 2024 19:07 — with GitHub Actions Active

AntFMoJ approved these changes Jun 14, 2024

View reviewed changes

jacobwoffenden merged commit a9ea6d0 into main Jun 14, 2024
12 checks passed

jacobwoffenden deleted the update-key-and-ip branch June 14, 2024 07:03

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

🔑 Replace Key + IP #6185

🔑 Replace Key + IP #6185

Gary-H9 commented May 21, 2024

github-actions bot commented May 21, 2024

git::https:/github.com/terraform-aws-modules/terraform-aws-lambda?ref=c42e75877ec6eed0e2142f7724aa661cffbb5cb8/iam.tf (terraform)

terraform-aws-modules/lambda/aws/iam.tf (terraform)

github-actions bot commented Jun 13, 2024

git::https:/github.com/terraform-aws-modules/terraform-aws-lambda?ref=c42e75877ec6eed0e2142f7724aa661cffbb5cb8/iam.tf (terraform)

terraform-aws-modules/lambda/aws/iam.tf (terraform)

github-actions bot commented Jun 13, 2024

git::https:/github.com/terraform-aws-modules/terraform-aws-lambda?ref=c42e75877ec6eed0e2142f7724aa661cffbb5cb8/iam.tf (terraform)

terraform-aws-modules/lambda/aws/iam.tf (terraform)

AntFMoJ commented Jun 14, 2024

🔑 Replace Key + IP #6185

🔑 Replace Key + IP #6185

Conversation

Gary-H9 commented May 21, 2024

github-actions bot commented May 21, 2024

Trivy Scan Success

git::https:/github.com/terraform-aws-modules/terraform-aws-lambda?ref=c42e75877ec6eed0e2142f7724aa661cffbb5cb8/iam.tf (terraform)

terraform-aws-modules/lambda/aws/iam.tf (terraform)

CTFLint Scan Success

Trivy Scan Success

github-actions bot commented Jun 13, 2024

Trivy Scan Success

git::https:/github.com/terraform-aws-modules/terraform-aws-lambda?ref=c42e75877ec6eed0e2142f7724aa661cffbb5cb8/iam.tf (terraform)

terraform-aws-modules/lambda/aws/iam.tf (terraform)

CTFLint Scan Success

Trivy Scan Success

github-actions bot commented Jun 13, 2024

Trivy Scan Success

git::https:/github.com/terraform-aws-modules/terraform-aws-lambda?ref=c42e75877ec6eed0e2142f7724aa661cffbb5cb8/iam.tf (terraform)

terraform-aws-modules/lambda/aws/iam.tf (terraform)

CTFLint Scan Success

Trivy Scan Success

AntFMoJ commented Jun 14, 2024

`Trivy Scan` Success

`CTFLint Scan` Success

`Trivy Scan` Success

`Trivy Scan` Success

`CTFLint Scan` Success

`Trivy Scan` Success

`Trivy Scan` Success

`CTFLint Scan` Success

`Trivy Scan` Success