Bump ecs_sandbox::modernisation-platform-terraform-ecs-cluster from 2.0.1 to 4.3.0 in /terraform/environments/delius-jitbit #6086

dependabot · 2024-05-15T00:39:30Z

Bumps ecs_sandbox::modernisation-platform-terraform-ecs-cluster from 2.0.1 to 4.3.0.

Release notes

Sourced from ecs_sandbox::modernisation-platform-terraform-ecs-cluster's releases.

v4.3.0

What's Changed

Numerous dependabot bumps

updated README.md by @Khatraf in ministryofjustice/modernisation-platform-terraform-ecs-cluster#139

Don't force nonsensitive value for container definitions by @georgepstaylor in ministryofjustice/modernisation-platform-terraform-ecs-cluster#155

Make mount points optional by @georgepstaylor in ministryofjustice/modernisation-platform-terraform-ecs-cluster#156

New Contributors

@Khatraf made their first contribution in ministryofjustice/modernisation-platform-terraform-ecs-cluster#139

Full Changelog: ministryofjustice/modernisation-platform-terraform-ecs-cluster@v4.2.1...v4.3.0

v4.2.1

What's Changed

feature/6675-GitHub Action Status Badges by @Kudzai-moj in ministryofjustice/modernisation-platform-terraform-ecs-cluster#140

Build(deps): Bump actions/setup-go from 5.0.0 to 5.0.1 by @dependabot in ministryofjustice/modernisation-platform-terraform-ecs-cluster#141

Build(deps): Bump bridgecrewio/checkov-action from 12.2726.0 to 12.2731.0 by @dependabot in ministryofjustice/modernisation-platform-terraform-ecs-cluster#142

📝 Add Documentation for the container definition module by @georgepstaylor in ministryofjustice/modernisation-platform-terraform-ecs-cluster#143

New Contributors

@Kudzai-moj made their first contribution in ministryofjustice/modernisation-platform-terraform-ecs-cluster#140

Full Changelog: ministryofjustice/modernisation-platform-terraform-ecs-cluster@v4.2.0...v4.2.1

v4.2.0

What's New

Mount points are now supported in a container definition

What's Changed

Add missing mount points key to json by @georgepstaylor in ministryofjustice/modernisation-platform-terraform-ecs-cluster#138

Full Changelog: ministryofjustice/modernisation-platform-terraform-ecs-cluster@v4.1.1...v4.2.0

v4.1.1

Change to replace [*] with [0] to select one item not a list.

What's Changed

Feature/trivy by @ep-93 in ministryofjustice/modernisation-platform-terraform-ecs-cluster#136

Remove splat operator from output to get string not string by @georgepstaylor in ministryofjustice/modernisation-platform-terraform-ecs-cluster#137

Full Changelog: ministryofjustice/modernisation-platform-terraform-ecs-cluster@v4.1.0...v4.1.1

4.1.0

Introduced new attributes that can be passed into the module. See below for details of all changes.

What's Changed

Build(deps): Bump bridgecrewio/checkov-action from 12.2725.0 to 12.2726.0 by @dependabot in ministryofjustice/modernisation-platform-terraform-ecs-cluster#126

Build(deps): Bump actions/upload-artifact from 4.3.2 to 4.3.3 by @dependabot in ministryofjustice/modernisation-platform-terraform-ecs-cluster#127

Build(deps): Bump github/codeql-action from 3.25.1 to 3.25.2 by @dependabot in ministryofjustice/modernisation-platform-terraform-ecs-cluster#128

... (truncated)

Commits

b006479 Merge pull request #157 from ministryofjustice/dependabot/github_actions/gith...
521ae82 Merge pull request #156 from ministryofjustice/mount-points-optional
659ce2e Merge pull request #155 from ministryofjustice/nonsensitive-container-defs
bdb15db Merge pull request #139 from ministryofjustice/docs/update-README-file
e22a720 Build(deps): Bump github/codeql-action from 3.25.4 to 3.25.5
e28af24 terraform-docs: automated action
322c719 make mount points optional
b19d811 Update task_def.tf
380d206 Merge pull request #154 from ministryofjustice/dependabot/github_actions/brid...
07dc9da Merge pull request #153 from ministryofjustice/dependabot/github_actions/ossf...
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [ecs_sandbox::modernisation-platform-terraform-ecs-cluster](https://github.com/ministryofjustice/modernisation-platform-terraform-ecs-cluster) from 2.0.1 to 4.3.0. - [Release notes](https://github.com/ministryofjustice/modernisation-platform-terraform-ecs-cluster/releases) - [Commits](ministryofjustice/modernisation-platform-terraform-ecs-cluster@v2.0.1...v4.3.0) --- updated-dependencies: - dependency-name: ecs_sandbox::github::ministryofjustice/modernisation-platform-terraform-ecs-cluster::v2.0.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]>

github-actions · 2024-05-15T00:42:02Z

`Trivy Scan` Failed

Show Output

```hcl

Trivy will check the following folders:
terraform/environments/delius-jitbit

Running Trivy in terraform/environments/delius-jitbit
2024-05-15T00:41:50Z INFO Need to update DB
2024-05-15T00:41:50Z INFO Downloading DB... repository="ghcr.io/aquasecurity/trivy-db:2"
2024-05-15T00:41:52Z INFO Vulnerability scanning is enabled
2024-05-15T00:41:52Z INFO Misconfiguration scanning is enabled
2024-05-15T00:41:52Z INFO Need to update the built-in policies
2024-05-15T00:41:52Z INFO Downloading the built-in policies...
50.41 KiB / 50.41 KiB [-----------------------------------------------------------] 100.00% ? p/s 0s2024-05-15T00:41:53Z INFO Secret scanning is enabled
2024-05-15T00:41:53Z INFO If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-05-15T00:41:53Z INFO Please see also https://aquasecurity.github.io/trivy/v0.51/docs/scanner/secret/#recommendation for faster secret detection
2024-05-15T00:41:56Z INFO Number of language-specific files num=0
2024-05-15T00:41:56Z INFO Detected config files num=15

ecs.tf (terraform)

Tests: 2 (SUCCESSES: 1, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 0, CRITICAL: 1)

CRITICAL: Security group rule allows egress to multiple public internet addresses.
════════════════════════════════════════
Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.

See https://avd.aquasec.com/misconfig/avd-aws-0104
────────────────────────────────────────
ecs.tf:70
via ecs.tf:64-72 (aws_security_group_rule.allow_all_egress)
────────────────────────────────────────
64 resource "aws_security_group_rule" "allow_all_egress" {
65 description = "Allow all outbound traffic to any IPv4 address"
66 type = "egress"
67 from_port = 0
68 to_port = 0
69 protocol = "-1"
70 [ cidr_blocks = ["0.0.0.0/0"]
71 security_group_id = aws_security_group.jitbit.id
72 }
────────────────────────────────────────

github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.2.1/main.tf (terraform)

Tests: 7 (SUCCESSES: 5, FAILURES: 0, EXCEPTIONS: 2)
Failures: 0 (HIGH: 0, CRITICAL: 0)

github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0/main.tf (terraform)

Tests: 14 (SUCCESSES: 12, FAILURES: 2, EXCEPTIONS: 0)
Failures: 2 (HIGH: 2, CRITICAL: 0)

HIGH: Bucket does not encrypt data with a customer managed key.
════════════════════════════════════════
Encryption using AWS keys provides protection for your S3 buckets. To increase control of the encryption and manage factors like rotation use customer managed keys.

See https://avd.aquasec.com/misconfig/avd-aws-0132
────────────────────────────────────────
github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0/main.tf:157-165
via s3.tf:1-84 (module.jitbit_bucket)
────────────────────────────────────────
157 ┌ resource "aws_s3_bucket_server_side_encryption_configuration" "default" {
158 │ bucket = aws_s3_bucket.default.id
159 │ rule {
160 │ apply_server_side_encryption_by_default {
161 │ sse_algorithm = var.sse_algorithm
162 │ kms_master_key_id = (var.custom_kms_key != "") ? var.custom_kms_key : ""
163 │ }
164 │ }
165 └ }
────────────────────────────────────────

HIGH: Bucket does not encrypt data with a customer managed key.
════════════════════════════════════════
Encryption using AWS keys provides protection for your S3 buckets. To increase control of the encryption and manage factors like rotation use customer managed keys.

See https://avd.aquasec.com/misconfig/avd-aws-0132
────────────────────────────────────────
github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0/main.tf:157-165
via ecs.tf:11-51 (module.s3_bucket_app_deployment)
────────────────────────────────────────
157 ┌ resource "aws_s3_bucket_server_side_encryption_configuration" "default" {
158 │ bucket = aws_s3_bucket.default.id
159 │ rule {
160 │ apply_server_side_encryption_by_default {
161 │ sse_algorithm = var.sse_algorithm
162 │ kms_master_key_id = (var.custom_kms_key != "") ? var.custom_kms_key : ""
163 │ }
164 │ }
165 └ }
────────────────────────────────────────

iam.tf (terraform)

Tests: 6 (SUCCESSES: 0, FAILURES: 0, EXCEPTIONS: 6)
Failures: 0 (HIGH: 0, CRITICAL: 0)

lb.tf (terraform)

Tests: 7 (SUCCESSES: 4, FAILURES: 2, EXCEPTIONS: 1)
Failures: 2 (HIGH: 0, CRITICAL: 2)

CRITICAL: Security group rule allows ingress from public internet.
════════════════════════════════════════
Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.

See https://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
lb.tf:62-70
via lb.tf:35-71 (ingress)
via lb.tf:30-87 (aws_security_group.load_balancer_security_group)
────────────────────────────────────────
30 resource "aws_security_group" "load_balancer_security_group" {
..
62 ┌ ipv6_cidr_blocks = [
63 │ # Route53 Healthcheck Access Cidrs IPv6
64 │ "2406:da18:7ff:f800::/53", # ap-southeast-1 Region
65 │ "2406:da18:fff:f800::/53", # ap-southeast-1 Region
66 │ "2a05:d018:fff:f800::/53", # eu-west-1 Region
67 │ "2a05:d018:7ff:f800::/53", # eu-west-1 Region
68 └ "2600:1f18:7fff:f800::/53", # us-east-1 Region
..
────────────────────────────────────────

CRITICAL: Security group rule allows ingress from public internet.
════════════════════════════════════════
Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.

See https://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
lb.tf:40-60
via lb.tf:35-71 (ingress)
via lb.tf:30-87 (aws_security_group.load_balancer_security_group)
────────────────────────────────────────
30 resource "aws_security_group" "load_balancer_security_group" {
..
40 ┌ cidr_blocks = distinct(flatten([
41 │ "20.49.214.199/32", # Azure Landing Zone Egress
42 │ "20.49.214.228/32", # Azure Landing Zone Egress
43 │ "20.26.11.71/32", # Azure Landing Zone Egress
44 │ "20.26.11.108/32", # Azure Landing Zone Egress
45 │ # Route53 Healthcheck Access Cidrs
46 └ # London Region not support yet, so metrics are not yet publised, can be enabled at later stage for Route53 endpoint monitor
..
────────────────────────────────────────

monitoring.tf (terraform)

Tests: 2 (SUCCESSES: 1, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Topic does not have encryption enabled.
════════════════════════════════════════
Topics should be encrypted to protect their contents.

See https://avd.aquasec.com/misconfig/avd-aws-0095
────────────────────────────────────────
monitoring.tf:6-8
────────────────────────────────────────
6 ┌ resource "aws_sns_topic" "jitbit_alerting" {
7 │ name = "jitbit_alerting"
8 └ }
────────────────────────────────────────

ses.tf (terraform)

Tests: 2 (SUCCESSES: 0, FAILURES: 0, EXCEPTIONS: 2)
Failures: 0 (HIGH: 0, CRITICAL: 0)

ses_bounce.tf (terraform)

Tests: 6 (SUCCESSES: 2, FAILURES: 1, EXCEPTIONS: 3)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Topic does not have encryption enabled.
════════════════════════════════════════
Topics should be encrypted to protect their contents.

See https://avd.aquasec.com/misconfig/avd-aws-0095
────────────────────────────────────────
ses_bounce.tf:1-5
────────────────────────────────────────
1 ┌ resource "aws_sns_topic" "jitbit_ses_destination_topic_bounce_email_notification" {
2 │ name = format("%s-ses-destination-topic-bounce-email-notification", local.application_name)
3 │
4 │ tags = local.tags
5 └ }
────────────────────────────────────────

ses_logging.tf (terraform)

Tests: 5 (SUCCESSES: 2, FAILURES: 1, EXCEPTIONS: 2)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Topic does not have encryption enabled.
════════════════════════════════════════
Topics should be encrypted to protect their contents.

See https://avd.aquasec.com/misconfig/avd-aws-0095
────────────────────────────────────────
ses_logging.tf:4-8
────────────────────────────────────────
4 ┌ resource "aws_sns_topic" "jitbit_ses_destination_topic" {
5 │ name = format("%s-ses-destination-topic", local.application_name)
6 │
7 │ tags = local.tags
8 └ }
────────────────────────────────────────

trivy_exitcode=1

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/delius-jitbit

*****************************

Running Checkov in terraform/environments/delius-jitbit
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2024-05-15 00:41:59,298 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0:None (for external modules, the --download-external-modules flag is required)
2024-05-15 00:41:59,298 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.1.0:None (for external modules, the --download-external-modules flag is required)
2024-05-15 00:41:59,298 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-ecs-cluster//cluster?ref=v4.3.0:None (for external modules, the --download-external-modules flag is required)
2024-05-15 00:41:59,298 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-pagerduty-integration?ref=v2.0.0:None (for external modules, the --download-external-modules flag is required)
2024-05-15 00:41:59,298 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.2.1:None (for external modules, the --download-external-modules flag is required)
2024-05-15 00:41:59,298 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-ecs-cluster//cluster?ref=v2.0.1:None (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 279, Failed checks: 60, Skipped checks: 20

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: bastion_linux
	File: /bastion_linux.tf:6-41
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		6  | module "bastion_linux" {
		7  |   source = "github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.2.1"
		8  | 
		9  |   providers = {
		10 |     aws.share-host   = aws.core-vpc # core-vpc-(environment) holds the networking for all accounts
		11 |     aws.share-tenant = aws          # The default provider (unaliased, `aws`) is the tenant
		12 |   }
		13 | 
		14 |   # s3 - used for logs and user ssh public keys
		15 |   bucket_name = "bastion"
		16 |   # public keys
		17 |   public_key_data = local.public_key_data.keys[local.environment]
		18 |   # logs
		19 |   log_auto_clean       = "Enabled"
		20 |   log_standard_ia_days = 30  # days before moving to IA storage
		21 |   log_glacier_days     = 60  # days before moving to Glacier
		22 |   log_expiry_days      = 180 # days before log expiration
		23 |   # bastion
		24 |   allow_ssh_commands = false
		25 | 
		26 |   app_name      = var.networking[0].application
		27 |   business_unit = local.vpc_name
		28 |   subnet_set    = local.subnet_set
		29 |   environment   = local.environment
		30 |   region        = "eu-west-2"
		31 | 
		32 |   # custom scaling schedule
		33 |   autoscaling_cron = {
		34 |     "down" : "0 21 * * *",
		35 |     "up" : "0 05 * * *"
		36 |   }
		37 | 
		38 |   # Tags
		39 |   tags_common = local.tags
		40 |   tags_prefix = terraform.workspace
		41 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: ecs
	File: /ecs.tf:1-8
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		1 | module "ecs" {
		2 |   source = "github.com/ministryofjustice/modernisation-platform-terraform-ecs-cluster//cluster?ref=v2.0.1"
		3 | 
		4 |   environment = local.environment
		5 |   name        = local.application_name
		6 | 
		7 |   tags = local.tags
		8 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: s3_bucket_app_deployment
	File: /ecs.tf:11-51
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		11 | module "s3_bucket_app_deployment" {
		12 | 
		13 |   source = "github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0"
		14 | 
		15 |   providers = {
		16 |     aws.bucket-replication = aws
		17 |   }
		18 |   bucket_name        = "${local.application_name}-${local.environment}-deployment"
		19 |   versioning_enabled = true
		20 | 
		21 |   ownership_controls = "BucketOwnerEnforced"
		22 | 
		23 |   lifecycle_rule = [
		24 |     {
		25 |       id      = "main"
		26 |       enabled = "Enabled"
		27 |       prefix  = ""
		28 | 
		29 |       tags = {
		30 |         rule      = "log"
		31 |         autoclean = "true"
		32 |       }
		33 | 
		34 |       noncurrent_version_transition = [
		35 |         {
		36 |           days          = 90
		37 |           storage_class = "STANDARD_IA"
		38 |           }, {
		39 |           days          = 365
		40 |           storage_class = "GLACIER"
		41 |         }
		42 |       ]
		43 | 
		44 |       noncurrent_version_expiration = {
		45 |         days = 730
		46 |       }
		47 |     }
		48 |   ]
		49 | 
		50 |   tags = local.tags
		51 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.jitbit
	File: /ecs.tf:84-87
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		84 | resource "aws_cloudwatch_log_group" "jitbit" {
		85 |   name              = format("%s-ecs", local.application_name)
		86 |   retention_in_days = 30
		87 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.jitbit
	File: /ecs.tf:84-87
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		84 | resource "aws_cloudwatch_log_group" "jitbit" {
		85 |   name              = format("%s-ecs", local.application_name)
		86 |   retention_in_days = 30
		87 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.ecs_service_policy
	File: /iam.tf:37-52
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		37 | data "aws_iam_policy_document" "ecs_service_policy" {
		38 |   statement {
		39 |     effect    = "Allow"
		40 |     resources = ["*"]
		41 | 
		42 |     actions = [
		43 |       "elasticloadbalancing:Describe*",
		44 |       "elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
		45 |       "elasticloadbalancing:RegisterInstancesWithLoadBalancer",
		46 |       "ec2:Describe*",
		47 |       "ec2:AuthorizeSecurityGroupIngress",
		48 |       "elasticloadbalancing:RegisterTargets",
		49 |       "elasticloadbalancing:DeregisterTargets"
		50 |     ]
		51 |   }
		52 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.ecs_service_policy
	File: /iam.tf:37-52
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		37 | data "aws_iam_policy_document" "ecs_service_policy" {
		38 |   statement {
		39 |     effect    = "Allow"
		40 |     resources = ["*"]
		41 | 
		42 |     actions = [
		43 |       "elasticloadbalancing:Describe*",
		44 |       "elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
		45 |       "elasticloadbalancing:RegisterInstancesWithLoadBalancer",
		46 |       "ec2:Describe*",
		47 |       "ec2:AuthorizeSecurityGroupIngress",
		48 |       "elasticloadbalancing:RegisterTargets",
		49 |       "elasticloadbalancing:DeregisterTargets"
		50 |     ]
		51 |   }
		52 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.ecs_exec
	File: /iam.tf:98-114
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		98  | data "aws_iam_policy_document" "ecs_exec" {
		99  |   statement {
		100 |     effect    = "Allow"
		101 |     resources = ["*"]
		102 | 
		103 |     actions = [
		104 |       "ssm:GetParameters",
		105 |       "ecr:GetAuthorizationToken",
		106 |       "ecr:BatchCheckLayerAvailability",
		107 |       "ecr:GetDownloadUrlForLayer",
		108 |       "ecr:BatchGetImage",
		109 |       "logs:CreateLogGroup",
		110 |       "logs:CreateLogStream",
		111 |       "logs:PutLogEvents"
		112 |     ]
		113 |   }
		114 | }

Check: CKV_AWS_108: "Ensure IAM policies does not allow data exfiltration"
	FAILED for resource: aws_iam_policy_document.ecs_exec
	File: /iam.tf:98-114
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-data-exfiltration

		98  | data "aws_iam_policy_document" "ecs_exec" {
		99  |   statement {
		100 |     effect    = "Allow"
		101 |     resources = ["*"]
		102 | 
		103 |     actions = [
		104 |       "ssm:GetParameters",
		105 |       "ecr:GetAuthorizationToken",
		106 |       "ecr:BatchCheckLayerAvailability",
		107 |       "ecr:GetDownloadUrlForLayer",
		108 |       "ecr:BatchGetImage",
		109 |       "logs:CreateLogGroup",
		110 |       "logs:CreateLogStream",
		111 |       "logs:PutLogEvents"
		112 |     ]
		113 |   }
		114 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.ecs_exec
	File: /iam.tf:98-114
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		98  | data "aws_iam_policy_document" "ecs_exec" {
		99  |   statement {
		100 |     effect    = "Allow"
		101 |     resources = ["*"]
		102 | 
		103 |     actions = [
		104 |       "ssm:GetParameters",
		105 |       "ecr:GetAuthorizationToken",
		106 |       "ecr:BatchCheckLayerAvailability",
		107 |       "ecr:GetDownloadUrlForLayer",
		108 |       "ecr:BatchGetImage",
		109 |       "logs:CreateLogGroup",
		110 |       "logs:CreateLogStream",
		111 |       "logs:PutLogEvents"
		112 |     ]
		113 |   }
		114 | }

Check: CKV_AWS_26: "Ensure all data stored in the SNS topic is encrypted"
	FAILED for resource: aws_sns_topic.jitbit_alerting
	File: /monitoring.tf:6-8
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-15

		6 | resource "aws_sns_topic" "jitbit_alerting" {
		7 |   name = "jitbit_alerting"
		8 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: pagerduty_core_alerts
	File: /monitoring.tf:37-44
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		37 | module "pagerduty_core_alerts" {
		38 |   depends_on = [
		39 |     aws_sns_topic.jitbit_alerting
		40 |   ]
		41 |   source                    = "github.com/ministryofjustice/modernisation-platform-terraform-pagerduty-integration?ref=v2.0.0"
		42 |   sns_topics                = [aws_sns_topic.jitbit_alerting.name]
		43 |   pagerduty_integration_key = local.pagerduty_integration_key
		44 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.app_logs
	File: /monitoring_app.tf:1-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		1 | resource "aws_cloudwatch_log_group" "app_logs" {
		2 |   name              = "delius-jitbit-ecs"
		3 |   retention_in_days = 30
		4 | 
		5 |   tags = local.tags
		6 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.app_logs
	File: /monitoring_app.tf:1-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		1 | resource "aws_cloudwatch_log_group" "app_logs" {
		2 |   name              = "delius-jitbit-ecs"
		3 |   retention_in_days = 30
		4 | 
		5 |   tags = local.tags
		6 | }

Check: CKV_AWS_354: "Ensure RDS Performance Insights are encrypted using KMS CMKs"
	FAILED for resource: aws_db_instance.jitbit
	File: /rds.tf:40-83
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-354

		40 | resource "aws_db_instance" "jitbit" {
		41 |   engine         = "sqlserver-se"
		42 |   license_model  = "license-included"
		43 |   engine_version = local.application_data.accounts[local.environment].db_engine_version
		44 |   instance_class = local.application_data.accounts[local.environment].db_instance_class
		45 |   identifier     = "${local.application_name}-${local.environment}-database"
		46 |   username       = local.application_data.accounts[local.environment].db_user
		47 | 
		48 |   manage_master_user_password = true
		49 | 
		50 |   snapshot_identifier = try(local.application_data.accounts[local.environment].db_snapshot_identifier, null)
		51 | 
		52 |   # tflint-ignore: aws_db_instance_default_parameter_group
		53 |   parameter_group_name        = "default.sqlserver-se-15.0"
		54 |   deletion_protection         = local.application_data.accounts[local.environment].db_deletion_protection
		55 |   delete_automated_backups    = local.application_data.accounts[local.environment].db_delete_automated_backups
		56 |   skip_final_snapshot         = local.skip_final_snapshot
		57 |   final_snapshot_identifier   = !local.skip_final_snapshot ? "${local.application_name}-${local.environment}-database-final-snapshot" : null
		58 |   allocated_storage           = local.application_data.accounts[local.environment].db_allocated_storage
		59 |   max_allocated_storage       = local.application_data.accounts[local.environment].db_max_allocated_storage
		60 |   storage_type                = local.application_data.accounts[local.environment].db_storage_type
		61 |   maintenance_window          = local.application_data.accounts[local.environment].db_maintenance_window
		62 |   auto_minor_version_upgrade  = local.application_data.accounts[local.environment].db_auto_minor_version_upgrade
		63 |   allow_major_version_upgrade = local.application_data.accounts[local.environment].db_allow_major_version_upgrade
		64 |   backup_window               = local.application_data.accounts[local.environment].db_backup_window
		65 |   backup_retention_period     = local.application_data.accounts[local.environment].db_retention_period
		66 |   #checkov:skip=CKV_AWS_133: "backup_retention enabled, can be edited it application_variables.json"
		67 |   iam_database_authentication_enabled = local.application_data.accounts[local.environment].db_iam_database_authentication_enabled
		68 |   #checkov:skip=CKV_AWS_161: "iam auth enabled, but optional"
		69 |   db_subnet_group_name   = aws_db_subnet_group.jitbit.id
		70 |   vpc_security_group_ids = [aws_security_group.database_security_group.id]
		71 |   multi_az               = local.application_data.accounts[local.environment].db_multi_az
		72 |   #checkov:skip=CKV_AWS_157: "multi-az enabled, but optional"
		73 |   monitoring_interval = local.application_data.accounts[local.environment].db_monitoring_interval
		74 |   monitoring_role_arn = local.application_data.accounts[local.environment].db_monitoring_interval == 0 ? "" : aws_iam_role.rds_enhanced_monitoring[0].arn
		75 |   #checkov:skip=CKV_AWS_118: "enhanced monitoring is enabled, but optional"
		76 |   storage_encrypted               = true
		77 |   performance_insights_enabled    = local.application_data.accounts[local.environment].db_performance_insights_enabled
		78 |   performance_insights_kms_key_id = "" #tfsec:ignore:aws-rds-enable-performance-insights-encryption Left empty so that it will run, however should be populated with real key in scenario.
		79 |   enabled_cloudwatch_logs_exports = local.application_data.accounts[local.environment].db_enabled_cloudwatch_logs_exports
		80 |   tags = merge(local.tags,
		81 |     { Name = lower(format("%s-%s-database", local.application_name, local.environment)) }
		82 |   )
		83 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: jitbit_bucket
	File: /s3.tf:1-84
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: ecs_sandbox
	File: /sandbox_ecs.tf:1-10
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		1  | module "ecs_sandbox" {
		2  |   count = local.is-development ? 1 : 0
		3  | 
		4  |   source = "github.com/ministryofjustice/modernisation-platform-terraform-ecs-cluster//cluster?ref=v4.3.0"
		5  | 
		6  |   environment = local.environment
		7  |   name        = "${local.application_name}-sandbox"
		8  | 
		9  |   tags = local.tags
		10 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: s3_bucket_app_deployment_sandbox
	File: /sandbox_ecs.tf:12-53
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		12 | module "s3_bucket_app_deployment_sandbox" {
		13 |   count = local.is-development ? 1 : 0
		14 | 
		15 |   source = "github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0"
		16 | 
		17 |   providers = {
		18 |     aws.bucket-replication = aws
		19 |   }
		20 |   bucket_name        = "${local.application_name}-sandbox-deployment"
		21 |   versioning_enabled = true
		22 | 
		23 |   ownership_controls = "BucketOwnerEnforced"
		24 | 
		25 |   lifecycle_rule = [
		26 |     {
		27 |       id      = "main"
		28 |       enabled = "Enabled"
		29 |       prefix  = ""
		30 | 
		31 |       tags = {
		32 |         rule      = "log"
		33 |         autoclean = "true"
		34 |       }
		35 | 
		36 |       noncurrent_version_transition = [
		37 |         {
		38 |           days          = 90
		39 |           storage_class = "STANDARD_IA"
		40 |           }, {
		41 |           days          = 365
		42 |           storage_class = "GLACIER"
		43 |         }
		44 |       ]
		45 | 
		46 |       noncurrent_version_expiration = {
		47 |         days = 730
		48 |       }
		49 |     }
		50 |   ]
		51 | 
		52 |   tags = local.tags
		53 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.jitbit_sandbox
	File: /sandbox_ecs.tf:92-97
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		92 | resource "aws_cloudwatch_log_group" "jitbit_sandbox" {
		93 |   count = local.is-development ? 1 : 0
		94 | 
		95 |   name              = format("%s-%s-ecs", local.application_name, "sandbox")
		96 |   retention_in_days = 30
		97 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.jitbit_sandbox
	File: /sandbox_ecs.tf:92-97
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		92 | resource "aws_cloudwatch_log_group" "jitbit_sandbox" {
		93 |   count = local.is-development ? 1 : 0
		94 | 
		95 |   name              = format("%s-%s-ecs", local.application_name, "sandbox")
		96 |   retention_in_days = 30
		97 | }

Check: CKV_AWS_150: "Ensure that Load Balancer has deletion protection enabled"
	FAILED for resource: aws_lb.external_sandbox
	File: /sandbox_lb.tf:2-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-150

		2  | resource "aws_lb" "external_sandbox" {
		3  |   # checkov:skip=CKV_AWS_91
		4  |   # checkov:skip=CKV2_AWS_28
		5  | 
		6  |   count = local.is-development ? 1 : 0
		7  | 
		8  |   name               = "${local.application_name}-lb-sandbox"
		9  |   internal           = false
		10 |   load_balancer_type = "application"
		11 |   security_groups    = [aws_security_group.load_balancer_security_group_sandbox[0].id]
		12 |   subnets            = data.aws_subnets.shared-public.ids
		13 | 
		14 |   drop_invalid_header_fields = true
		15 | 
		16 |   tags = merge(
		17 |     local.tags,
		18 |     {
		19 |       Name = "${local.application_name}-sandbox"
		20 |     }
		21 |   )
		22 | }

Check: CKV_AWS_118: "Ensure that enhanced monitoring is enabled for Amazon RDS instances"
	FAILED for resource: aws_db_instance.jitbit_sandbox
	File: /sandbox_rds.tf:27-70
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/ensure-that-enhanced-monitoring-is-enabled-for-amazon-rds-instances

		27 | resource "aws_db_instance" "jitbit_sandbox" {
		28 |   count = local.is-development ? 1 : 0
		29 | 
		30 |   engine         = "sqlserver-se"
		31 |   license_model  = "license-included"
		32 |   engine_version = local.application_data.accounts["sandbox"].db_engine_version
		33 |   instance_class = local.application_data.accounts["sandbox"].db_instance_class
		34 |   identifier     = "${local.application_name}-sandbox-database"
		35 |   username       = local.application_data.accounts["sandbox"].db_user
		36 | 
		37 |   manage_master_user_password = true
		38 | 
		39 |   snapshot_identifier = try(local.application_data.accounts["sandbox"].db_snapshot_identifier, null)
		40 | 
		41 |   # tflint-ignore: aws_db_instance_default_parameter_group
		42 |   parameter_group_name        = "default.sqlserver-se-15.0"
		43 |   deletion_protection         = local.application_data.accounts["sandbox"].db_deletion_protection
		44 |   delete_automated_backups    = local.application_data.accounts["sandbox"].db_delete_automated_backups
		45 |   skip_final_snapshot         = local.application_data.accounts["sandbox"].db_skip_final_snapshot
		46 |   final_snapshot_identifier   = !local.skip_final_snapshot ? "${local.application_name}-sandbox-database-final-snapshot" : null
		47 |   allocated_storage           = local.application_data.accounts["sandbox"].db_allocated_storage
		48 |   max_allocated_storage       = local.application_data.accounts["sandbox"].db_max_allocated_storage
		49 |   storage_type                = local.application_data.accounts["sandbox"].db_storage_type
		50 |   maintenance_window          = local.application_data.accounts["sandbox"].db_maintenance_window
		51 |   auto_minor_version_upgrade  = local.application_data.accounts["sandbox"].db_auto_minor_version_upgrade
		52 |   allow_major_version_upgrade = local.application_data.accounts["sandbox"].db_allow_major_version_upgrade
		53 |   backup_window               = local.application_data.accounts["sandbox"].db_backup_window
		54 |   backup_retention_period     = local.application_data.accounts["sandbox"].db_retention_period
		55 |   #checkov:skip=CKV_AWS_133: "backup_retention enabled, can be edited it application_variables.json"
		56 |   iam_database_authentication_enabled = local.application_data.accounts["sandbox"].db_iam_database_authentication_enabled
		57 |   #checkov:skip=CKV_AWS_161: "iam auth enabled, but optional"
		58 |   db_subnet_group_name   = aws_db_subnet_group.jitbit.id
		59 |   vpc_security_group_ids = [aws_security_group.database_security_group_sandbox[0].id]
		60 |   multi_az               = local.application_data.accounts["sandbox"].db_multi_az
		61 |   #checkov:skip=CKV_AWS_157: "multi-az enabled, but optional"
		62 |   storage_encrypted = true
		63 | 
		64 |   tags = merge(
		65 |     local.tags,
		66 |     {
		67 |       Name = lower(format("%s-%s-database", local.application_name, "sandbox"))
		68 |     }
		69 |   )
		70 | }

Check: CKV_AWS_129: "Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled"
	FAILED for resource: aws_db_instance.jitbit_sandbox
	File: /sandbox_rds.tf:27-70
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-that-respective-logs-of-amazon-relational-database-service-amazon-rds-are-enabled

		27 | resource "aws_db_instance" "jitbit_sandbox" {
		28 |   count = local.is-development ? 1 : 0
		29 | 
		30 |   engine         = "sqlserver-se"
		31 |   license_model  = "license-included"
		32 |   engine_version = local.application_data.accounts["sandbox"].db_engine_version
		33 |   instance_class = local.application_data.accounts["sandbox"].db_instance_class
		34 |   identifier     = "${local.application_name}-sandbox-database"
		35 |   username       = local.application_data.accounts["sandbox"].db_user
		36 | 
		37 |   manage_master_user_password = true
		38 | 
		39 |   snapshot_identifier = try(local.application_data.accounts["sandbox"].db_snapshot_identifier, null)
		40 | 
		41 |   # tflint-ignore: aws_db_instance_default_parameter_group
		42 |   parameter_group_name        = "default.sqlserver-se-15.0"
		43 |   deletion_protection         = local.application_data.accounts["sandbox"].db_deletion_protection
		44 |   delete_automated_backups    = local.application_data.accounts["sandbox"].db_delete_automated_backups
		45 |   skip_final_snapshot         = local.application_data.accounts["sandbox"].db_skip_final_snapshot
		46 |   final_snapshot_identifier   = !local.skip_final_snapshot ? "${local.application_name}-sandbox-database-final-snapshot" : null
		47 |   allocated_storage           = local.application_data.accounts["sandbox"].db_allocated_storage
		48 |   max_allocated_storage       = local.application_data.accounts["sandbox"].db_max_allocated_storage
		49 |   storage_type                = local.application_data.accounts["sandbox"].db_storage_type
		50 |   maintenance_window          = local.application_data.accounts["sandbox"].db_maintenance_window
		51 |   auto_minor_version_upgrade  = local.application_data.accounts["sandbox"].db_auto_minor_version_upgrade
		52 |   allow_major_version_upgrade = local.application_data.accounts["sandbox"].db_allow_major_version_upgrade
		53 |   backup_window               = local.application_data.accounts["sandbox"].db_backup_window
		54 |   backup_retention_period     = local.application_data.accounts["sandbox"].db_retention_period
		55 |   #checkov:skip=CKV_AWS_133: "backup_retention enabled, can be edited it application_variables.json"
		56 |   iam_database_authentication_enabled = local.application_data.accounts["sandbox"].db_iam_database_authentication_enabled
		57 |   #checkov:skip=CKV_AWS_161: "iam auth enabled, but optional"
		58 |   db_subnet_group_name   = aws_db_subnet_group.jitbit.id
		59 |   vpc_security_group_ids = [aws_security_group.database_security_group_sandbox[0].id]
		60 |   multi_az               = local.application_data.accounts["sandbox"].db_multi_az
		61 |   #checkov:skip=CKV_AWS_157: "multi-az enabled, but optional"
		62 |   storage_encrypted = true
		63 | 
		64 |   tags = merge(
		65 |     local.tags,
		66 |     {
		67 |       Name = lower(format("%s-%s-database", local.application_name, "sandbox"))
		68 |     }
		69 |   )
		70 | }

Check: CKV_AWS_354: "Ensure RDS Performance Insights are encrypted using KMS CMKs"
	FAILED for resource: aws_db_instance.jitbit_sandbox
	File: /sandbox_rds.tf:27-70
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-354

		27 | resource "aws_db_instance" "jitbit_sandbox" {
		28 |   count = local.is-development ? 1 : 0
		29 | 
		30 |   engine         = "sqlserver-se"
		31 |   license_model  = "license-included"
		32 |   engine_version = local.application_data.accounts["sandbox"].db_engine_version
		33 |   instance_class = local.application_data.accounts["sandbox"].db_instance_class
		34 |   identifier     = "${local.application_name}-sandbox-database"
		35 |   username       = local.application_data.accounts["sandbox"].db_user
		36 | 
		37 |   manage_master_user_password = true
		38 | 
		39 |   snapshot_identifier = try(local.application_data.accounts["sandbox"].db_snapshot_identifier, null)
		40 | 
		41 |   # tflint-ignore: aws_db_instance_default_parameter_group
		42 |   parameter_group_name        = "default.sqlserver-se-15.0"
		43 |   deletion_protection         = local.application_data.accounts["sandbox"].db_deletion_protection
		44 |   delete_automated_backups    = local.application_data.accounts["sandbox"].db_delete_automated_backups
		45 |   skip_final_snapshot         = local.application_data.accounts["sandbox"].db_skip_final_snapshot
		46 |   final_snapshot_identifier   = !local.skip_final_snapshot ? "${local.application_name}-sandbox-database-final-snapshot" : null
		47 |   allocated_storage           = local.application_data.accounts["sandbox"].db_allocated_storage
		48 |   max_allocated_storage       = local.application_data.accounts["sandbox"].db_max_allocated_storage
		49 |   storage_type                = local.application_data.accounts["sandbox"].db_storage_type
		50 |   maintenance_window          = local.application_data.accounts["sandbox"].db_maintenance_window
		51 |   auto_minor_version_upgrade  = local.application_data.accounts["sandbox"].db_auto_minor_version_upgrade
		52 |   allow_major_version_upgrade = local.application_data.accounts["sandbox"].db_allow_major_version_upgrade
		53 |   backup_window               = local.application_data.accounts["sandbox"].db_backup_window
		54 |   backup_retention_period     = local.application_data.accounts["sandbox"].db_retention_period
		55 |   #checkov:skip=CKV_AWS_133: "backup_retention enabled, can be edited it application_variables.json"
		56 |   iam_database_authentication_enabled = local.application_data.accounts["sandbox"].db_iam_database_authentication_enabled
		57 |   #checkov:skip=CKV_AWS_161: "iam auth enabled, but optional"
		58 |   db_subnet_group_name   = aws_db_subnet_group.jitbit.id
		59 |   vpc_security_group_ids = [aws_security_group.database_security_group_sandbox[0].id]
		60 |   multi_az               = local.application_data.accounts["sandbox"].db_multi_az
		61 |   #checkov:skip=CKV_AWS_157: "multi-az enabled, but optional"
		62 |   storage_encrypted = true
		63 | 
		64 |   tags = merge(
		65 |     local.tags,
		66 |     {
		67 |       Name = lower(format("%s-%s-database", local.application_name, "sandbox"))
		68 |     }
		69 |   )
		70 | }

Check: CKV_AWS_353: "Ensure that RDS instances have performance insights enabled"
	FAILED for resource: aws_db_instance.jitbit_sandbox
	File: /sandbox_rds.tf:27-70
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-353

		27 | resource "aws_db_instance" "jitbit_sandbox" {
		28 |   count = local.is-development ? 1 : 0
		29 | 
		30 |   engine         = "sqlserver-se"
		31 |   license_model  = "license-included"
		32 |   engine_version = local.application_data.accounts["sandbox"].db_engine_version
		33 |   instance_class = local.application_data.accounts["sandbox"].db_instance_class
		34 |   identifier     = "${local.application_name}-sandbox-database"
		35 |   username       = local.application_data.accounts["sandbox"].db_user
		36 | 
		37 |   manage_master_user_password = true
		38 | 
		39 |   snapshot_identifier = try(local.application_data.accounts["sandbox"].db_snapshot_identifier, null)
		40 | 
		41 |   # tflint-ignore: aws_db_instance_default_parameter_group
		42 |   parameter_group_name        = "default.sqlserver-se-15.0"
		43 |   deletion_protection         = local.application_data.accounts["sandbox"].db_deletion_protection
		44 |   delete_automated_backups    = local.application_data.accounts["sandbox"].db_delete_automated_backups
		45 |   skip_final_snapshot         = local.application_data.accounts["sandbox"].db_skip_final_snapshot
		46 |   final_snapshot_identifier   = !local.skip_final_snapshot ? "${local.application_name}-sandbox-database-final-snapshot" : null
		47 |   allocated_storage           = local.application_data.accounts["sandbox"].db_allocated_storage
		48 |   max_allocated_storage       = local.application_data.accounts["sandbox"].db_max_allocated_storage
		49 |   storage_type                = local.application_data.accounts["sandbox"].db_storage_type
		50 |   maintenance_window          = local.application_data.accounts["sandbox"].db_maintenance_window
		51 |   auto_minor_version_upgrade  = local.application_data.accounts["sandbox"].db_auto_minor_version_upgrade
		52 |   allow_major_version_upgrade = local.application_data.accounts["sandbox"].db_allow_major_version_upgrade
		53 |   backup_window               = local.application_data.accounts["sandbox"].db_backup_window
		54 |   backup_retention_period     = local.application_data.accounts["sandbox"].db_retention_period
		55 |   #checkov:skip=CKV_AWS_133: "backup_retention enabled, can be edited it application_variables.json"
		56 |   iam_database_authentication_enabled = local.application_data.accounts["sandbox"].db_iam_database_authentication_enabled
		57 |   #checkov:skip=CKV_AWS_161: "iam auth enabled, but optional"
		58 |   db_subnet_group_name   = aws_db_subnet_group.jitbit.id
		59 |   vpc_security_group_ids = [aws_security_group.database_security_group_sandbox[0].id]
		60 |   multi_az               = local.application_data.accounts["sandbox"].db_multi_az
		61 |   #checkov:skip=CKV_AWS_157: "multi-az enabled, but optional"
		62 |   storage_encrypted = true
		63 | 
		64 |   tags = merge(
		65 |     local.tags,
		66 |     {
		67 |       Name = lower(format("%s-%s-database", local.application_name, "sandbox"))
		68 |     }
		69 |   )
		70 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: jitbit_bucket_sandbox
	File: /sandbox_s3.tf:1-86
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_273: "Ensure access is controlled through SSO and not AWS IAM defined users"
	FAILED for resource: aws_iam_user.jitbit_ses_smtp_user
	File: /ses.tf:54-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-273

		54 | resource "aws_iam_user" "jitbit_ses_smtp_user" {
		55 |   name = "${local.environment}-jitbit-smtp-user"
		56 | }

Check: CKV_AWS_290: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_user_policy.jitbit_ses_smtp_user
	File: /ses.tf:62-79
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-290

		62 | resource "aws_iam_user_policy" "jitbit_ses_smtp_user" {
		63 |   name = "${local.environment}-jitbit-ses-smtp-user-policy"
		64 |   user = aws_iam_user.jitbit_ses_smtp_user.name
		65 | 
		66 |   policy = jsonencode({
		67 |     Version = "2012-10-17",
		68 |     Statement = [
		69 |       {
		70 |         Effect = "Allow",
		71 |         Action = [
		72 |           "ses:SendRawEmail",
		73 |           "ses:SendEmail"
		74 |         ],
		75 |         Resource = "*"
		76 |       }
		77 |     ]
		78 |   })
		79 | }

Check: CKV_AWS_355: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_user_policy.jitbit_ses_smtp_user
	File: /ses.tf:62-79
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-355

		62 | resource "aws_iam_user_policy" "jitbit_ses_smtp_user" {
		63 |   name = "${local.environment}-jitbit-ses-smtp-user-policy"
		64 |   user = aws_iam_user.jitbit_ses_smtp_user.name
		65 | 
		66 |   policy = jsonencode({
		67 |     Version = "2012-10-17",
		68 |     Statement = [
		69 |       {
		70 |         Effect = "Allow",
		71 |         Action = [
		72 |           "ses:SendRawEmail",
		73 |           "ses:SendEmail"
		74 |         ],
		75 |         Resource = "*"
		76 |       }
		77 |     ]
		78 |   })
		79 | }

Check: CKV_AWS_337: "Ensure SSM parameters are using KMS CMK"
	FAILED for resource: aws_ssm_parameter.jitbit_ses_smtp_user
	File: /ses.tf:81-91
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-337

		81 | resource "aws_ssm_parameter" "jitbit_ses_smtp_user" {
		82 |   name = "/${local.environment}/jitbit/ses_smtp"
		83 |   type = "SecureString"
		84 |   value = jsonencode({
		85 |     user              = aws_iam_user.jitbit_ses_smtp_user.name,
		86 |     key               = aws_iam_access_key.jitbit_ses_smtp_user.id,
		87 |     secret            = aws_iam_access_key.jitbit_ses_smtp_user.secret
		88 |     ses_smtp_user     = aws_iam_access_key.jitbit_ses_smtp_user.id
		89 |     ses_smtp_password = aws_iam_access_key.jitbit_ses_smtp_user.ses_smtp_password_v4
		90 |   })
		91 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.lambda_policy_bounce_email_notification
	File: /ses_bounce.tf:58-75
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		58 | data "aws_iam_policy_document" "lambda_policy_bounce_email_notification" {
		59 |   statement {
		60 |     actions = [
		61 |       "ses:SendRawEmail",
		62 |       "ses:SendEmail"
		63 |     ]
		64 |     resources = ["*"]
		65 |   }
		66 | 
		67 |   statement {
		68 |     actions = [
		69 |       "logs:CreateLogGroup",
		70 |       "logs:CreateLogStream",
		71 |       "logs:PutLogEvents"
		72 |     ]
		73 |     resources = ["arn:aws:logs:*:*:*"]
		74 |   }
		75 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.lambda_policy_bounce_email_notification
	File: /ses_bounce.tf:58-75
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		58 | data "aws_iam_policy_document" "lambda_policy_bounce_email_notification" {
		59 |   statement {
		60 |     actions = [
		61 |       "ses:SendRawEmail",
		62 |       "ses:SendEmail"
		63 |     ]
		64 |     resources = ["*"]
		65 |   }
		66 | 
		67 |   statement {
		68 |     actions = [
		69 |       "logs:CreateLogGroup",
		70 |       "logs:CreateLogStream",
		71 |       "logs:PutLogEvents"
		72 |     ]
		73 |     resources = ["arn:aws:logs:*:*:*"]
		74 |   }
		75 | }

Check: CKV_AWS_26: "Ensure all data stored in the SNS topic is encrypted"
	FAILED for resource: aws_sns_topic.jitbit_ses_destination_topic_bounce_email_notification
	File: /ses_bounce.tf:1-5
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-15

		1 | resource "aws_sns_topic" "jitbit_ses_destination_topic_bounce_email_notification" {
		2 |   name = format("%s-ses-destination-topic-bounce-email-notification", local.application_name)
		3 | 
		4 |   tags = local.tags
		5 | }

Check: CKV_AWS_115: "Ensure that AWS Lambda function is configured for function-level concurrent execution limit"
	FAILED for resource: aws_lambda_function.bounce_email_notification
	File: /ses_bounce.tf:29-43
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-function-level-concurrent-execution-limit

		29 | resource "aws_lambda_function" "bounce_email_notification" {
		30 |   filename         = "${path.module}/lambda/bounce_email_notification/bounce_email_notification.zip"
		31 |   function_name    = "bounce_email_notification"
		32 |   architectures    = ["arm64"]
		33 |   role             = aws_iam_role.lambda_bounce_email_notification.arn
		34 |   runtime          = "python3.12"
		35 |   handler          = "bounce_email_notification.handler"
		36 |   source_code_hash = data.archive_file.lambda_function_payload_bounce_email_notification.output_base64sha256
		37 | 
		38 |   lifecycle {
		39 |     replace_triggered_by = [aws_iam_role.lambda_bounce_email_notification]
		40 |   }
		41 | 
		42 |   tags = local.tags
		43 | }

Check: CKV_AWS_272: "Ensure AWS Lambda function is configured to validate code-signing"
	FAILED for resource: aws_lambda_function.bounce_email_notification
	File: /ses_bounce.tf:29-43
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-272

		29 | resource "aws_lambda_function" "bounce_email_notification" {
		30 |   filename         = "${path.module}/lambda/bounce_email_notification/bounce_email_notification.zip"
		31 |   function_name    = "bounce_email_notification"
		32 |   architectures    = ["arm64"]
		33 |   role             = aws_iam_role.lambda_bounce_email_notification.arn
		34 |   runtime          = "python3.12"
		35 |   handler          = "bounce_email_notification.handler"
		36 |   source_code_hash = data.archive_file.lambda_function_payload_bounce_email_notification.output_base64sha256
		37 | 
		38 |   lifecycle {
		39 |     replace_triggered_by = [aws_iam_role.lambda_bounce_email_notification]
		40 |   }
		41 | 
		42 |   tags = local.tags
		43 | }

Check: CKV_AWS_117: "Ensure that AWS Lambda function is configured inside a VPC"
	FAILED for resource: aws_lambda_function.bounce_email_notification
	File: /ses_bounce.tf:29-43
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-inside-a-vpc-1

		29 | resource "aws_lambda_function" "bounce_email_notification" {
		30 |   filename         = "${path.module}/lambda/bounce_email_notification/bounce_email_notification.zip"
		31 |   function_name    = "bounce_email_notification"
		32 |   architectures    = ["arm64"]
		33 |   role             = aws_iam_role.lambda_bounce_email_notification.arn
		34 |   runtime          = "python3.12"
		35 |   handler          = "bounce_email_notification.handler"
		36 |   source_code_hash = data.archive_file.lambda_function_payload_bounce_email_notification.output_base64sha256
		37 | 
		38 |   lifecycle {
		39 |     replace_triggered_by = [aws_iam_role.lambda_bounce_email_notification]
		40 |   }
		41 | 
		42 |   tags = local.tags
		43 | }

Check: CKV_AWS_116: "Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)"
	FAILED for resource: aws_lambda_function.bounce_email_notification
	File: /ses_bounce.tf:29-43
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-a-dead-letter-queue-dlq

		29 | resource "aws_lambda_function" "bounce_email_notification" {
		30 |   filename         = "${path.module}/lambda/bounce_email_notification/bounce_email_notification.zip"
		31 |   function_name    = "bounce_email_notification"
		32 |   architectures    = ["arm64"]
		33 |   role             = aws_iam_role.lambda_bounce_email_notification.arn
		34 |   runtime          = "python3.12"
		35 |   handler          = "bounce_email_notification.handler"
		36 |   source_code_hash = data.archive_file.lambda_function_payload_bounce_email_notification.output_base64sha256
		37 | 
		38 |   lifecycle {
		39 |     replace_triggered_by = [aws_iam_role.lambda_bounce_email_notification]
		40 |   }
		41 | 
		42 |   tags = local.tags
		43 | }

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: aws_lambda_function.bounce_email_notification
	File: /ses_bounce.tf:29-43
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		29 | resource "aws_lambda_function" "bounce_email_notification" {
		30 |   filename         = "${path.module}/lambda/bounce_email_notification/bounce_email_notification.zip"
		31 |   function_name    = "bounce_email_notification"
		32 |   architectures    = ["arm64"]
		33 |   role             = aws_iam_role.lambda_bounce_email_notification.arn
		34 |   runtime          = "python3.12"
		35 |   handler          = "bounce_email_notification.handler"
		36 |   source_code_hash = data.archive_file.lambda_function_payload_bounce_email_notification.output_base64sha256
		37 | 
		38 |   lifecycle {
		39 |     replace_triggered_by = [aws_iam_role.lambda_bounce_email_notification]
		40 |   }
		41 | 
		42 |   tags = local.tags
		43 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.bounce_email_notification
	File: /ses_bounce.tf:91-96
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		91 | resource "aws_cloudwatch_log_group" "bounce_email_notification" {
		92 |   name              = "/aws/lambda/bounce_email_notification"
		93 |   retention_in_days = local.application_data.accounts[local.environment].lambda_log_retention_days
		94 | 
		95 |   tags = local.tags
		96 | }
Check: CKV_AWS_26: "Ensure all data stored in the SNS topic is encrypted"
	FAILED for resource: aws_sns_topic.jitbit_ses_destination_topic
	File: /ses_logging.tf:4-8
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-15

		4 | resource "aws_sns_topic" "jitbit_ses_destination_topic" {
		5 |   name = format("%s-ses-destination-topic", local.application_name)
		6 | 
		7 |   tags = local.tags
		8 | }

Check: CKV_AWS_115: "Ensure that AWS Lambda function is configured for function-level concurrent execution limit"
	FAILED for resource: aws_lambda_function.sns_to_cloudwatch
	File: /ses_logging.tf:36-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-function-level-concurrent-execution-limit

		36 | resource "aws_lambda_function" "sns_to_cloudwatch" {
		37 |   filename         = "${path.module}/lambda/sns_to_cloudwatch/sns_to_cloudwatch.zip"
		38 |   function_name    = "sns_to_cloudwatch"
		39 |   architectures    = ["arm64"]
		40 |   role             = aws_iam_role.lambda_logging.arn
		41 |   runtime          = "python3.12"
		42 |   handler          = "sns_to_cloudwatch.handler"
		43 |   source_code_hash = data.archive_file.lambda_function_payload.output_base64sha256
		44 | 
		45 |   environment {
		46 |     variables = {
		47 |       LOG_GROUP_NAME = aws_cloudwatch_log_group.sns_logs.name
		48 |     }
		49 |   }
		50 | 
		51 |   lifecycle {
		52 |     replace_triggered_by = [aws_iam_role.lambda_logging]
		53 |   }
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_272: "Ensure AWS Lambda function is configured to validate code-signing"
	FAILED for resource: aws_lambda_function.sns_to_cloudwatch
	File: /ses_logging.tf:36-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-272

		36 | resource "aws_lambda_function" "sns_to_cloudwatch" {
		37 |   filename         = "${path.module}/lambda/sns_to_cloudwatch/sns_to_cloudwatch.zip"
		38 |   function_name    = "sns_to_cloudwatch"
		39 |   architectures    = ["arm64"]
		40 |   role             = aws_iam_role.lambda_logging.arn
		41 |   runtime          = "python3.12"
		42 |   handler          = "sns_to_cloudwatch.handler"
		43 |   source_code_hash = data.archive_file.lambda_function_payload.output_base64sha256
		44 | 
		45 |   environment {
		46 |     variables = {
		47 |       LOG_GROUP_NAME = aws_cloudwatch_log_group.sns_logs.name
		48 |     }
		49 |   }
		50 | 
		51 |   lifecycle {
		52 |     replace_triggered_by = [aws_iam_role.lambda_logging]
		53 |   }
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_173: "Check encryption settings for Lambda environmental variable"
	FAILED for resource: aws_lambda_function.sns_to_cloudwatch
	File: /ses_logging.tf:36-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-5

		36 | resource "aws_lambda_function" "sns_to_cloudwatch" {
		37 |   filename         = "${path.module}/lambda/sns_to_cloudwatch/sns_to_cloudwatch.zip"
		38 |   function_name    = "sns_to_cloudwatch"
		39 |   architectures    = ["arm64"]
		40 |   role             = aws_iam_role.lambda_logging.arn
		41 |   runtime          = "python3.12"
		42 |   handler          = "sns_to_cloudwatch.handler"
		43 |   source_code_hash = data.archive_file.lambda_function_payload.output_base64sha256
		44 | 
		45 |   environment {
		46 |     variables = {
		47 |       LOG_GROUP_NAME = aws_cloudwatch_log_group.sns_logs.name
		48 |     }
		49 |   }
		50 | 
		51 |   lifecycle {
		52 |     replace_triggered_by = [aws_iam_role.lambda_logging]
		53 |   }
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_117: "Ensure that AWS Lambda function is configured inside a VPC"
	FAILED for resource: aws_lambda_function.sns_to_cloudwatch
	File: /ses_logging.tf:36-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-inside-a-vpc-1

		36 | resource "aws_lambda_function" "sns_to_cloudwatch" {
		37 |   filename         = "${path.module}/lambda/sns_to_cloudwatch/sns_to_cloudwatch.zip"
		38 |   function_name    = "sns_to_cloudwatch"
		39 |   architectures    = ["arm64"]
		40 |   role             = aws_iam_role.lambda_logging.arn
		41 |   runtime          = "python3.12"
		42 |   handler          = "sns_to_cloudwatch.handler"
		43 |   source_code_hash = data.archive_file.lambda_function_payload.output_base64sha256
		44 | 
		45 |   environment {
		46 |     variables = {
		47 |       LOG_GROUP_NAME = aws_cloudwatch_log_group.sns_logs.name
		48 |     }
		49 |   }
		50 | 
		51 |   lifecycle {
		52 |     replace_triggered_by = [aws_iam_role.lambda_logging]
		53 |   }
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_116: "Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)"
	FAILED for resource: aws_lambda_function.sns_to_cloudwatch
	File: /ses_logging.tf:36-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-a-dead-letter-queue-dlq

		36 | resource "aws_lambda_function" "sns_to_cloudwatch" {
		37 |   filename         = "${path.module}/lambda/sns_to_cloudwatch/sns_to_cloudwatch.zip"
		38 |   function_name    = "sns_to_cloudwatch"
		39 |   architectures    = ["arm64"]
		40 |   role             = aws_iam_role.lambda_logging.arn
		41 |   runtime          = "python3.12"
		42 |   handler          = "sns_to_cloudwatch.handler"
		43 |   source_code_hash = data.archive_file.lambda_function_payload.output_base64sha256
		44 | 
		45 |   environment {
		46 |     variables = {
		47 |       LOG_GROUP_NAME = aws_cloudwatch_log_group.sns_logs.name
		48 |     }
		49 |   }
		50 | 
		51 |   lifecycle {
		52 |     replace_triggered_by = [aws_iam_role.lambda_logging]
		53 |   }
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: aws_lambda_function.sns_to_cloudwatch
	File: /ses_logging.tf:36-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		36 | resource "aws_lambda_function" "sns_to_cloudwatch" {
		37 |   filename         = "${path.module}/lambda/sns_to_cloudwatch/sns_to_cloudwatch.zip"
		38 |   function_name    = "sns_to_cloudwatch"
		39 |   architectures    = ["arm64"]
		40 |   role             = aws_iam_role.lambda_logging.arn
		41 |   runtime          = "python3.12"
		42 |   handler          = "sns_to_cloudwatch.handler"
		43 |   source_code_hash = data.archive_file.lambda_function_payload.output_base64sha256
		44 | 
		45 |   environment {
		46 |     variables = {
		47 |       LOG_GROUP_NAME = aws_cloudwatch_log_group.sns_logs.name
		48 |     }
		49 |   }
		50 | 
		51 |   lifecycle {
		52 |     replace_triggered_by = [aws_iam_role.lambda_logging]
		53 |   }
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.sns_logs
	File: /ses_logging.tf:58-63
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		58 | resource "aws_cloudwatch_log_group" "sns_logs" {
		59 |   name              = format("%s-ses-logs", local.application_name)
		60 |   retention_in_days = local.application_data.accounts[local.environment].lambda_log_retention_days
		61 | 
		62 |   tags = local.tags
		63 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.execution_logs
	File: /ses_logging.tf:65-70
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		65 | resource "aws_cloudwatch_log_group" "execution_logs" {
		66 |   name              = format("/aws/lambda/%s", aws_lambda_function.sns_to_cloudwatch.function_name)
		67 |   retention_in_days = 3
		68 | 
		69 |   tags = local.tags
		70 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.execution_logs
	File: /ses_logging.tf:65-70
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		65 | resource "aws_cloudwatch_log_group" "execution_logs" {
		66 |   name              = format("/aws/lambda/%s", aws_lambda_function.sns_to_cloudwatch.function_name)
		67 |   retention_in_days = 3
		68 | 
		69 |   tags = local.tags
		70 | }

Check: CKV_AWS_337: "Ensure SSM parameters are using KMS CMK"
	FAILED for resource: aws_ssm_parameter.app_url
	File: /ssm.tf:2-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-337

		2 | resource "aws_ssm_parameter" "app_url" {
		3 |   name  = "/${var.networking[0].application}/environment/app-url"
		4 |   type  = "String"
		5 |   value = "https://${local.app_url}/"
		6 | }

Check: CKV_AWS_192: "Ensure WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell"
	FAILED for resource: aws_wafv2_web_acl.this
	File: /waf.tf:1-53
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-waf-prevents-message-lookup-in-log4j2

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.waf
	File: /waf.tf:59-63
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		59 | resource "aws_cloudwatch_log_group" "waf" {
		60 |   name              = "aws-waf-logs-${local.application_name}"
		61 |   retention_in_days = 60
		62 |   tags              = local.tags
		63 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.waf
	File: /waf.tf:59-63
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		59 | resource "aws_cloudwatch_log_group" "waf" {
		60 |   name              = "aws-waf-logs-${local.application_name}"
		61 |   retention_in_days = 60
		62 |   tags              = local.tags
		63 | }

Check: CKV2_AWS_60: "Ensure RDS instance with copy tags to snapshots is enabled"
	FAILED for resource: aws_db_instance.jitbit
	File: /rds.tf:40-83
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-60

		40 | resource "aws_db_instance" "jitbit" {
		41 |   engine         = "sqlserver-se"
		42 |   license_model  = "license-included"
		43 |   engine_version = local.application_data.accounts[local.environment].db_engine_version
		44 |   instance_class = local.application_data.accounts[local.environment].db_instance_class
		45 |   identifier     = "${local.application_name}-${local.environment}-database"
		46 |   username       = local.application_data.accounts[local.environment].db_user
		47 | 
		48 |   manage_master_user_password = true
		49 | 
		50 |   snapshot_identifier = try(local.application_data.accounts[local.environment].db_snapshot_identifier, null)
		51 | 
		52 |   # tflint-ignore: aws_db_instance_default_parameter_group
		53 |   parameter_group_name        = "default.sqlserver-se-15.0"
		54 |   deletion_protection         = local.application_data.accounts[local.environment].db_deletion_protection
		55 |   delete_automated_backups    = local.application_data.accounts[local.environment].db_delete_automated_backups
		56 |   skip_final_snapshot         = local.skip_final_snapshot
		57 |   final_snapshot_identifier   = !local.skip_final_snapshot ? "${local.application_name}-${local.environment}-database-final-snapshot" : null
		58 |   allocated_storage           = local.application_data.accounts[local.environment].db_allocated_storage
		59 |   max_allocated_storage       = local.application_data.accounts[local.environment].db_max_allocated_storage
		60 |   storage_type                = local.application_data.accounts[local.environment].db_storage_type
		61 |   maintenance_window          = local.application_data.accounts[local.environment].db_maintenance_window
		62 |   auto_minor_version_upgrade  = local.application_data.accounts[local.environment].db_auto_minor_version_upgrade
		63 |   allow_major_version_upgrade = local.application_data.accounts[local.environment].db_allow_major_version_upgrade
		64 |   backup_window               = local.application_data.accounts[local.environment].db_backup_window
		65 |   backup_retention_period     = local.application_data.accounts[local.environment].db_retention_period
		66 |   #checkov:skip=CKV_AWS_133: "backup_retention enabled, can be edited it application_variables.json"
		67 |   iam_database_authentication_enabled = local.application_data.accounts[local.environment].db_iam_database_authentication_enabled
		68 |   #checkov:skip=CKV_AWS_161: "iam auth enabled, but optional"
		69 |   db_subnet_group_name   = aws_db_subnet_group.jitbit.id
		70 |   vpc_security_group_ids = [aws_security_group.database_security_group.id]
		71 |   multi_az               = local.application_data.accounts[local.environment].db_multi_az
		72 |   #checkov:skip=CKV_AWS_157: "multi-az enabled, but optional"
		73 |   monitoring_interval = local.application_data.accounts[local.environment].db_monitoring_interval
		74 |   monitoring_role_arn = local.application_data.accounts[local.environment].db_monitoring_interval == 0 ? "" : aws_iam_role.rds_enhanced_monitoring[0].arn
		75 |   #checkov:skip=CKV_AWS_118: "enhanced monitoring is enabled, but optional"
		76 |   storage_encrypted               = true
		77 |   performance_insights_enabled    = local.application_data.accounts[local.environment].db_performance_insights_enabled
		78 |   performance_insights_kms_key_id = "" #tfsec:ignore:aws-rds-enable-performance-insights-encryption Left empty so that it will run, however should be populated with real key in scenario.
		79 |   enabled_cloudwatch_logs_exports = local.application_data.accounts[local.environment].db_enabled_cloudwatch_logs_exports
		80 |   tags = merge(local.tags,
		81 |     { Name = lower(format("%s-%s-database", local.application_name, local.environment)) }
		82 |   )
		83 | }

Check: CKV2_AWS_60: "Ensure RDS instance with copy tags to snapshots is enabled"
	FAILED for resource: aws_db_instance.jitbit_sandbox
	File: /sandbox_rds.tf:27-70
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-60

		27 | resource "aws_db_instance" "jitbit_sandbox" {
		28 |   count = local.is-development ? 1 : 0
		29 | 
		30 |   engine         = "sqlserver-se"
		31 |   license_model  = "license-included"
		32 |   engine_version = local.application_data.accounts["sandbox"].db_engine_version
		33 |   instance_class = local.application_data.accounts["sandbox"].db_instance_class
		34 |   identifier     = "${local.application_name}-sandbox-database"
		35 |   username       = local.application_data.accounts["sandbox"].db_user
		36 | 
		37 |   manage_master_user_password = true
		38 | 
		39 |   snapshot_identifier = try(local.application_data.accounts["sandbox"].db_snapshot_identifier, null)
		40 | 
		41 |   # tflint-ignore: aws_db_instance_default_parameter_group
		42 |   parameter_group_name        = "default.sqlserver-se-15.0"
		43 |   deletion_protection         = local.application_data.accounts["sandbox"].db_deletion_protection
		44 |   delete_automated_backups    = local.application_data.accounts["sandbox"].db_delete_automated_backups
		45 |   skip_final_snapshot         = local.application_data.accounts["sandbox"].db_skip_final_snapshot
		46 |   final_snapshot_identifier   = !local.skip_final_snapshot ? "${local.application_name}-sandbox-database-final-snapshot" : null
		47 |   allocated_storage           = local.application_data.accounts["sandbox"].db_allocated_storage
		48 |   max_allocated_storage       = local.application_data.accounts["sandbox"].db_max_allocated_storage
		49 |   storage_type                = local.application_data.accounts["sandbox"].db_storage_type
		50 |   maintenance_window          = local.application_data.accounts["sandbox"].db_maintenance_window
		51 |   auto_minor_version_upgrade  = local.application_data.accounts["sandbox"].db_auto_minor_version_upgrade
		52 |   allow_major_version_upgrade = local.application_data.accounts["sandbox"].db_allow_major_version_upgrade
		53 |   backup_window               = local.application_data.accounts["sandbox"].db_backup_window
		54 |   backup_retention_period     = local.application_data.accounts["sandbox"].db_retention_period
		55 |   #checkov:skip=CKV_AWS_133: "backup_retention enabled, can be edited it application_variables.json"
		56 |   iam_database_authentication_enabled = local.application_data.accounts["sandbox"].db_iam_database_authentication_enabled
		57 |   #checkov:skip=CKV_AWS_161: "iam auth enabled, but optional"
		58 |   db_subnet_group_name   = aws_db_subnet_group.jitbit.id
		59 |   vpc_security_group_ids = [aws_security_group.database_security_group_sandbox[0].id]
		60 |   multi_az               = local.application_data.accounts["sandbox"].db_multi_az
		61 |   #checkov:skip=CKV_AWS_157: "multi-az enabled, but optional"
		62 |   storage_encrypted = true
		63 | 
		64 |   tags = merge(
		65 |     local.tags,
		66 |     {
		67 |       Name = lower(format("%s-%s-database", local.application_name, "sandbox"))
		68 |     }
		69 |   )
		70 | }

Check: CKV2_AWS_34: "AWS SSM Parameter should be Encrypted"
	FAILED for resource: aws_ssm_parameter.app_url
	File: /ssm.tf:2-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-ssm-parameter-is-encrypted

		2 | resource "aws_ssm_parameter" "app_url" {
		3 |   name  = "/${var.networking[0].application}/environment/app-url"
		4 |   type  = "String"
		5 |   value = "https://${local.app_url}/"
		6 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: aws_security_group.jitbit
	File: /ecs.tf:53-62
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		53 | resource "aws_security_group" "jitbit" {
		54 |   vpc_id      = data.aws_vpc.shared.id
		55 |   name        = format("hmpps-%s-%s-service", local.environment, local.application_name)
		56 |   description = "Security group for the ${local.application_name} service"
		57 |   tags        = local.tags
		58 | 
		59 |   lifecycle {
		60 |     create_before_destroy = true
		61 |   }
		62 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: aws_security_group.jitbit_sandbox
	File: /sandbox_ecs.tf:55-66
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		55 | resource "aws_security_group" "jitbit_sandbox" {
		56 |   count = local.is-development ? 1 : 0
		57 | 
		58 |   vpc_id      = data.aws_vpc.shared.id
		59 |   name        = format("hmpps-%s-%s-service", "sandbox", local.application_name)
		60 |   description = "Security group for the ${local.application_name} service"
		61 |   tags        = local.tags
		62 | 
		63 |   lifecycle {
		64 |     create_before_destroy = true
		65 |   }
		66 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.db_app_connection_string_sandbox
	File: /sandbox_secrets.tf:2-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		2  | resource "aws_secretsmanager_secret" "db_app_connection_string_sandbox" {
		3  |   count = local.is-development ? 1 : 0
		4  |   #checkov:skip=CKV_AWS_149
		5  |   name                    = "${var.networking[0].application}-app-connection-string-sandbox"
		6  |   recovery_window_in_days = 0
		7  |   tags = merge(
		8  |     local.tags,
		9  |     {
		10 |       Name = "${var.networking[0].application}-app-connection-string-sandbox"
		11 |     },
		12 |   )
		13 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.db_app_connection_string
	File: /secrets.tf:5-15
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		5  | resource "aws_secretsmanager_secret" "db_app_connection_string" {
		6  |   #checkov:skip=CKV_AWS_149
		7  |   name                    = "${var.networking[0].application}-app-connection-string"
		8  |   recovery_window_in_days = 0
		9  |   tags = merge(
		10 |     local.tags,
		11 |     {
		12 |       Name = "${var.networking[0].application}-app-connection-string"
		13 |     },
		14 |   )
		15 | }


checkov_exitcode=1

`CTFLint Scan` Failed

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.5.0)
tflint will check the following folders:
terraform/environments/delius-jitbit

*****************************

Running tflint in terraform/environments/delius-jitbit
Excluding the following checks: terraform_unused_declarations
1 issue(s) found:

Warning: Missing version constraint for provider "archive" in `required_providers` (terraform_required_providers)

  on terraform/environments/delius-jitbit/ses_bounce.tf line 22:
  22: data "archive_file" "lambda_function_payload_bounce_email_notification" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_required_providers.md

tflint_exitcode=2

`Trivy Scan` Failed

Show Output

*****************************

Trivy will check the following folders:
terraform/environments/delius-jitbit

*****************************

Running Trivy in terraform/environments/delius-jitbit
2024-05-15T00:41:50Z	INFO	Need to update DB
2024-05-15T00:41:50Z	INFO	Downloading DB...	repository="ghcr.io/aquasecurity/trivy-db:2"
2024-05-15T00:41:52Z	INFO	Vulnerability scanning is enabled
2024-05-15T00:41:52Z	INFO	Misconfiguration scanning is enabled
2024-05-15T00:41:52Z	INFO	Need to update the built-in policies
2024-05-15T00:41:52Z	INFO	Downloading the built-in policies...
50.41 KiB / 50.41 KiB [-----------------------------------------------------------] 100.00% ? p/s 0s2024-05-15T00:41:53Z	INFO	Secret scanning is enabled
2024-05-15T00:41:53Z	INFO	If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-05-15T00:41:53Z	INFO	Please see also https://aquasecurity.github.io/trivy/v0.51/docs/scanner/secret/#recommendation for faster secret detection
2024-05-15T00:41:56Z	INFO	Number of language-specific files	num=0
2024-05-15T00:41:56Z	INFO	Detected config files	num=15

ecs.tf (terraform)
==================
Tests: 2 (SUCCESSES: 1, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 0, CRITICAL: 1)

CRITICAL: Security group rule allows egress to multiple public internet addresses.
════════════════════════════════════════
Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.

See https://avd.aquasec.com/misconfig/avd-aws-0104
────────────────────────────────────────
 ecs.tf:70
   via ecs.tf:64-72 (aws_security_group_rule.allow_all_egress)
────────────────────────────────────────
  64   resource "aws_security_group_rule" "allow_all_egress" {
  65     description       = "Allow all outbound traffic to any IPv4 address"
  66     type              = "egress"
  67     from_port         = 0
  68     to_port           = 0
  69     protocol          = "-1"
  70 [   cidr_blocks       = ["0.0.0.0/0"]
  71     security_group_id = aws_security_group.jitbit.id
  72   }
────────────────────────────────────────



github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.2.1/main.tf (terraform)
==========================================================================================================
Tests: 7 (SUCCESSES: 5, FAILURES: 0, EXCEPTIONS: 2)
Failures: 0 (HIGH: 0, CRITICAL: 0)


github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0/main.tf (terraform)
======================================================================================================
Tests: 14 (SUCCESSES: 12, FAILURES: 2, EXCEPTIONS: 0)
Failures: 2 (HIGH: 2, CRITICAL: 0)

HIGH: Bucket does not encrypt data with a customer managed key.
════════════════════════════════════════
Encryption using AWS keys provides protection for your S3 buckets. To increase control of the encryption and manage factors like rotation use customer managed keys.

See https://avd.aquasec.com/misconfig/avd-aws-0132
────────────────────────────────────────
 github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0/main.tf:157-165
   via s3.tf:1-84 (module.jitbit_bucket)
────────────────────────────────────────
 157 ┌ resource "aws_s3_bucket_server_side_encryption_configuration" "default" {
 158 │   bucket = aws_s3_bucket.default.id
 159 │   rule {
 160 │     apply_server_side_encryption_by_default {
 161 │       sse_algorithm     = var.sse_algorithm
 162 │       kms_master_key_id = (var.custom_kms_key != "") ? var.custom_kms_key : ""
 163 │     }
 164 │   }
 165 └ }
────────────────────────────────────────


HIGH: Bucket does not encrypt data with a customer managed key.
════════════════════════════════════════
Encryption using AWS keys provides protection for your S3 buckets. To increase control of the encryption and manage factors like rotation use customer managed keys.

See https://avd.aquasec.com/misconfig/avd-aws-0132
────────────────────────────────────────
 github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0/main.tf:157-165
   via ecs.tf:11-51 (module.s3_bucket_app_deployment)
────────────────────────────────────────
 157 ┌ resource "aws_s3_bucket_server_side_encryption_configuration" "default" {
 158 │   bucket = aws_s3_bucket.default.id
 159 │   rule {
 160 │     apply_server_side_encryption_by_default {
 161 │       sse_algorithm     = var.sse_algorithm
 162 │       kms_master_key_id = (var.custom_kms_key != "") ? var.custom_kms_key : ""
 163 │     }
 164 │   }
 165 └ }
────────────────────────────────────────



iam.tf (terraform)
==================
Tests: 6 (SUCCESSES: 0, FAILURES: 0, EXCEPTIONS: 6)
Failures: 0 (HIGH: 0, CRITICAL: 0)


lb.tf (terraform)
=================
Tests: 7 (SUCCESSES: 4, FAILURES: 2, EXCEPTIONS: 1)
Failures: 2 (HIGH: 0, CRITICAL: 2)

CRITICAL: Security group rule allows ingress from public internet.
════════════════════════════════════════
Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.

See https://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
 lb.tf:62-70
   via lb.tf:35-71 (ingress)
    via lb.tf:30-87 (aws_security_group.load_balancer_security_group)
────────────────────────────────────────
  30   resource "aws_security_group" "load_balancer_security_group" {
  ..   
  62 ┌     ipv6_cidr_blocks = [
  63 │       # Route53 Healthcheck Access Cidrs IPv6
  64 │       "2406:da18:7ff:f800::/53",  # ap-southeast-1 Region
  65 │       "2406:da18:fff:f800::/53",  # ap-southeast-1 Region
  66 │       "2a05:d018:fff:f800::/53",  # eu-west-1 Region
  67 │       "2a05:d018:7ff:f800::/53",  # eu-west-1 Region
  68 └       "2600:1f18:7fff:f800::/53", # us-east-1 Region
  ..   
────────────────────────────────────────


CRITICAL: Security group rule allows ingress from public internet.
════════════════════════════════════════
Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.

See https://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
 lb.tf:40-60
   via lb.tf:35-71 (ingress)
    via lb.tf:30-87 (aws_security_group.load_balancer_security_group)
────────────────────────────────────────
  30   resource "aws_security_group" "load_balancer_security_group" {
  ..   
  40 ┌     cidr_blocks = distinct(flatten([
  41 │       "20.49.214.199/32", # Azure Landing Zone Egress
  42 │       "20.49.214.228/32", # Azure Landing Zone Egress
  43 │       "20.26.11.71/32",   # Azure Landing Zone Egress
  44 │       "20.26.11.108/32",  # Azure Landing Zone Egress
  45 │       # Route53 Healthcheck Access Cidrs
  46 └       # London Region not support yet, so metrics are not yet publised, can be enabled at later stage for Route53 endpoint monitor
  ..   
────────────────────────────────────────



monitoring.tf (terraform)
=========================
Tests: 2 (SUCCESSES: 1, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Topic does not have encryption enabled.
════════════════════════════════════════
Topics should be encrypted to protect their contents.

See https://avd.aquasec.com/misconfig/avd-aws-0095
────────────────────────────────────────
 monitoring.tf:6-8
────────────────────────────────────────
   6 ┌ resource "aws_sns_topic" "jitbit_alerting" {
   7 │   name = "jitbit_alerting"
   8 └ }
────────────────────────────────────────



ses.tf (terraform)
==================
Tests: 2 (SUCCESSES: 0, FAILURES: 0, EXCEPTIONS: 2)
Failures: 0 (HIGH: 0, CRITICAL: 0)


ses_bounce.tf (terraform)
=========================
Tests: 6 (SUCCESSES: 2, FAILURES: 1, EXCEPTIONS: 3)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Topic does not have encryption enabled.
════════════════════════════════════════
Topics should be encrypted to protect their contents.

See https://avd.aquasec.com/misconfig/avd-aws-0095
────────────────────────────────────────
 ses_bounce.tf:1-5
────────────────────────────────────────
   1 ┌ resource "aws_sns_topic" "jitbit_ses_destination_topic_bounce_email_notification" {
   2 │   name = format("%s-ses-destination-topic-bounce-email-notification", local.application_name)
   3 │ 
   4 │   tags = local.tags
   5 └ }
────────────────────────────────────────



ses_logging.tf (terraform)
==========================
Tests: 5 (SUCCESSES: 2, FAILURES: 1, EXCEPTIONS: 2)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Topic does not have encryption enabled.
════════════════════════════════════════
Topics should be encrypted to protect their contents.

See https://avd.aquasec.com/misconfig/avd-aws-0095
────────────────────────────────────────
 ses_logging.tf:4-8
────────────────────────────────────────
   4 ┌ resource "aws_sns_topic" "jitbit_ses_destination_topic" {
   5 │   name = format("%s-ses-destination-topic", local.application_name)
   6 │ 
   7 │   tags = local.tags
   8 └ }
────────────────────────────────────────


trivy_exitcode=1

dependabot bot requested review from a team as code owners May 15, 2024 00:39

dependabot bot added the dependencies Pull requests that update a dependency file label May 15, 2024

dependabot bot requested a review from a team as a code owner May 15, 2024 00:39

dependabot bot added the terraform Pull requests that update Terraform code label May 15, 2024

dependabot bot mentioned this pull request May 15, 2024

Bump ecs_sandbox::modernisation-platform-terraform-ecs-cluster from 2.0.1 to 4.2.1 in /terraform/environments/delius-jitbit #5994

Closed

github-actions bot added the environments-repository Used to exclude PRs from this repo in our Slack PR update label May 15, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump ecs_sandbox::modernisation-platform-terraform-ecs-cluster from 2.0.1 to 4.3.0 in /terraform/environments/delius-jitbit #6086

Bump ecs_sandbox::modernisation-platform-terraform-ecs-cluster from 2.0.1 to 4.3.0 in /terraform/environments/delius-jitbit #6086

dependabot bot commented on behalf of github May 15, 2024

github-actions bot commented May 15, 2024

ecs.tf (terraform)

github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.2.1/main.tf (terraform)

github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0/main.tf (terraform)

iam.tf (terraform)

lb.tf (terraform)

monitoring.tf (terraform)

ses.tf (terraform)

ses_bounce.tf (terraform)

ses_logging.tf (terraform)

Bump ecs_sandbox::modernisation-platform-terraform-ecs-cluster from 2.0.1 to 4.3.0 in /terraform/environments/delius-jitbit #6086

Are you sure you want to change the base?

Bump ecs_sandbox::modernisation-platform-terraform-ecs-cluster from 2.0.1 to 4.3.0 in /terraform/environments/delius-jitbit #6086

Conversation

dependabot bot commented on behalf of github May 15, 2024

v4.3.0

What's Changed

New Contributors

v4.2.1

What's Changed

New Contributors

v4.2.0

What's New

What's Changed

v4.1.1

What's Changed

4.1.0

What's Changed

github-actions bot commented May 15, 2024

Trivy Scan Failed

ecs.tf (terraform)

github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.2.1/main.tf (terraform)

github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0/main.tf (terraform)

iam.tf (terraform)

lb.tf (terraform)

monitoring.tf (terraform)

ses.tf (terraform)

ses_bounce.tf (terraform)

ses_logging.tf (terraform)

CTFLint Scan Failed

Trivy Scan Failed

`Trivy Scan` Failed

`CTFLint Scan` Failed

`Trivy Scan` Failed