Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

tfsec ignores #143

Closed
wants to merge 4 commits into from
Closed

tfsec ignores #143

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
4810901
Update main.tf
leigh507 Jun 24, 2021
ad02286
Update main.tf
leigh507 Jun 24, 2021
62735e3
Merge branch 'master' of https://github.com/cloudposse/terraform-aws-…
andycognitoiq Jun 20, 2022
beb5cef
Merge branch 'cloudposse-master' into serverlessV2
andycognitoiq Jun 20, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,7 @@ resource "aws_security_group_rule" "egress" {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
cidr_blocks = ["0.0.0.0/0"] #tfsec:ignore:AWS007
security_group_id = join("", aws_security_group.default.*.id)
}

Expand All @@ -62,7 +62,7 @@ resource "aws_rds_cluster" "primary" {
cluster_identifier = var.cluster_identifier == "" ? module.this.id : var.cluster_identifier
database_name = var.db_name
master_username = local.ignore_admin_credentials ? null : var.admin_user
master_password = local.ignore_admin_credentials ? null : var.admin_password
master_password = local.ignore_admin_credentials ? null : var.admin_password #tfsec:ignore:GEN003
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LOW   Ensure RDS clusters have an AWS Backup backup plan
    Resource: aws_rds_cluster.primary | ID: BC_AWS_GENERAL_49

How to Fix

resource "aws_rds_cluster" "rds_cluster_good" {
  cluster_identifier      = "aurora-cluster-demo"
  engine                  = "aurora-mysql"
  engine_version          = "5.7.mysql_aurora.2.03.2"
  availability_zones      = ["us-west-2a", "us-west-2b", "us-west-2c"]
  database_name           = "mydb"
  master_username         = "foo"
  master_password         = "bar"
}


resource "aws_backup_plan" "example" {
  name = "tf_example_backup_plan"

  rule {
    rule_name         = "tf_example_backup_rule"
    target_vault_name = "vault-name"
    schedule          = "cron(0 12 * * ? *)"
  }
}

resource "aws_backup_selection" "backup_good" {
  iam_role_arn = "arn:partition:service:region:account-id:resource-id"
  name         = "tf_example_backup_selection"
  plan_id      = aws_backup_plan.example.id

  resources = [
    aws_rds_cluster.rds_cluster_good.arn
  ]
}

Description

TBA

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

MEDIUM   Ensure RDS cluster has IAM authentication enabled
    Resource: module.rds_cluster_aurora_postgres.aws_rds_cluster.primary | ID: BC_AWS_IAM_66

How to Fix

resource "aws_rds_cluster" "enabled" {
	...
+ iam_database_authentication_enabled = true
}

Description

TBD

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LOW   Ensure Amazon RDS clusters and instances have AWS IAM authentication enabled
    Resource: module.rds_cluster_aurora_mysql_serverless.aws_rds_cluster.primary | ID: BC_AWS_IAM_59

How to Fix

resource "aws_rds_cluster" "default" {
  cluster_identifier      = "aurora-cluster-demo"
	...
+  iam_database_authentication_enabled = true
}

Description

TBA. Identity and Access Management (IAM)

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

MEDIUM   Ensure RDS cluster has IAM authentication enabled
    Resource: module.rds_cluster_aurora_mysql.aws_rds_cluster.primary | ID: BC_AWS_IAM_66

How to Fix

resource "aws_rds_cluster" "enabled" {
	...
+ iam_database_authentication_enabled = true
}

Description

TBD

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

MEDIUM   Ensure RDS cluster has IAM authentication enabled
    Resource: module.rds_cluster_aurora_serverlessv2_postgres_13.aws_rds_cluster.primary | ID: BC_AWS_IAM_66

How to Fix

resource "aws_rds_cluster" "enabled" {
	...
+ iam_database_authentication_enabled = true
}

Description

TBD

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LOW   Ensure RDS clusters and instances have deletion protection enabled
    Resource: module.rds_cluster_aurora_postgres.aws_rds_cluster.primary | ID: BC_AWS_GENERAL_69

How to Fix

resource "aws_rds_cluster" "default" {
  ...
+ deletion_protection = true
}

Description

TBA

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LOW   Ensure Amazon RDS clusters and instances have AWS IAM authentication enabled
    Resource: module.rds_cluster.aws_rds_cluster.primary | ID: BC_AWS_IAM_59

How to Fix

resource "aws_rds_cluster" "default" {
  cluster_identifier      = "aurora-cluster-demo"
	...
+  iam_database_authentication_enabled = true
}

Description

TBA. Identity and Access Management (IAM)

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

HIGH   Ensure all data stored in Aurora is securely encrypted at rest
    Resource: module.rds_cluster_aurora_serverlessv2_postgres_13.aws_rds_cluster.primary | ID: BC_AWS_GENERAL_38

How to Fix

resource "aws_rds_cluster" "example" {
  ...
  cluster_identifier      = "aurora-cluster-demo"
+ storage_encrypted       = true
  ...
}

Description

This policy examines the resource **aws_rds_cluster** to check that encryption is set up. The property **storage_encrypted** is examined.

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

MEDIUM   Ensure RDS cluster has IAM authentication enabled
    Resource: module.rds_cluster.aws_rds_cluster.primary | ID: BC_AWS_IAM_66

How to Fix

resource "aws_rds_cluster" "enabled" {
	...
+ iam_database_authentication_enabled = true
}

Description

TBD

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LOW   Ensure Amazon RDS clusters and instances have AWS IAM authentication enabled
    Resource: module.rds_cluster_aurora_postgres.aws_rds_cluster.primary | ID: BC_AWS_IAM_59

How to Fix

resource "aws_rds_cluster" "default" {
  cluster_identifier      = "aurora-cluster-demo"
	...
+  iam_database_authentication_enabled = true
}

Description

TBA. Identity and Access Management (IAM)

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

MEDIUM   Ensure RDS cluster has IAM authentication enabled
    Resource: module.rds_cluster_aurora_mysql_serverless.aws_rds_cluster.primary | ID: BC_AWS_IAM_66

How to Fix

resource "aws_rds_cluster" "enabled" {
	...
+ iam_database_authentication_enabled = true
}

Description

TBD

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LOW   Ensure Amazon RDS clusters and instances have AWS IAM authentication enabled
    Resource: module.rds_cluster_aurora_mysql.aws_rds_cluster.primary | ID: BC_AWS_IAM_59

How to Fix

resource "aws_rds_cluster" "default" {
  cluster_identifier      = "aurora-cluster-demo"
	...
+  iam_database_authentication_enabled = true
}

Description

TBA. Identity and Access Management (IAM)

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

HIGH   Ensure all data stored in Aurora is securely encrypted at rest
    Resource: module.rds_cluster.aws_rds_cluster.primary | ID: BC_AWS_GENERAL_38

How to Fix

resource "aws_rds_cluster" "example" {
  ...
  cluster_identifier      = "aurora-cluster-demo"
+ storage_encrypted       = true
  ...
}

Description

This policy examines the resource **aws_rds_cluster** to check that encryption is set up. The property **storage_encrypted** is examined.

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LOW   Ensure Amazon RDS clusters and instances have AWS IAM authentication enabled
    Resource: module.rds_cluster_aurora_serverlessv2_postgres_13.aws_rds_cluster.primary | ID: BC_AWS_IAM_59

How to Fix

resource "aws_rds_cluster" "default" {
  cluster_identifier      = "aurora-cluster-demo"
	...
+  iam_database_authentication_enabled = true
}

Description

TBA. Identity and Access Management (IAM)

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

HIGH   Ensure all data stored in Aurora is securely encrypted at rest
    Resource: module.rds_cluster_aurora_mysql.aws_rds_cluster.primary | ID: BC_AWS_GENERAL_38

How to Fix

resource "aws_rds_cluster" "example" {
  ...
  cluster_identifier      = "aurora-cluster-demo"
+ storage_encrypted       = true
  ...
}

Description

This policy examines the resource **aws_rds_cluster** to check that encryption is set up. The property **storage_encrypted** is examined.

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LOW   Ensure RDS clusters and instances have deletion protection enabled
    Resource: module.rds_cluster_aurora_mysql.aws_rds_cluster.primary | ID: BC_AWS_GENERAL_69

How to Fix

resource "aws_rds_cluster" "default" {
  ...
+ deletion_protection = true
}

Description

TBA

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LOW   Ensure RDS clusters and instances have deletion protection enabled
    Resource: module.rds_cluster_aurora_mysql_serverless.aws_rds_cluster.primary | ID: BC_AWS_GENERAL_69

How to Fix

resource "aws_rds_cluster" "default" {
  ...
+ deletion_protection = true
}

Description

TBA

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

HIGH   Ensure all data stored in Aurora is securely encrypted at rest
    Resource: module.rds_cluster_aurora_postgres.aws_rds_cluster.primary | ID: BC_AWS_GENERAL_38

How to Fix

resource "aws_rds_cluster" "example" {
  ...
  cluster_identifier      = "aurora-cluster-demo"
+ storage_encrypted       = true
  ...
}

Description

This policy examines the resource **aws_rds_cluster** to check that encryption is set up. The property **storage_encrypted** is examined.

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

MEDIUM   Ensure Postgres RDS has Query Logging enabled
    Resource: aws_rds_cluster.primary | ID: BC_AWS_GENERAL_96

How to Fix

resource "aws_rds_cluster_parameter_group" "examplea" {
  name = "rds-cluster-pg"
  family      = "aurora5.7"
  description = "RDS default cluster parameter group"

+  parameter {
+    name="log_statement"
+    value="all"
+  }

+  parameter {
+    name="log_min_duration_statement"
+    value="1"
+  }
}

Description

This check ensures that you have enabled query logging set up for your PostgreSQL database cluster. A cluster needs to have a non-default parameter group and two parameters set - that of *log_statement* and *log_min_duration_statement*, these need to be set to *all* and *1* respectively to get sufficient logs.

Note
Setting querying logging can expose secrets (including passwords) from your queries, - restrict and encrypt to mitigate.

backup_retention_period = var.retention_period
preferred_backup_window = var.backup_window
copy_tags_to_snapshot = var.copy_tags_to_snapshot
Expand All @@ -73,7 +73,7 @@ resource "aws_rds_cluster" "primary" {
storage_type = var.storage_type
iops = var.iops
allocated_storage = var.allocated_storage
kms_key_id = var.kms_key_arn
kms_key_id = var.kms_key_arn #tfsec:ignore:AWS051
source_region = var.source_region
snapshot_identifier = var.snapshot_identifier
vpc_security_group_ids = compact(flatten([join("", aws_security_group.default.*.id), var.vpc_security_group_ids]))
Expand Down Expand Up @@ -155,15 +155,15 @@ resource "aws_rds_cluster" "secondary" {
cluster_identifier = var.cluster_identifier == "" ? module.this.id : var.cluster_identifier
database_name = var.db_name
master_username = local.ignore_admin_credentials ? null : var.admin_user
master_password = local.ignore_admin_credentials ? null : var.admin_password
master_password = local.ignore_admin_credentials ? null : var.admin_password #tfsec:ignore:GEN003
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LOW   Ensure RDS clusters have an AWS Backup backup plan
    Resource: aws_rds_cluster.secondary | ID: BC_AWS_GENERAL_49

How to Fix

resource "aws_rds_cluster" "rds_cluster_good" {
  cluster_identifier      = "aurora-cluster-demo"
  engine                  = "aurora-mysql"
  engine_version          = "5.7.mysql_aurora.2.03.2"
  availability_zones      = ["us-west-2a", "us-west-2b", "us-west-2c"]
  database_name           = "mydb"
  master_username         = "foo"
  master_password         = "bar"
}


resource "aws_backup_plan" "example" {
  name = "tf_example_backup_plan"

  rule {
    rule_name         = "tf_example_backup_rule"
    target_vault_name = "vault-name"
    schedule          = "cron(0 12 * * ? *)"
  }
}

resource "aws_backup_selection" "backup_good" {
  iam_role_arn = "arn:partition:service:region:account-id:resource-id"
  name         = "tf_example_backup_selection"
  plan_id      = aws_backup_plan.example.id

  resources = [
    aws_rds_cluster.rds_cluster_good.arn
  ]
}

Description

TBA

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

HIGH   Ensure all data stored in Aurora is securely encrypted at rest
    Resource: module.rds_cluster.aws_rds_cluster.secondary | ID: BC_AWS_GENERAL_38

How to Fix

resource "aws_rds_cluster" "example" {
  ...
  cluster_identifier      = "aurora-cluster-demo"
+ storage_encrypted       = true
  ...
}

Description

This policy examines the resource **aws_rds_cluster** to check that encryption is set up. The property **storage_encrypted** is examined.

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

MEDIUM   Ensure Postgres RDS has Query Logging enabled
    Resource: aws_rds_cluster.secondary | ID: BC_AWS_GENERAL_96

How to Fix

resource "aws_rds_cluster_parameter_group" "examplea" {
  name = "rds-cluster-pg"
  family      = "aurora5.7"
  description = "RDS default cluster parameter group"

+  parameter {
+    name="log_statement"
+    value="all"
+  }

+  parameter {
+    name="log_min_duration_statement"
+    value="1"
+  }
}

Description

This check ensures that you have enabled query logging set up for your PostgreSQL database cluster. A cluster needs to have a non-default parameter group and two parameters set - that of *log_statement* and *log_min_duration_statement*, these need to be set to *all* and *1* respectively to get sufficient logs.

Note
Setting querying logging can expose secrets (including passwords) from your queries, - restrict and encrypt to mitigate.

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

HIGH   Ensure all data stored in Aurora is securely encrypted at rest
    Resource: module.rds_cluster_aurora_mysql.aws_rds_cluster.secondary | ID: BC_AWS_GENERAL_38

How to Fix

resource "aws_rds_cluster" "example" {
  ...
  cluster_identifier      = "aurora-cluster-demo"
+ storage_encrypted       = true
  ...
}

Description

This policy examines the resource **aws_rds_cluster** to check that encryption is set up. The property **storage_encrypted** is examined.

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

MEDIUM   Ensure RDS cluster has IAM authentication enabled
    Resource: module.rds_cluster_aurora_mysql_serverless.aws_rds_cluster.secondary | ID: BC_AWS_IAM_66

How to Fix

resource "aws_rds_cluster" "enabled" {
	...
+ iam_database_authentication_enabled = true
}

Description

TBD

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

MEDIUM   Ensure RDS cluster has IAM authentication enabled
    Resource: module.rds_cluster_aurora_mysql.aws_rds_cluster.secondary | ID: BC_AWS_IAM_66

How to Fix

resource "aws_rds_cluster" "enabled" {
	...
+ iam_database_authentication_enabled = true
}

Description

TBD

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LOW   Ensure Amazon RDS clusters and instances have AWS IAM authentication enabled
    Resource: module.rds_cluster.aws_rds_cluster.secondary | ID: BC_AWS_IAM_59

How to Fix

resource "aws_rds_cluster" "default" {
  cluster_identifier      = "aurora-cluster-demo"
	...
+  iam_database_authentication_enabled = true
}

Description

TBA. Identity and Access Management (IAM)

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

MEDIUM   Ensure RDS cluster has IAM authentication enabled
    Resource: module.rds_cluster.aws_rds_cluster.secondary | ID: BC_AWS_IAM_66

How to Fix

resource "aws_rds_cluster" "enabled" {
	...
+ iam_database_authentication_enabled = true
}

Description

TBD

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LOW   Ensure RDS clusters and instances have deletion protection enabled
    Resource: module.rds_cluster_aurora_mysql_serverless.aws_rds_cluster.secondary | ID: BC_AWS_GENERAL_69

How to Fix

resource "aws_rds_cluster" "default" {
  ...
+ deletion_protection = true
}

Description

TBA

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

HIGH   Ensure all data stored in Aurora is securely encrypted at rest
    Resource: module.rds_cluster_aurora_postgres.aws_rds_cluster.secondary | ID: BC_AWS_GENERAL_38

How to Fix

resource "aws_rds_cluster" "example" {
  ...
  cluster_identifier      = "aurora-cluster-demo"
+ storage_encrypted       = true
  ...
}

Description

This policy examines the resource **aws_rds_cluster** to check that encryption is set up. The property **storage_encrypted** is examined.

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LOW   Ensure Amazon RDS clusters and instances have AWS IAM authentication enabled
    Resource: module.rds_cluster_aurora_mysql.aws_rds_cluster.secondary | ID: BC_AWS_IAM_59

How to Fix

resource "aws_rds_cluster" "default" {
  cluster_identifier      = "aurora-cluster-demo"
	...
+  iam_database_authentication_enabled = true
}

Description

TBA. Identity and Access Management (IAM)

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LOW   Ensure RDS clusters and instances have deletion protection enabled
    Resource: module.rds_cluster_aurora_postgres.aws_rds_cluster.secondary | ID: BC_AWS_GENERAL_69

How to Fix

resource "aws_rds_cluster" "default" {
  ...
+ deletion_protection = true
}

Description

TBA

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

MEDIUM   Ensure RDS cluster has IAM authentication enabled
    Resource: module.rds_cluster_aurora_postgres.aws_rds_cluster.secondary | ID: BC_AWS_IAM_66

How to Fix

resource "aws_rds_cluster" "enabled" {
	...
+ iam_database_authentication_enabled = true
}

Description

TBD

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

MEDIUM   Ensure RDS cluster has IAM authentication enabled
    Resource: module.rds_cluster_aurora_serverlessv2_postgres_13.aws_rds_cluster.secondary | ID: BC_AWS_IAM_66

How to Fix

resource "aws_rds_cluster" "enabled" {
	...
+ iam_database_authentication_enabled = true
}

Description

TBD

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LOW   Ensure Amazon RDS clusters and instances have AWS IAM authentication enabled
    Resource: module.rds_cluster_aurora_mysql_serverless.aws_rds_cluster.secondary | ID: BC_AWS_IAM_59

How to Fix

resource "aws_rds_cluster" "default" {
  cluster_identifier      = "aurora-cluster-demo"
	...
+  iam_database_authentication_enabled = true
}

Description

TBA. Identity and Access Management (IAM)

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LOW   Ensure RDS clusters and instances have deletion protection enabled
    Resource: module.rds_cluster_aurora_mysql.aws_rds_cluster.secondary | ID: BC_AWS_GENERAL_69

How to Fix

resource "aws_rds_cluster" "default" {
  ...
+ deletion_protection = true
}

Description

TBA

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LOW   Ensure Amazon RDS clusters and instances have AWS IAM authentication enabled
    Resource: module.rds_cluster_aurora_postgres.aws_rds_cluster.secondary | ID: BC_AWS_IAM_59

How to Fix

resource "aws_rds_cluster" "default" {
  cluster_identifier      = "aurora-cluster-demo"
	...
+  iam_database_authentication_enabled = true
}

Description

TBA. Identity and Access Management (IAM)

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

HIGH   Ensure all data stored in Aurora is securely encrypted at rest
    Resource: module.rds_cluster_aurora_serverlessv2_postgres_13.aws_rds_cluster.secondary | ID: BC_AWS_GENERAL_38

How to Fix

resource "aws_rds_cluster" "example" {
  ...
  cluster_identifier      = "aurora-cluster-demo"
+ storage_encrypted       = true
  ...
}

Description

This policy examines the resource **aws_rds_cluster** to check that encryption is set up. The property **storage_encrypted** is examined.

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LOW   Ensure Amazon RDS clusters and instances have AWS IAM authentication enabled
    Resource: module.rds_cluster_aurora_serverlessv2_postgres_13.aws_rds_cluster.secondary | ID: BC_AWS_IAM_59

How to Fix

resource "aws_rds_cluster" "default" {
  cluster_identifier      = "aurora-cluster-demo"
	...
+  iam_database_authentication_enabled = true
}

Description

TBA. Identity and Access Management (IAM)

backup_retention_period = var.retention_period
preferred_backup_window = var.backup_window
copy_tags_to_snapshot = var.copy_tags_to_snapshot
final_snapshot_identifier = var.cluster_identifier == "" ? lower(module.this.id) : lower(var.cluster_identifier)
skip_final_snapshot = var.skip_final_snapshot
apply_immediately = var.apply_immediately
storage_encrypted = var.storage_encrypted
kms_key_id = var.kms_key_arn
kms_key_id = var.kms_key_arn #tfsec:ignore:AWS051
source_region = var.source_region
snapshot_identifier = var.snapshot_identifier
vpc_security_group_ids = compact(flatten([join("", aws_security_group.default.*.id), var.vpc_security_group_ids]))
Expand Down