You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
TFSEC will check the following folders:
terraform/environments/electronic-monitoring-data terraform/environments/electronic-monitoring-data/modules/landing_zone/landing_zone_user terraform/environments/electronic-monitoring-data/modules/landing_zone terraform/environments/electronic-monitoring-data/modules/landing_zone/server_security_group terraform/environments/electronic-monitoring-data/modules/landing_zone
Running TFSEC in terraform/environments/electronic-monitoring-data
Excluding the following checks: AWS095
======================================================
tfsec is joining the Trivy family
tfsec will continue to remain available
for the time being, although our engineering
attention will be directed at Trivy going forward.
Results #1-6 HIGH IAM policy document uses sensitive action 's3:PutObject' on wildcarded resource 'ae06699d-157b-47ee-b5c2-5265efc8e972/' (6 similar results)
────────────────────────────────────────────────────────────────────────────────
modules/landing_zone/landing_zone_user/main.tf:57
via modules/landing_zone/main.tf:349-359 (module.landing_zone_users["0"])
via main.tf:1-17 (module.capita)
────────────────────────────────────────────────────────────────────────────────
46 data "aws_iam_policy_document" "this_transfer_user" {
..
57 [ resources = ["${var.landing_bucket.arn}/"]
..
59 }
────────────────────────────────────────────────────────────────────────────────
Individual Causes
modules/landing_zone/landing_zone_user/main.tf:1-17 (module.capita) 6 instances
────────────────────────────────────────────────────────────────────────────────
ID aws-iam-no-policy-wildcards
Impact Overly permissive policies may grant access to sensitive resources
Resolution Specify the exact permissions required, and to which resources they should apply instead of using wildcards.
Results #7-9 HIGH IAM policy document uses sensitive action 's3:GetObject' on wildcarded resource 'ae06699d-157b-47ee-b5c2-5265efc8e972/' (3 similar results)
────────────────────────────────────────────────────────────────────────────────
modules/landing_zone/main.tf:291
via main.tf:1-17 (module.capita)
────────────────────────────────────────────────────────────────────────────────
283 data "aws_iam_policy_document" "this_transfer_workflow" {
...
291 [ resources = ["${aws_s3_bucket.landing_bucket.arn}/"]
...
335 }
────────────────────────────────────────────────────────────────────────────────
Individual Causes
modules/landing_zone/main.tf:1-17 (module.capita) 3 instances
────────────────────────────────────────────────────────────────────────────────
ID aws-iam-no-policy-wildcards
Impact Overly permissive policies may grant access to sensitive resources
Resolution Specify the exact permissions required, and to which resources they should apply instead of using wildcards.
Results #10-12 HIGH IAM policy document uses sensitive action 's3:PutObject' on wildcarded resource '3ea70b0c-6323-4b21-bdff-317b42ba8911/' (3 similar results)
────────────────────────────────────────────────────────────────────────────────
modules/landing_zone/main.tf:300
via main.tf:1-17 (module.capita)
────────────────────────────────────────────────────────────────────────────────
283 data "aws_iam_policy_document" "this_transfer_workflow" {
...
300 [ resources = ["${var.data_store_bucket.arn}/"]
...
335 }
────────────────────────────────────────────────────────────────────────────────
Individual Causes
modules/landing_zone/main.tf:1-17 (module.capita) 3 instances
────────────────────────────────────────────────────────────────────────────────
ID aws-iam-no-policy-wildcards
Impact Overly permissive policies may grant access to sensitive resources
Resolution Specify the exact permissions required, and to which resources they should apply instead of using wildcards.
Results #13-18 HIGH IAM policy document uses sensitive action 's3:PutObjectTagging' on wildcarded resource '3ea70b0c-6323-4b21-bdff-317b42ba8911/' (6 similar results)
────────────────────────────────────────────────────────────────────────────────
modules/landing_zone/main.tf:320-323
via main.tf:1-17 (module.capita)
────────────────────────────────────────────────────────────────────────────────
283 data "aws_iam_policy_document" "this_transfer_workflow" {
...
320 ┌ resources = [
321 │ "${var.data_store_bucket.arn}/",
322 │ "${aws_s3_bucket.landing_bucket.arn}/*",
323 └ ]
...
335 }
────────────────────────────────────────────────────────────────────────────────
Individual Causes
modules/landing_zone/main.tf:1-17 (module.capita) 6 instances
────────────────────────────────────────────────────────────────────────────────
ID aws-iam-no-policy-wildcards
Impact Overly permissive policies may grant access to sensitive resources
Resolution Specify the exact permissions required, and to which resources they should apply instead of using wildcards.
Results #19-21 HIGH IAM policy document uses sensitive action 's3:DeleteObject' on wildcarded resource 'ae06699d-157b-47ee-b5c2-5265efc8e972/' (3 similar results)
────────────────────────────────────────────────────────────────────────────────
modules/landing_zone/main.tf:333
via main.tf:1-17 (module.capita)
────────────────────────────────────────────────────────────────────────────────
283 data "aws_iam_policy_document" "this_transfer_workflow" {
...
333 [ resources = ["${aws_s3_bucket.landing_bucket.arn}/"]
...
335 }
────────────────────────────────────────────────────────────────────────────────
Individual Causes
modules/landing_zone/main.tf:1-17 (module.capita) 3 instances
────────────────────────────────────────────────────────────────────────────────
ID aws-iam-no-policy-wildcards
Impact Overly permissive policies may grant access to sensitive resources
Resolution Specify the exact permissions required, and to which resources they should apply instead of using wildcards.
modules/landing_zone/main.tf:1-17 (module.capita)
────────────────────────────────────────────────────────────────────────────────
ID aws-s3-encryption-customer-key
Impact Using AWS managed keys does not allow for fine grained control
Resolution Enable encryption using customer managed keys
modules/s3_log_bucket/main.tf:1-17 (module.capita) 3 instances
────────────────────────────────────────────────────────────────────────────────
ID aws-s3-encryption-customer-key
Impact Using AWS managed keys does not allow for fine grained control
Resolution Enable encryption using customer managed keys
Result #29 HIGH Bucket does not encrypt data with a customer managed key.
────────────────────────────────────────────────────────────────────────────────
s3.tf:20-28
────────────────────────────────────────────────────────────────────────────────
20 resource "aws_s3_bucket_server_side_encryption_configuration" "data_store" {
21 bucket = aws_s3_bucket.data_store.id
22
23 rule {
24 apply_server_side_encryption_by_default {
25 sse_algorithm = "AES256"
26 }
27 }
28 }
────────────────────────────────────────────────────────────────────────────────
ID aws-s3-encryption-customer-key
Impact Using AWS managed keys does not allow for fine grained control
Resolution Enable encryption using customer managed keys
Results #30-32 MEDIUM Key does not have rotation enabled. (3 similar results)
────────────────────────────────────────────────────────────────────────────────
modules/landing_zone/main.tf:119-127
via main.tf:1-17 (module.capita)
────────────────────────────────────────────────────────────────────────────────
119 resource "aws_kms_key" "this" {
120 description = "${var.supplier} server cloudwatch log encryption key"
121 key_usage = "ENCRYPT_DECRYPT"
122 deletion_window_in_days = 30
123
124 tags = {
125 supplier = var.supplier
126 }
127 }
────────────────────────────────────────────────────────────────────────────────
Individual Causes
modules/landing_zone/main.tf:1-17 (module.capita)
modules/landing_zone/main.tf:37-53 (module.g4s)
modules/landing_zone/main.tf:19-35 (module.civica)
────────────────────────────────────────────────────────────────────────────────
ID aws-kms-auto-rotate-keys
Impact Long life KMS keys increase the attack surface when compromised
Resolution Configure KMS key to auto rotate
modules/landing_zone/main.tf:1-17 (module.capita)
────────────────────────────────────────────────────────────────────────────────
ID aws-s3-enable-versioning
Impact Deleted or modified data would not be recoverable
Resolution Enable versioning to protect against accidental/malicious removal or modification
modules/s3_log_bucket/main.tf:19-35 (module.civica)
────────────────────────────────────────────────────────────────────────────────
ID aws-s3-enable-bucket-logging
Impact There is no way to determine the access to this bucket
Resolution Add a logging block to the resource to enable access logging
modules/s3_log_bucket/main.tf:5-10 (module.data_store_log_bucket)
────────────────────────────────────────────────────────────────────────────────
ID aws-s3-enable-versioning
Impact Deleted or modified data would not be recoverable
Resolution Enable versioning to protect against accidental/malicious removal or modification
Result #1 HIGH IAM policy document uses sensitive action 's3:GetObject' on wildcarded resource 'd0d9cd51-25d0-4283-a1a3-68a861a53701/'
────────────────────────────────────────────────────────────────────────────────
main.tf:291
────────────────────────────────────────────────────────────────────────────────
283 data "aws_iam_policy_document" "this_transfer_workflow" {
...
291 [ resources = ["${aws_s3_bucket.landing_bucket.arn}/"]
...
335 }
────────────────────────────────────────────────────────────────────────────────
ID aws-iam-no-policy-wildcards
Impact Overly permissive policies may grant access to sensitive resources
Resolution Specify the exact permissions required, and to which resources they should apply instead of using wildcards.
Result #2 HIGH IAM policy document uses sensitive action 's3:PutObjectTagging' on wildcarded resource ''
────────────────────────────────────────────────────────────────────────────────
main.tf:320-323
────────────────────────────────────────────────────────────────────────────────
283 data "aws_iam_policy_document" "this_transfer_workflow" {
...
320 ┌ resources = [
321 │ "${var.data_store_bucket.arn}/",
322 │ "${aws_s3_bucket.landing_bucket.arn}/",
323 └ ]
...
335 }
────────────────────────────────────────────────────────────────────────────────
ID aws-iam-no-policy-wildcards
Impact Overly permissive policies may grant access to sensitive resources
Resolution Specify the exact permissions required, and to which resources they should apply instead of using wildcards.
Result #3 HIGH IAM policy document uses sensitive action 's3:DeleteObject' on wildcarded resource 'd0d9cd51-25d0-4283-a1a3-68a861a53701/'
────────────────────────────────────────────────────────────────────────────────
main.tf:333
────────────────────────────────────────────────────────────────────────────────
283 data "aws_iam_policy_document" "this_transfer_workflow" {
...
333 [ resources = ["${aws_s3_bucket.landing_bucket.arn}/"]
...
335 }
────────────────────────────────────────────────────────────────────────────────
ID aws-iam-no-policy-wildcards
Impact Overly permissive policies may grant access to sensitive resources
Resolution Specify the exact permissions required, and to which resources they should apply instead of using wildcards.
Result #4 HIGH Bucket does not encrypt data with a customer managed key.
────────────────────────────────────────────────────────────────────────────────
main.tf:37-45
────────────────────────────────────────────────────────────────────────────────
37 resource "aws_s3_bucket_server_side_encryption_configuration" "landing_bucket" {
38 bucket = aws_s3_bucket.landing_bucket.id
39
40 rule {
41 apply_server_side_encryption_by_default {
42 sse_algorithm = "AES256"
43 }
44 }
45 }
────────────────────────────────────────────────────────────────────────────────
ID aws-s3-encryption-customer-key
Impact Using AWS managed keys does not allow for fine grained control
Resolution Enable encryption using customer managed keys
Result #5 HIGH Bucket does not encrypt data with a customer managed key.
────────────────────────────────────────────────────────────────────────────────
../s3_log_bucket/main.tf:10-18
via main.tf:105-113 (module.log_bucket)
────────────────────────────────────────────────────────────────────────────────
10 resource "aws_s3_bucket_server_side_encryption_configuration" "this" {
11 bucket = aws_s3_bucket.this.id
12
13 rule {
14 apply_server_side_encryption_by_default {
15 sse_algorithm = "AES256"
16 }
17 }
18 }
────────────────────────────────────────────────────────────────────────────────
ID aws-s3-encryption-customer-key
Impact Using AWS managed keys does not allow for fine grained control
Resolution Enable encryption using customer managed keys
Result #7 MEDIUM Bucket does not have versioning enabled
────────────────────────────────────────────────────────────────────────────────
main.tf:84
────────────────────────────────────────────────────────────────────────────────
81 resource "aws_s3_bucket_versioning" "landing_bucket" {
82 bucket = aws_s3_bucket.landing_bucket.id
83 versioning_configuration {
84 [ status = "Disabled"
85 }
86 }
────────────────────────────────────────────────────────────────────────────────
ID aws-s3-enable-versioning
Impact Deleted or modified data would not be recoverable
Resolution Enable versioning to protect against accidental/malicious removal or modification
Result #8 MEDIUM Bucket does not have logging enabled
────────────────────────────────────────────────────────────────────────────────
../s3_log_bucket/main.tf:2-8
via main.tf:105-113 (module.log_bucket)
────────────────────────────────────────────────────────────────────────────────
2 resource "aws_s3_bucket" "this" {
3 bucket = "${var.source_bucket.id}-logs"
4
5 force_destroy = true
6
7 tags = var.tags
8 }
────────────────────────────────────────────────────────────────────────────────
ID aws-s3-enable-bucket-logging
Impact There is no way to determine the access to this bucket
Resolution Add a logging block to the resource to enable access logging
Result #9 MEDIUM Bucket does not have versioning enabled
────────────────────────────────────────────────────────────────────────────────
../s3_log_bucket/main.tf:2-8
via main.tf:105-113 (module.log_bucket)
────────────────────────────────────────────────────────────────────────────────
2 resource "aws_s3_bucket" "this" {
3 bucket = "${var.source_bucket.id}-logs"
4
5 force_destroy = true
6
7 tags = var.tags
8 }
────────────────────────────────────────────────────────────────────────────────
ID aws-s3-enable-versioning
Impact Deleted or modified data would not be recoverable
Resolution Enable versioning to protect against accidental/malicious removal or modification
Result #1 HIGH IAM policy document uses sensitive action 's3:GetObject' on wildcarded resource '627a0de2-78a3-42fd-9289-f3aa2a2a2167/'
────────────────────────────────────────────────────────────────────────────────
main.tf:291
────────────────────────────────────────────────────────────────────────────────
283 data "aws_iam_policy_document" "this_transfer_workflow" {
...
291 [ resources = ["${aws_s3_bucket.landing_bucket.arn}/"]
...
335 }
────────────────────────────────────────────────────────────────────────────────
ID aws-iam-no-policy-wildcards
Impact Overly permissive policies may grant access to sensitive resources
Resolution Specify the exact permissions required, and to which resources they should apply instead of using wildcards.
Result #2 HIGH IAM policy document uses sensitive action 's3:PutObjectTagging' on wildcarded resource ''
────────────────────────────────────────────────────────────────────────────────
main.tf:320-323
────────────────────────────────────────────────────────────────────────────────
283 data "aws_iam_policy_document" "this_transfer_workflow" {
...
320 ┌ resources = [
321 │ "${var.data_store_bucket.arn}/",
322 │ "${aws_s3_bucket.landing_bucket.arn}/",
323 └ ]
...
335 }
────────────────────────────────────────────────────────────────────────────────
ID aws-iam-no-policy-wildcards
Impact Overly permissive policies may grant access to sensitive resources
Resolution Specify the exact permissions required, and to which resources they should apply instead of using wildcards.
Result #3 HIGH IAM policy document uses sensitive action 's3:DeleteObject' on wildcarded resource '627a0de2-78a3-42fd-9289-f3aa2a2a2167/'
────────────────────────────────────────────────────────────────────────────────
main.tf:333
────────────────────────────────────────────────────────────────────────────────
283 data "aws_iam_policy_document" "this_transfer_workflow" {
...
333 [ resources = ["${aws_s3_bucket.landing_bucket.arn}/"]
...
335 }
────────────────────────────────────────────────────────────────────────────────
ID aws-iam-no-policy-wildcards
Impact Overly permissive policies may grant access to sensitive resources
Resolution Specify the exact permissions required, and to which resources they should apply instead of using wildcards.
Result #4 HIGH Bucket does not encrypt data with a customer managed key.
────────────────────────────────────────────────────────────────────────────────
main.tf:37-45
────────────────────────────────────────────────────────────────────────────────
37 resource "aws_s3_bucket_server_side_encryption_configuration" "landing_bucket" {
38 bucket = aws_s3_bucket.landing_bucket.id
39
40 rule {
41 apply_server_side_encryption_by_default {
42 sse_algorithm = "AES256"
43 }
44 }
45 }
────────────────────────────────────────────────────────────────────────────────
ID aws-s3-encryption-customer-key
Impact Using AWS managed keys does not allow for fine grained control
Resolution Enable encryption using customer managed keys
Result #5 HIGH Bucket does not encrypt data with a customer managed key.
────────────────────────────────────────────────────────────────────────────────
../s3_log_bucket/main.tf:10-18
via main.tf:105-113 (module.log_bucket)
────────────────────────────────────────────────────────────────────────────────
10 resource "aws_s3_bucket_server_side_encryption_configuration" "this" {
11 bucket = aws_s3_bucket.this.id
12
13 rule {
14 apply_server_side_encryption_by_default {
15 sse_algorithm = "AES256"
16 }
17 }
18 }
────────────────────────────────────────────────────────────────────────────────
ID aws-s3-encryption-customer-key
Impact Using AWS managed keys does not allow for fine grained control
Resolution Enable encryption using customer managed keys
Result #7 MEDIUM Bucket does not have versioning enabled
────────────────────────────────────────────────────────────────────────────────
main.tf:84
────────────────────────────────────────────────────────────────────────────────
81 resource "aws_s3_bucket_versioning" "landing_bucket" {
82 bucket = aws_s3_bucket.landing_bucket.id
83 versioning_configuration {
84 [ status = "Disabled"
85 }
86 }
────────────────────────────────────────────────────────────────────────────────
ID aws-s3-enable-versioning
Impact Deleted or modified data would not be recoverable
Resolution Enable versioning to protect against accidental/malicious removal or modification
Result #8 MEDIUM Bucket does not have logging enabled
────────────────────────────────────────────────────────────────────────────────
../s3_log_bucket/main.tf:2-8
via main.tf:105-113 (module.log_bucket)
────────────────────────────────────────────────────────────────────────────────
2 resource "aws_s3_bucket" "this" {
3 bucket = "${var.source_bucket.id}-logs"
4
5 force_destroy = true
6
7 tags = var.tags
8 }
────────────────────────────────────────────────────────────────────────────────
ID aws-s3-enable-bucket-logging
Impact There is no way to determine the access to this bucket
Resolution Add a logging block to the resource to enable access logging
Result #9 MEDIUM Bucket does not have versioning enabled
────────────────────────────────────────────────────────────────────────────────
../s3_log_bucket/main.tf:2-8
via main.tf:105-113 (module.log_bucket)
────────────────────────────────────────────────────────────────────────────────
2 resource "aws_s3_bucket" "this" {
3 bucket = "${var.source_bucket.id}-logs"
4
5 force_destroy = true
6
7 tags = var.tags
8 }
────────────────────────────────────────────────────────────────────────────────
ID aws-s3-enable-versioning
Impact Deleted or modified data would not be recoverable
Resolution Enable versioning to protect against accidental/malicious removal or modification
*****************************
Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version:0.5.0)
tflint will check the following folders:
terraform/environments/electronic-monitoring-data terraform/environments/electronic-monitoring-data/modules/landing_zone/landing_zone_user terraform/environments/electronic-monitoring-data/modules/landing_zone terraform/environments/electronic-monitoring-data/modules/landing_zone/server_security_group terraform/environments/electronic-monitoring-data/modules/landing_zone
*****************************
Running tflint in terraform/environments/electronic-monitoring-data
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=0*****************************
Running tflint in terraform/environments/electronic-monitoring-data/modules/landing_zone/landing_zone_user
Excluding the following checks: terraform_unused_declarations
4issue(s) found:
Warning: terraform "required_version" attribute is required (terraform_required_version)
on line 0:
(source code not available)
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_required_version.md
Warning: Missing version constraint for provider "aws" in `required_providers` (terraform_required_providers)
on terraform/environments/electronic-monitoring-data/modules/landing_zone/landing_zone_user/main.tf line 67:67:resource"aws_transfer_ssh_key""this" {
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_required_providers.md
Warning: `landing_bucket` variable has no type (terraform_typed_variables)
on terraform/environments/electronic-monitoring-data/modules/landing_zone/landing_zone_user/variables.tf line 1:1:variable"landing_bucket" {
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_typed_variables.md
Warning: `transfer_server` variable has no type (terraform_typed_variables)
on terraform/environments/electronic-monitoring-data/modules/landing_zone/landing_zone_user/variables.tf line 15:15:variable"transfer_server" {
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_typed_variables.mdtflint_exitcode=2*****************************
Running tflint in terraform/environments/electronic-monitoring-data/modules/landing_zone
Excluding the following checks: terraform_unused_declarations
6issue(s) found:
Warning: terraform "required_version" attribute is required (terraform_required_version)
on line 0:
(source code not available)
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_required_version.md
Warning: Missing version constraint for provider "random" in `required_providers` (terraform_required_providers)
on terraform/environments/electronic-monitoring-data/modules/landing_zone/main.tf line 21:21:resource"random_string""this" {
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_required_providers.md
Warning: Missing version constraint for provider "aws" in `required_providers` (terraform_required_providers)
on terraform/environments/electronic-monitoring-data/modules/landing_zone/main.tf line 337:337:resource"aws_iam_role_policy""this_transfer_workflow" {
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_required_providers.md
Warning: `account_id` variable has no type (terraform_typed_variables)
on terraform/environments/electronic-monitoring-data/modules/landing_zone/variables.tf line 1:1:variable"account_id" {
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_typed_variables.md
Warning: `data_store_bucket` variable has no type (terraform_typed_variables)
on terraform/environments/electronic-monitoring-data/modules/landing_zone/variables.tf line 5:5:variable"data_store_bucket" {
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_typed_variables.md
Warning: `vpc_id` variable has no type (terraform_typed_variables)
on terraform/environments/electronic-monitoring-data/modules/landing_zone/variables.tf line 30:30:variable"vpc_id" {
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_typed_variables.mdtflint_exitcode=4*****************************
Running tflint in terraform/environments/electronic-monitoring-data/modules/landing_zone/server_security_group
Excluding the following checks: terraform_unused_declarations
3issue(s) found:
Warning: terraform "required_version" attribute is required (terraform_required_version)
on line 0:
(source code not available)
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_required_version.md
Warning: Missing version constraint for provider "aws" in `required_providers` (terraform_required_providers)
on terraform/environments/electronic-monitoring-data/modules/landing_zone/server_security_group/main.tf line 28:28:resource"aws_vpc_security_group_ingress_rule""this_ipv6" {
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_required_providers.md
Warning: `vpc_id` variable has no type (terraform_typed_variables)
on terraform/environments/electronic-monitoring-data/modules/landing_zone/server_security_group/variables.tf line 23:23:variable"vpc_id" {
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_typed_variables.mdtflint_exitcode=6*****************************
Running tflint in terraform/environments/electronic-monitoring-data/modules/landing_zone
Excluding the following checks: terraform_unused_declarations
6issue(s) found:
Warning: terraform "required_version" attribute is required (terraform_required_version)
on line 0:
(source code not available)
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_required_version.md
Warning: Missing version constraint for provider "random" in `required_providers` (terraform_required_providers)
on terraform/environments/electronic-monitoring-data/modules/landing_zone/main.tf line 21:21:resource"random_string""this" {
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_required_providers.md
Warning: Missing version constraint for provider "aws" in `required_providers` (terraform_required_providers)
on terraform/environments/electronic-monitoring-data/modules/landing_zone/main.tf line 337:337:resource"aws_iam_role_policy""this_transfer_workflow" {
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_required_providers.md
Warning: `account_id` variable has no type (terraform_typed_variables)
on terraform/environments/electronic-monitoring-data/modules/landing_zone/variables.tf line 1:1:variable"account_id" {
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_typed_variables.md
Warning: `data_store_bucket` variable has no type (terraform_typed_variables)
on terraform/environments/electronic-monitoring-data/modules/landing_zone/variables.tf line 5:5:variable"data_store_bucket" {
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_typed_variables.md
Warning: `vpc_id` variable has no type (terraform_typed_variables)
on terraform/environments/electronic-monitoring-data/modules/landing_zone/variables.tf line 30:30:variable"vpc_id" {
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_typed_variables.mdtflint_exitcode=8
TFSEC will check the following folders:
terraform/environments/electronic-monitoring-data terraform/environments/electronic-monitoring-data/modules/landing_zone/landing_zone_user terraform/environments/electronic-monitoring-data/modules/landing_zone terraform/environments/electronic-monitoring-data/modules/landing_zone/server_security_group terraform/environments/electronic-monitoring-data/modules/landing_zone
Running TFSEC in terraform/environments/electronic-monitoring-data
Excluding the following checks: AWS095
======================================================
tfsec is joining the Trivy family
tfsec will continue to remain available
for the time being, although our engineering
attention will be directed at Trivy going forward.
Results #1-6 HIGH IAM policy document uses sensitive action 's3:PutObject' on wildcarded resource '97b69b01-230d-462b-a2c4-0e50c2b5fac9/' (6 similar results)
────────────────────────────────────────────────────────────────────────────────
modules/landing_zone/landing_zone_user/main.tf:57
via modules/landing_zone/main.tf:349-359 (module.landing_zone_users["0"])
via main.tf:1-17 (module.capita)
────────────────────────────────────────────────────────────────────────────────
46 data "aws_iam_policy_document" "this_transfer_user" {
..
57 [ resources = ["${var.landing_bucket.arn}/"]
..
59 }
────────────────────────────────────────────────────────────────────────────────
Individual Causes
modules/landing_zone/landing_zone_user/main.tf:1-17 (module.capita) 6 instances
────────────────────────────────────────────────────────────────────────────────
ID aws-iam-no-policy-wildcards
Impact Overly permissive policies may grant access to sensitive resources
Resolution Specify the exact permissions required, and to which resources they should apply instead of using wildcards.
Results #7-9 HIGH IAM policy document uses sensitive action 's3:GetObject' on wildcarded resource '97b69b01-230d-462b-a2c4-0e50c2b5fac9/' (3 similar results)
────────────────────────────────────────────────────────────────────────────────
modules/landing_zone/main.tf:291
via main.tf:1-17 (module.capita)
────────────────────────────────────────────────────────────────────────────────
283 data "aws_iam_policy_document" "this_transfer_workflow" {
...
291 [ resources = ["${aws_s3_bucket.landing_bucket.arn}/"]
...
335 }
────────────────────────────────────────────────────────────────────────────────
Individual Causes
modules/landing_zone/main.tf:1-17 (module.capita) 3 instances
────────────────────────────────────────────────────────────────────────────────
ID aws-iam-no-policy-wildcards
Impact Overly permissive policies may grant access to sensitive resources
Resolution Specify the exact permissions required, and to which resources they should apply instead of using wildcards.
Results #10-12 HIGH IAM policy document uses sensitive action 's3:PutObject' on wildcarded resource '64ece238-be4a-42c0-90d0-5c9ff8f05fe8/' (3 similar results)
────────────────────────────────────────────────────────────────────────────────
modules/landing_zone/main.tf:300
via main.tf:1-17 (module.capita)
────────────────────────────────────────────────────────────────────────────────
283 data "aws_iam_policy_document" "this_transfer_workflow" {
...
300 [ resources = ["${var.data_store_bucket.arn}/"]
...
335 }
────────────────────────────────────────────────────────────────────────────────
Individual Causes
modules/landing_zone/main.tf:1-17 (module.capita) 3 instances
────────────────────────────────────────────────────────────────────────────────
ID aws-iam-no-policy-wildcards
Impact Overly permissive policies may grant access to sensitive resources
Resolution Specify the exact permissions required, and to which resources they should apply instead of using wildcards.
Results #13-18 HIGH IAM policy document uses sensitive action 's3:PutObjectTagging' on wildcarded resource '64ece238-be4a-42c0-90d0-5c9ff8f05fe8/' (6 similar results)
────────────────────────────────────────────────────────────────────────────────
modules/landing_zone/main.tf:320-323
via main.tf:1-17 (module.capita)
────────────────────────────────────────────────────────────────────────────────
283 data "aws_iam_policy_document" "this_transfer_workflow" {
...
320 ┌ resources = [
321 │ "${var.data_store_bucket.arn}/",
322 │ "${aws_s3_bucket.landing_bucket.arn}/*",
323 └ ]
...
335 }
────────────────────────────────────────────────────────────────────────────────
Individual Causes
modules/landing_zone/main.tf:1-17 (module.capita) 6 instances
────────────────────────────────────────────────────────────────────────────────
ID aws-iam-no-policy-wildcards
Impact Overly permissive policies may grant access to sensitive resources
Resolution Specify the exact permissions required, and to which resources they should apply instead of using wildcards.
Results #19-21 HIGH IAM policy document uses sensitive action 's3:DeleteObject' on wildcarded resource '97b69b01-230d-462b-a2c4-0e50c2b5fac9/' (3 similar results)
────────────────────────────────────────────────────────────────────────────────
modules/landing_zone/main.tf:333
via main.tf:1-17 (module.capita)
────────────────────────────────────────────────────────────────────────────────
283 data "aws_iam_policy_document" "this_transfer_workflow" {
...
333 [ resources = ["${aws_s3_bucket.landing_bucket.arn}/"]
...
335 }
────────────────────────────────────────────────────────────────────────────────
Individual Causes
modules/landing_zone/main.tf:1-17 (module.capita) 3 instances
────────────────────────────────────────────────────────────────────────────────
ID aws-iam-no-policy-wildcards
Impact Overly permissive policies may grant access to sensitive resources
Resolution Specify the exact permissions required, and to which resources they should apply instead of using wildcards.
modules/landing_zone/main.tf:1-17 (module.capita)
────────────────────────────────────────────────────────────────────────────────
ID aws-s3-encryption-customer-key
Impact Using AWS managed keys does not allow for fine grained control
Resolution Enable encryption using customer managed keys
modules/s3_log_bucket/main.tf:1-17 (module.capita) 3 instances
────────────────────────────────────────────────────────────────────────────────
ID aws-s3-encryption-customer-key
Impact Using AWS managed keys does not allow for fine grained control
Resolution Enable encryption using customer managed keys
Result #29 HIGH Bucket does not encrypt data with a customer managed key.
────────────────────────────────────────────────────────────────────────────────
s3.tf:20-28
────────────────────────────────────────────────────────────────────────────────
20 resource "aws_s3_bucket_server_side_encryption_configuration" "data_store" {
21 bucket = aws_s3_bucket.data_store.id
22
23 rule {
24 apply_server_side_encryption_by_default {
25 sse_algorithm = "AES256"
26 }
27 }
28 }
────────────────────────────────────────────────────────────────────────────────
ID aws-s3-encryption-customer-key
Impact Using AWS managed keys does not allow for fine grained control
Resolution Enable encryption using customer managed keys
Results #30-32 MEDIUM Key does not have rotation enabled. (3 similar results)
────────────────────────────────────────────────────────────────────────────────
modules/landing_zone/main.tf:119-127
via main.tf:1-17 (module.capita)
────────────────────────────────────────────────────────────────────────────────
119 resource "aws_kms_key" "this" {
120 description = "${var.supplier} server cloudwatch log encryption key"
121 key_usage = "ENCRYPT_DECRYPT"
122 deletion_window_in_days = 30
123
124 tags = {
125 supplier = var.supplier
126 }
127 }
────────────────────────────────────────────────────────────────────────────────
Individual Causes
modules/landing_zone/main.tf:1-17 (module.capita)
modules/landing_zone/main.tf:37-53 (module.g4s)
modules/landing_zone/main.tf:19-35 (module.civica)
────────────────────────────────────────────────────────────────────────────────
ID aws-kms-auto-rotate-keys
Impact Long life KMS keys increase the attack surface when compromised
Resolution Configure KMS key to auto rotate
modules/landing_zone/main.tf:1-17 (module.capita)
────────────────────────────────────────────────────────────────────────────────
ID aws-s3-enable-versioning
Impact Deleted or modified data would not be recoverable
Resolution Enable versioning to protect against accidental/malicious removal or modification
modules/s3_log_bucket/main.tf:19-35 (module.civica)
────────────────────────────────────────────────────────────────────────────────
ID aws-s3-enable-bucket-logging
Impact There is no way to determine the access to this bucket
Resolution Add a logging block to the resource to enable access logging
modules/s3_log_bucket/main.tf:5-10 (module.data_store_log_bucket)
────────────────────────────────────────────────────────────────────────────────
ID aws-s3-enable-versioning
Impact Deleted or modified data would not be recoverable
Resolution Enable versioning to protect against accidental/malicious removal or modification
Result #1 HIGH IAM policy document uses sensitive action 's3:GetObject' on wildcarded resource 'e194451f-8846-4df6-936d-b1bf8e1f2efb/'
────────────────────────────────────────────────────────────────────────────────
main.tf:291
────────────────────────────────────────────────────────────────────────────────
283 data "aws_iam_policy_document" "this_transfer_workflow" {
...
291 [ resources = ["${aws_s3_bucket.landing_bucket.arn}/"]
...
335 }
────────────────────────────────────────────────────────────────────────────────
ID aws-iam-no-policy-wildcards
Impact Overly permissive policies may grant access to sensitive resources
Resolution Specify the exact permissions required, and to which resources they should apply instead of using wildcards.
Result #2 HIGH IAM policy document uses sensitive action 's3:PutObjectTagging' on wildcarded resource ''
────────────────────────────────────────────────────────────────────────────────
main.tf:320-323
────────────────────────────────────────────────────────────────────────────────
283 data "aws_iam_policy_document" "this_transfer_workflow" {
...
320 ┌ resources = [
321 │ "${var.data_store_bucket.arn}/",
322 │ "${aws_s3_bucket.landing_bucket.arn}/",
323 └ ]
...
335 }
────────────────────────────────────────────────────────────────────────────────
ID aws-iam-no-policy-wildcards
Impact Overly permissive policies may grant access to sensitive resources
Resolution Specify the exact permissions required, and to which resources they should apply instead of using wildcards.
Result #3 HIGH IAM policy document uses sensitive action 's3:DeleteObject' on wildcarded resource 'e194451f-8846-4df6-936d-b1bf8e1f2efb/'
────────────────────────────────────────────────────────────────────────────────
main.tf:333
────────────────────────────────────────────────────────────────────────────────
283 data "aws_iam_policy_document" "this_transfer_workflow" {
...
333 [ resources = ["${aws_s3_bucket.landing_bucket.arn}/"]
...
335 }
────────────────────────────────────────────────────────────────────────────────
ID aws-iam-no-policy-wildcards
Impact Overly permissive policies may grant access to sensitive resources
Resolution Specify the exact permissions required, and to which resources they should apply instead of using wildcards.
Result #4 HIGH Bucket does not encrypt data with a customer managed key.
────────────────────────────────────────────────────────────────────────────────
main.tf:37-45
────────────────────────────────────────────────────────────────────────────────
37 resource "aws_s3_bucket_server_side_encryption_configuration" "landing_bucket" {
38 bucket = aws_s3_bucket.landing_bucket.id
39
40 rule {
41 apply_server_side_encryption_by_default {
42 sse_algorithm = "AES256"
43 }
44 }
45 }
────────────────────────────────────────────────────────────────────────────────
ID aws-s3-encryption-customer-key
Impact Using AWS managed keys does not allow for fine grained control
Resolution Enable encryption using customer managed keys
Result #5 HIGH Bucket does not encrypt data with a customer managed key.
────────────────────────────────────────────────────────────────────────────────
../s3_log_bucket/main.tf:10-18
via main.tf:105-113 (module.log_bucket)
────────────────────────────────────────────────────────────────────────────────
10 resource "aws_s3_bucket_server_side_encryption_configuration" "this" {
11 bucket = aws_s3_bucket.this.id
12
13 rule {
14 apply_server_side_encryption_by_default {
15 sse_algorithm = "AES256"
16 }
17 }
18 }
────────────────────────────────────────────────────────────────────────────────
ID aws-s3-encryption-customer-key
Impact Using AWS managed keys does not allow for fine grained control
Resolution Enable encryption using customer managed keys
Result #7 MEDIUM Bucket does not have versioning enabled
────────────────────────────────────────────────────────────────────────────────
main.tf:84
────────────────────────────────────────────────────────────────────────────────
81 resource "aws_s3_bucket_versioning" "landing_bucket" {
82 bucket = aws_s3_bucket.landing_bucket.id
83 versioning_configuration {
84 [ status = "Disabled"
85 }
86 }
────────────────────────────────────────────────────────────────────────────────
ID aws-s3-enable-versioning
Impact Deleted or modified data would not be recoverable
Resolution Enable versioning to protect against accidental/malicious removal or modification
Result #8 MEDIUM Bucket does not have logging enabled
────────────────────────────────────────────────────────────────────────────────
../s3_log_bucket/main.tf:2-8
via main.tf:105-113 (module.log_bucket)
────────────────────────────────────────────────────────────────────────────────
2 resource "aws_s3_bucket" "this" {
3 bucket = "${var.source_bucket.id}-logs"
4
5 force_destroy = true
6
7 tags = var.tags
8 }
────────────────────────────────────────────────────────────────────────────────
ID aws-s3-enable-bucket-logging
Impact There is no way to determine the access to this bucket
Resolution Add a logging block to the resource to enable access logging
Result #9 MEDIUM Bucket does not have versioning enabled
────────────────────────────────────────────────────────────────────────────────
../s3_log_bucket/main.tf:2-8
via main.tf:105-113 (module.log_bucket)
────────────────────────────────────────────────────────────────────────────────
2 resource "aws_s3_bucket" "this" {
3 bucket = "${var.source_bucket.id}-logs"
4
5 force_destroy = true
6
7 tags = var.tags
8 }
────────────────────────────────────────────────────────────────────────────────
ID aws-s3-enable-versioning
Impact Deleted or modified data would not be recoverable
Resolution Enable versioning to protect against accidental/malicious removal or modification
Result #1 HIGH IAM policy document uses sensitive action 's3:GetObject' on wildcarded resource '9debcaba-17bb-4801-a506-61a0435716c1/'
────────────────────────────────────────────────────────────────────────────────
main.tf:291
────────────────────────────────────────────────────────────────────────────────
283 data "aws_iam_policy_document" "this_transfer_workflow" {
...
291 [ resources = ["${aws_s3_bucket.landing_bucket.arn}/"]
...
335 }
────────────────────────────────────────────────────────────────────────────────
ID aws-iam-no-policy-wildcards
Impact Overly permissive policies may grant access to sensitive resources
Resolution Specify the exact permissions required, and to which resources they should apply instead of using wildcards.
Result #2 HIGH IAM policy document uses sensitive action 's3:PutObjectTagging' on wildcarded resource ''
────────────────────────────────────────────────────────────────────────────────
main.tf:320-323
────────────────────────────────────────────────────────────────────────────────
283 data "aws_iam_policy_document" "this_transfer_workflow" {
...
320 ┌ resources = [
321 │ "${var.data_store_bucket.arn}/",
322 │ "${aws_s3_bucket.landing_bucket.arn}/",
323 └ ]
...
335 }
────────────────────────────────────────────────────────────────────────────────
ID aws-iam-no-policy-wildcards
Impact Overly permissive policies may grant access to sensitive resources
Resolution Specify the exact permissions required, and to which resources they should apply instead of using wildcards.
Result #3 HIGH IAM policy document uses sensitive action 's3:DeleteObject' on wildcarded resource '9debcaba-17bb-4801-a506-61a0435716c1/'
────────────────────────────────────────────────────────────────────────────────
main.tf:333
────────────────────────────────────────────────────────────────────────────────
283 data "aws_iam_policy_document" "this_transfer_workflow" {
...
333 [ resources = ["${aws_s3_bucket.landing_bucket.arn}/"]
...
335 }
────────────────────────────────────────────────────────────────────────────────
ID aws-iam-no-policy-wildcards
Impact Overly permissive policies may grant access to sensitive resources
Resolution Specify the exact permissions required, and to which resources they should apply instead of using wildcards.
Result #4 HIGH Bucket does not encrypt data with a customer managed key.
────────────────────────────────────────────────────────────────────────────────
main.tf:37-45
────────────────────────────────────────────────────────────────────────────────
37 resource "aws_s3_bucket_server_side_encryption_configuration" "landing_bucket" {
38 bucket = aws_s3_bucket.landing_bucket.id
39
40 rule {
41 apply_server_side_encryption_by_default {
42 sse_algorithm = "AES256"
43 }
44 }
45 }
────────────────────────────────────────────────────────────────────────────────
ID aws-s3-encryption-customer-key
Impact Using AWS managed keys does not allow for fine grained control
Resolution Enable encryption using customer managed keys
Result #5 HIGH Bucket does not encrypt data with a customer managed key.
────────────────────────────────────────────────────────────────────────────────
../s3_log_bucket/main.tf:10-18
via main.tf:105-113 (module.log_bucket)
────────────────────────────────────────────────────────────────────────────────
10 resource "aws_s3_bucket_server_side_encryption_configuration" "this" {
11 bucket = aws_s3_bucket.this.id
12
13 rule {
14 apply_server_side_encryption_by_default {
15 sse_algorithm = "AES256"
16 }
17 }
18 }
────────────────────────────────────────────────────────────────────────────────
ID aws-s3-encryption-customer-key
Impact Using AWS managed keys does not allow for fine grained control
Resolution Enable encryption using customer managed keys
Result #7 MEDIUM Bucket does not have versioning enabled
────────────────────────────────────────────────────────────────────────────────
main.tf:84
────────────────────────────────────────────────────────────────────────────────
81 resource "aws_s3_bucket_versioning" "landing_bucket" {
82 bucket = aws_s3_bucket.landing_bucket.id
83 versioning_configuration {
84 [ status = "Disabled"
85 }
86 }
────────────────────────────────────────────────────────────────────────────────
ID aws-s3-enable-versioning
Impact Deleted or modified data would not be recoverable
Resolution Enable versioning to protect against accidental/malicious removal or modification
Result #8 MEDIUM Bucket does not have logging enabled
────────────────────────────────────────────────────────────────────────────────
../s3_log_bucket/main.tf:2-8
via main.tf:105-113 (module.log_bucket)
────────────────────────────────────────────────────────────────────────────────
2 resource "aws_s3_bucket" "this" {
3 bucket = "${var.source_bucket.id}-logs"
4
5 force_destroy = true
6
7 tags = var.tags
8 }
────────────────────────────────────────────────────────────────────────────────
ID aws-s3-enable-bucket-logging
Impact There is no way to determine the access to this bucket
Resolution Add a logging block to the resource to enable access logging
Result #9 MEDIUM Bucket does not have versioning enabled
────────────────────────────────────────────────────────────────────────────────
../s3_log_bucket/main.tf:2-8
via main.tf:105-113 (module.log_bucket)
────────────────────────────────────────────────────────────────────────────────
2 resource "aws_s3_bucket" "this" {
3 bucket = "${var.source_bucket.id}-logs"
4
5 force_destroy = true
6
7 tags = var.tags
8 }
────────────────────────────────────────────────────────────────────────────────
ID aws-s3-enable-versioning
Impact Deleted or modified data would not be recoverable
Resolution Enable versioning to protect against accidental/malicious removal or modification
*****************************
Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version:0.5.0)
tflint will check the following folders:
terraform/environments/electronic-monitoring-data terraform/environments/electronic-monitoring-data/modules/landing_zone/landing_zone_user terraform/environments/electronic-monitoring-data/modules/landing_zone terraform/environments/electronic-monitoring-data/modules/landing_zone/server_security_group terraform/environments/electronic-monitoring-data/modules/landing_zone
*****************************
Running tflint in terraform/environments/electronic-monitoring-data
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=0*****************************
Running tflint in terraform/environments/electronic-monitoring-data/modules/landing_zone/landing_zone_user
Excluding the following checks: terraform_unused_declarations
4issue(s) found:
Warning: terraform "required_version" attribute is required (terraform_required_version)
on line 0:
(source code not available)
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_required_version.md
Warning: Missing version constraint for provider "aws" in `required_providers` (terraform_required_providers)
on terraform/environments/electronic-monitoring-data/modules/landing_zone/landing_zone_user/main.tf line 67:67:resource"aws_transfer_ssh_key""this" {
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_required_providers.md
Warning: `landing_bucket` variable has no type (terraform_typed_variables)
on terraform/environments/electronic-monitoring-data/modules/landing_zone/landing_zone_user/variables.tf line 1:1:variable"landing_bucket" {
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_typed_variables.md
Warning: `transfer_server` variable has no type (terraform_typed_variables)
on terraform/environments/electronic-monitoring-data/modules/landing_zone/landing_zone_user/variables.tf line 15:15:variable"transfer_server" {
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_typed_variables.mdtflint_exitcode=2*****************************
Running tflint in terraform/environments/electronic-monitoring-data/modules/landing_zone
Excluding the following checks: terraform_unused_declarations
6issue(s) found:
Warning: terraform "required_version" attribute is required (terraform_required_version)
on line 0:
(source code not available)
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_required_version.md
Warning: Missing version constraint for provider "random" in `required_providers` (terraform_required_providers)
on terraform/environments/electronic-monitoring-data/modules/landing_zone/main.tf line 21:21:resource"random_string""this" {
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_required_providers.md
Warning: Missing version constraint for provider "aws" in `required_providers` (terraform_required_providers)
on terraform/environments/electronic-monitoring-data/modules/landing_zone/main.tf line 337:337:resource"aws_iam_role_policy""this_transfer_workflow" {
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_required_providers.md
Warning: `account_id` variable has no type (terraform_typed_variables)
on terraform/environments/electronic-monitoring-data/modules/landing_zone/variables.tf line 1:1:variable"account_id" {
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_typed_variables.md
Warning: `data_store_bucket` variable has no type (terraform_typed_variables)
on terraform/environments/electronic-monitoring-data/modules/landing_zone/variables.tf line 5:5:variable"data_store_bucket" {
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_typed_variables.md
Warning: `vpc_id` variable has no type (terraform_typed_variables)
on terraform/environments/electronic-monitoring-data/modules/landing_zone/variables.tf line 30:30:variable"vpc_id" {
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_typed_variables.mdtflint_exitcode=4*****************************
Running tflint in terraform/environments/electronic-monitoring-data/modules/landing_zone/server_security_group
Excluding the following checks: terraform_unused_declarations
3issue(s) found:
Warning: terraform "required_version" attribute is required (terraform_required_version)
on line 0:
(source code not available)
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_required_version.md
Warning: Missing version constraint for provider "aws" in `required_providers` (terraform_required_providers)
on terraform/environments/electronic-monitoring-data/modules/landing_zone/server_security_group/main.tf line 28:28:resource"aws_vpc_security_group_ingress_rule""this_ipv6" {
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_required_providers.md
Warning: `vpc_id` variable has no type (terraform_typed_variables)
on terraform/environments/electronic-monitoring-data/modules/landing_zone/server_security_group/variables.tf line 23:23:variable"vpc_id" {
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_typed_variables.mdtflint_exitcode=6*****************************
Running tflint in terraform/environments/electronic-monitoring-data/modules/landing_zone
Excluding the following checks: terraform_unused_declarations
6issue(s) found:
Warning: terraform "required_version" attribute is required (terraform_required_version)
on line 0:
(source code not available)
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_required_version.md
Warning: Missing version constraint for provider "random" in `required_providers` (terraform_required_providers)
on terraform/environments/electronic-monitoring-data/modules/landing_zone/main.tf line 21:21:resource"random_string""this" {
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_required_providers.md
Warning: Missing version constraint for provider "aws" in `required_providers` (terraform_required_providers)
on terraform/environments/electronic-monitoring-data/modules/landing_zone/main.tf line 337:337:resource"aws_iam_role_policy""this_transfer_workflow" {
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_required_providers.md
Warning: `account_id` variable has no type (terraform_typed_variables)
on terraform/environments/electronic-monitoring-data/modules/landing_zone/variables.tf line 1:1:variable"account_id" {
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_typed_variables.md
Warning: `data_store_bucket` variable has no type (terraform_typed_variables)
on terraform/environments/electronic-monitoring-data/modules/landing_zone/variables.tf line 5:5:variable"data_store_bucket" {
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_typed_variables.md
Warning: `vpc_id` variable has no type (terraform_typed_variables)
on terraform/environments/electronic-monitoring-data/modules/landing_zone/variables.tf line 30:30:variable"vpc_id" {
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_typed_variables.mdtflint_exitcode=8
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
github-actions
bot
added
the
environments-repository
pete-j-g
force-pushed
the
NIT-1038-mis-allow-ad-traffic-between-mp-and-legacy
branch
from
No description provided.