Delete Quarantined files after 90 days #5924

Gary-H9 · 2024-05-01T14:27:48Z

Add a lifecycle rule to the mojap-ingestion-${local.environment}-quarantine bucket which deletes files 90 days after they were last modified or created. Files should only be created in this context.

github-actions · 2024-05-01T17:34:29Z

`Trivy Scan` Failed

Show Output

```hcl

Trivy will check the following folders:
terraform/environments/analytical-platform-ingestion/modules/transfer-family/user-with-egress terraform/environments/analytical-platform-ingestion/modules/transfer-family/user terraform/environments/analytical-platform-ingestion

Running Trivy in terraform/environments/analytical-platform-ingestion/modules/transfer-family/user-with-egress
2024-05-01T17:34:08.154Z �[34mINFO�[0m Need to update DB
2024-05-01T17:34:08.154Z �[34mINFO�[0m DB Repository: ghcr.io/aquasecurity/trivy-db:2
2024-05-01T17:34:08.154Z �[34mINFO�[0m Downloading DB...
2024-05-01T17:34:09.938Z �[34mINFO�[0m Vulnerability scanning is enabled
2024-05-01T17:34:09.938Z �[34mINFO�[0m Misconfiguration scanning is enabled
2024-05-01T17:34:09.938Z �[34mINFO�[0m Need to update the built-in policies
2024-05-01T17:34:09.938Z �[34mINFO�[0m Downloading the built-in policies...
50.41 KiB / 50.41 KiB [-----------------------------------------------------------] 100.00% ? p/s 0s2024-05-01T17:34:10.137Z �[34mINFO�[0m Secret scanning is enabled
2024-05-01T17:34:10.138Z �[34mINFO�[0m If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-05-01T17:34:10.138Z �[34mINFO�[0m Please see also https://aquasecurity.github.io/trivy/v0.50/docs/scanner/secret/#recommendation for faster secret detection
2024-05-01T17:34:11.551Z �[34mINFO�[0m Number of language-specific files: 0
2024-05-01T17:34:11.551Z �[34mINFO�[0m Detected config files: 2

main.tf (terraform)

Tests: 3 (SUCCESSES: 1, FAILURES: 0, EXCEPTIONS: 2)
Failures: 0 (HIGH: 0, CRITICAL: 0)

trivy_exitcode=0

Running Trivy in terraform/environments/analytical-platform-ingestion/modules/transfer-family/user
2024-05-01T17:34:12.145Z �[34mINFO�[0m Vulnerability scanning is enabled
2024-05-01T17:34:12.145Z �[34mINFO�[0m Misconfiguration scanning is enabled
2024-05-01T17:34:12.145Z �[34mINFO�[0m Secret scanning is enabled
2024-05-01T17:34:12.145Z �[34mINFO�[0m If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-05-01T17:34:12.145Z �[34mINFO�[0m Please see also https://aquasecurity.github.io/trivy/v0.50/docs/scanner/secret/#recommendation for faster secret detection
2024-05-01T17:34:13.539Z �[34mINFO�[0m Number of language-specific files: 0
2024-05-01T17:34:13.539Z �[34mINFO�[0m Detected config files: 2

main.tf (terraform)

Tests: 3 (SUCCESSES: 1, FAILURES: 0, EXCEPTIONS: 2)
Failures: 0 (HIGH: 0, CRITICAL: 0)

trivy_exitcode=0

Running Trivy in terraform/environments/analytical-platform-ingestion
2024-05-01T17:34:14.133Z �[34mINFO�[0m Vulnerability scanning is enabled
2024-05-01T17:34:14.133Z �[34mINFO�[0m Misconfiguration scanning is enabled
2024-05-01T17:34:14.133Z �[34mINFO�[0m Secret scanning is enabled
2024-05-01T17:34:14.133Z �[34mINFO�[0m If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-05-01T17:34:14.133Z �[34mINFO�[0m Please see also https://aquasecurity.github.io/trivy/v0.50/docs/scanner/secret/#recommendation for faster secret detection
2024-05-01T17:34:19.656Z �[34mINFO�[0m Number of language-specific files: 0
2024-05-01T17:34:19.656Z �[34mINFO�[0m Detected config files: 17

git::https:/github.com/terraform-aws-modules/terraform-aws-lambda?ref=c42e75877ec6eed0e2142f7724aa661cffbb5cb8/iam.tf (terraform)

Tests: 4 (SUCCESSES: 0, FAILURES: 0, EXCEPTIONS: 4)
Failures: 0 (HIGH: 0, CRITICAL: 0)

git::https:/github.com/terraform-aws-modules/terraform-aws-s3-bucket?ref=3a1c80b29fdf8fc682d2749456ec36ecbaf4ce14/main.tf (terraform)

Tests: 11 (SUCCESSES: 5, FAILURES: 1, EXCEPTIONS: 5)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Bucket does not encrypt data with a customer managed key.
════════════════════════════════════════
Encryption using AWS keys provides protection for your S3 buckets. To increase control of the encryption and manage factors like rotation use customer managed keys.

See https://avd.aquasec.com/misconfig/avd-aws-0132
────────────────────────────────────────
git::https:/github.com/terraform-aws-modules/terraform-aws-s3-bucket?ref=3a1c80b29fdf8fc682d2749456ec36ecbaf4ce14/main.tf:176-198
via s3.tf:136-161 (module.bold_egress_bucket)
────────────────────────────────────────
176 ┌ resource "aws_s3_bucket_server_side_encryption_configuration" "this" {
177 │ count = local.create_bucket && length(keys(var.server_side_encryption_configuration)) > 0 ? 1 : 0
178 │
179 │ bucket = aws_s3_bucket.this[0].id
180 │ expected_bucket_owner = var.expected_bucket_owner
181 │
182 │ dynamic "rule" {
183 │ for_each = try(flatten([var.server_side_encryption_configuration["rule"]]), [])
184 └
...
────────────────────────────────────────

iam-policies.tf (terraform)

Tests: 2 (SUCCESSES: 0, FAILURES: 0, EXCEPTIONS: 2)
Failures: 0 (HIGH: 0, CRITICAL: 0)

terraform-aws-modules/lambda/aws/iam.tf (terraform)

Tests: 16 (SUCCESSES: 0, FAILURES: 0, EXCEPTIONS: 16)
Failures: 0 (HIGH: 0, CRITICAL: 0)

trivy_exitcode=1

</details> #### `Checkov Scan` Success
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/analytical-platform-ingestion/modules/transfer-family/user-with-egress terraform/environments/analytical-platform-ingestion/modules/transfer-family/user terraform/environments/analytical-platform-ingestion

*****************************

Running Checkov in terraform/environments/analytical-platform-ingestion/modules/transfer-family/user-with-egress
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2024-05-01 17:34:22,003 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/iam/aws//modules/iam-policy:5.37.1 (for external modules, the --download-external-modules flag is required)
2024-05-01 17:34:22,003 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/iam/aws//modules/iam-assumable-role:5.37.1 (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 20, Failed checks: 0, Skipped checks: 6


checkov_exitcode=0

*****************************

Running Checkov in terraform/environments/analytical-platform-ingestion/modules/transfer-family/user
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2024-05-01 17:34:24,701 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/iam/aws//modules/iam-policy:5.37.1 (for external modules, the --download-external-modules flag is required)
2024-05-01 17:34:24,701 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/iam/aws//modules/iam-assumable-role:5.37.1 (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 20, Failed checks: 0, Skipped checks: 6


checkov_exitcode=0

*****************************

Running Checkov in terraform/environments/analytical-platform-ingestion
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2024-05-01 17:34:27,467 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/sns/aws:6.0.1 (for external modules, the --download-external-modules flag is required)
2024-05-01 17:34:27,467 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/iam/aws//modules/iam-policy:5.37.1 (for external modules, the --download-external-modules flag is required)
2024-05-01 17:34:27,467 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/iam/aws//modules/iam-assumable-role:5.37.1 (for external modules, the --download-external-modules flag is required)
2024-05-01 17:34:27,467 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/s3-bucket/aws:4.1.0 (for external modules, the --download-external-modules flag is required)
2024-05-01 17:34:27,467 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/security-group/aws:~> 5.0 (for external modules, the --download-external-modules flag is required)
2024-05-01 17:34:27,467 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/vpc/aws//modules/vpc-endpoints:~> 5.0 (for external modules, the --download-external-modules flag is required)
2024-05-01 17:34:27,468 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/cloudwatch/aws//modules/log-group:5.3.1 (for external modules, the --download-external-modules flag is required)
2024-05-01 17:34:27,468 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/vpc/aws:~> 5.0 (for external modules, the --download-external-modules flag is required)
2024-05-01 17:34:27,468 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/lambda/aws:7.2.5 (for external modules, the --download-external-modules flag is required)
2024-05-01 17:34:27,468 [MainThread  ] [WARNI]  Failed to download module ministryofjustice/observability-platform-tenant/aws:1.0.0 (for external modules, the --download-external-modules flag is required)
2024-05-01 17:34:27,468 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/kms/aws:2.2.1 (for external modules, the --download-external-modules flag is required)
2024-05-01 17:34:27,468 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/s3-bucket/aws//modules/notification:4.1.0 (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 102, Failed checks: 0, Skipped checks: 52


checkov_exitcode=0

`CTFLint Scan` Success

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.5.0)
tflint will check the following folders:
terraform/environments/analytical-platform-ingestion/modules/transfer-family/user-with-egress terraform/environments/analytical-platform-ingestion/modules/transfer-family/user terraform/environments/analytical-platform-ingestion

*****************************

Running tflint in terraform/environments/analytical-platform-ingestion/modules/transfer-family/user-with-egress
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=0

*****************************

Running tflint in terraform/environments/analytical-platform-ingestion/modules/transfer-family/user
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=0

*****************************

Running tflint in terraform/environments/analytical-platform-ingestion
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=0

`Trivy Scan` Failed

Show Output

*****************************

Trivy will check the following folders:
terraform/environments/analytical-platform-ingestion/modules/transfer-family/user-with-egress terraform/environments/analytical-platform-ingestion/modules/transfer-family/user terraform/environments/analytical-platform-ingestion

*****************************

Running Trivy in terraform/environments/analytical-platform-ingestion/modules/transfer-family/user-with-egress
2024-05-01T17:34:08.154Z	�[34mINFO�[0m	Need to update DB
2024-05-01T17:34:08.154Z	�[34mINFO�[0m	DB Repository: ghcr.io/aquasecurity/trivy-db:2
2024-05-01T17:34:08.154Z	�[34mINFO�[0m	Downloading DB...
2024-05-01T17:34:09.938Z	�[34mINFO�[0m	Vulnerability scanning is enabled
2024-05-01T17:34:09.938Z	�[34mINFO�[0m	Misconfiguration scanning is enabled
2024-05-01T17:34:09.938Z	�[34mINFO�[0m	Need to update the built-in policies
2024-05-01T17:34:09.938Z	�[34mINFO�[0m	Downloading the built-in policies...
50.41 KiB / 50.41 KiB [-----------------------------------------------------------] 100.00% ? p/s 0s2024-05-01T17:34:10.137Z	�[34mINFO�[0m	Secret scanning is enabled
2024-05-01T17:34:10.138Z	�[34mINFO�[0m	If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-05-01T17:34:10.138Z	�[34mINFO�[0m	Please see also https://aquasecurity.github.io/trivy/v0.50/docs/scanner/secret/#recommendation for faster secret detection
2024-05-01T17:34:11.551Z	�[34mINFO�[0m	Number of language-specific files: 0
2024-05-01T17:34:11.551Z	�[34mINFO�[0m	Detected config files: 2

main.tf (terraform)
===================
Tests: 3 (SUCCESSES: 1, FAILURES: 0, EXCEPTIONS: 2)
Failures: 0 (HIGH: 0, CRITICAL: 0)

trivy_exitcode=0

*****************************

Running Trivy in terraform/environments/analytical-platform-ingestion/modules/transfer-family/user
2024-05-01T17:34:12.145Z	�[34mINFO�[0m	Vulnerability scanning is enabled
2024-05-01T17:34:12.145Z	�[34mINFO�[0m	Misconfiguration scanning is enabled
2024-05-01T17:34:12.145Z	�[34mINFO�[0m	Secret scanning is enabled
2024-05-01T17:34:12.145Z	�[34mINFO�[0m	If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-05-01T17:34:12.145Z	�[34mINFO�[0m	Please see also https://aquasecurity.github.io/trivy/v0.50/docs/scanner/secret/#recommendation for faster secret detection
2024-05-01T17:34:13.539Z	�[34mINFO�[0m	Number of language-specific files: 0
2024-05-01T17:34:13.539Z	�[34mINFO�[0m	Detected config files: 2

main.tf (terraform)
===================
Tests: 3 (SUCCESSES: 1, FAILURES: 0, EXCEPTIONS: 2)
Failures: 0 (HIGH: 0, CRITICAL: 0)

trivy_exitcode=0

*****************************

Running Trivy in terraform/environments/analytical-platform-ingestion
2024-05-01T17:34:14.133Z	�[34mINFO�[0m	Vulnerability scanning is enabled
2024-05-01T17:34:14.133Z	�[34mINFO�[0m	Misconfiguration scanning is enabled
2024-05-01T17:34:14.133Z	�[34mINFO�[0m	Secret scanning is enabled
2024-05-01T17:34:14.133Z	�[34mINFO�[0m	If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-05-01T17:34:14.133Z	�[34mINFO�[0m	Please see also https://aquasecurity.github.io/trivy/v0.50/docs/scanner/secret/#recommendation for faster secret detection
2024-05-01T17:34:19.656Z	�[34mINFO�[0m	Number of language-specific files: 0
2024-05-01T17:34:19.656Z	�[34mINFO�[0m	Detected config files: 17

git::https:/github.com/terraform-aws-modules/terraform-aws-lambda?ref=c42e75877ec6eed0e2142f7724aa661cffbb5cb8/iam.tf (terraform)
=================================================================================================================================
Tests: 4 (SUCCESSES: 0, FAILURES: 0, EXCEPTIONS: 4)
Failures: 0 (HIGH: 0, CRITICAL: 0)


git::https:/github.com/terraform-aws-modules/terraform-aws-s3-bucket?ref=3a1c80b29fdf8fc682d2749456ec36ecbaf4ce14/main.tf (terraform)
=====================================================================================================================================
Tests: 11 (SUCCESSES: 5, FAILURES: 1, EXCEPTIONS: 5)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Bucket does not encrypt data with a customer managed key.
════════════════════════════════════════
Encryption using AWS keys provides protection for your S3 buckets. To increase control of the encryption and manage factors like rotation use customer managed keys.

See https://avd.aquasec.com/misconfig/avd-aws-0132
────────────────────────────────────────
 git::https:/github.com/terraform-aws-modules/terraform-aws-s3-bucket?ref=3a1c80b29fdf8fc682d2749456ec36ecbaf4ce14/main.tf:176-198
   via s3.tf:136-161 (module.bold_egress_bucket)
────────────────────────────────────────
 176 ┌ resource "aws_s3_bucket_server_side_encryption_configuration" "this" {
 177 │   count = local.create_bucket && length(keys(var.server_side_encryption_configuration)) > 0 ? 1 : 0
 178 │ 
 179 │   bucket                = aws_s3_bucket.this[0].id
 180 │   expected_bucket_owner = var.expected_bucket_owner
 181 │ 
 182 │   dynamic "rule" {
 183 │     for_each = try(flatten([var.server_side_encryption_configuration["rule"]]), [])
 184 └ 
 ...   
────────────────────────────────────────



iam-policies.tf (terraform)
===========================
Tests: 2 (SUCCESSES: 0, FAILURES: 0, EXCEPTIONS: 2)
Failures: 0 (HIGH: 0, CRITICAL: 0)


terraform-aws-modules/lambda/aws/iam.tf (terraform)
===================================================
Tests: 16 (SUCCESSES: 0, FAILURES: 0, EXCEPTIONS: 16)
Failures: 0 (HIGH: 0, CRITICAL: 0)

trivy_exitcode=1

github-actions · 2024-05-02T12:40:05Z

`Trivy Scan` Success

Show Output

```hcl

Trivy will check the following folders:
terraform/environments/analytical-platform-ingestion/modules/transfer-family/user-with-egress terraform/environments/analytical-platform-ingestion/modules/transfer-family/user terraform/environments/analytical-platform-ingestion

Running Trivy in terraform/environments/analytical-platform-ingestion/modules/transfer-family/user-with-egress
2024-05-02T12:39:42.169Z �[34mINFO�[0m Need to update DB
2024-05-02T12:39:42.169Z �[34mINFO�[0m DB Repository: ghcr.io/aquasecurity/trivy-db:2
2024-05-02T12:39:42.169Z �[34mINFO�[0m Downloading DB...
2024-05-02T12:39:43.981Z �[34mINFO�[0m Vulnerability scanning is enabled
2024-05-02T12:39:43.981Z �[34mINFO�[0m Misconfiguration scanning is enabled
2024-05-02T12:39:43.981Z �[34mINFO�[0m Need to update the built-in policies
2024-05-02T12:39:43.981Z �[34mINFO�[0m Downloading the built-in policies...
50.41 KiB / 50.41 KiB [-----------------------------------------------------------] 100.00% ? p/s 0s2024-05-02T12:39:44.169Z �[34mINFO�[0m Secret scanning is enabled
2024-05-02T12:39:44.169Z �[34mINFO�[0m If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-05-02T12:39:44.169Z �[34mINFO�[0m Please see also https://aquasecurity.github.io/trivy/v0.50/docs/scanner/secret/#recommendation for faster secret detection
2024-05-02T12:39:45.616Z �[34mINFO�[0m Number of language-specific files: 0
2024-05-02T12:39:45.616Z �[34mINFO�[0m Detected config files: 2

main.tf (terraform)

Tests: 3 (SUCCESSES: 1, FAILURES: 0, EXCEPTIONS: 2)
Failures: 0 (HIGH: 0, CRITICAL: 0)

trivy_exitcode=0

Running Trivy in terraform/environments/analytical-platform-ingestion/modules/transfer-family/user
2024-05-02T12:39:46.223Z �[34mINFO�[0m Vulnerability scanning is enabled
2024-05-02T12:39:46.223Z �[34mINFO�[0m Misconfiguration scanning is enabled
2024-05-02T12:39:46.224Z �[34mINFO�[0m Secret scanning is enabled
2024-05-02T12:39:46.224Z �[34mINFO�[0m If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-05-02T12:39:46.224Z �[34mINFO�[0m Please see also https://aquasecurity.github.io/trivy/v0.50/docs/scanner/secret/#recommendation for faster secret detection
2024-05-02T12:39:47.739Z �[34mINFO�[0m Number of language-specific files: 0
2024-05-02T12:39:47.739Z �[34mINFO�[0m Detected config files: 2

main.tf (terraform)

Tests: 3 (SUCCESSES: 1, FAILURES: 0, EXCEPTIONS: 2)
Failures: 0 (HIGH: 0, CRITICAL: 0)

trivy_exitcode=0

Running Trivy in terraform/environments/analytical-platform-ingestion
2024-05-02T12:39:48.350Z �[34mINFO�[0m Vulnerability scanning is enabled
2024-05-02T12:39:48.350Z �[34mINFO�[0m Misconfiguration scanning is enabled
2024-05-02T12:39:48.350Z �[34mINFO�[0m Secret scanning is enabled
2024-05-02T12:39:48.350Z �[34mINFO�[0m If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-05-02T12:39:48.350Z �[34mINFO�[0m Please see also https://aquasecurity.github.io/trivy/v0.50/docs/scanner/secret/#recommendation for faster secret detection
2024-05-02T12:39:54.115Z �[34mINFO�[0m Number of language-specific files: 0
2024-05-02T12:39:54.115Z �[34mINFO�[0m Detected config files: 17

git::https:/github.com/terraform-aws-modules/terraform-aws-lambda?ref=c42e75877ec6eed0e2142f7724aa661cffbb5cb8/iam.tf (terraform)

Tests: 4 (SUCCESSES: 0, FAILURES: 0, EXCEPTIONS: 4)
Failures: 0 (HIGH: 0, CRITICAL: 0)

iam-policies.tf (terraform)

Tests: 2 (SUCCESSES: 0, FAILURES: 0, EXCEPTIONS: 2)
Failures: 0 (HIGH: 0, CRITICAL: 0)

terraform-aws-modules/lambda/aws/iam.tf (terraform)

Tests: 16 (SUCCESSES: 0, FAILURES: 0, EXCEPTIONS: 16)
Failures: 0 (HIGH: 0, CRITICAL: 0)

trivy_exitcode=0

</details> #### `Checkov Scan` Success
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/analytical-platform-ingestion/modules/transfer-family/user-with-egress terraform/environments/analytical-platform-ingestion/modules/transfer-family/user terraform/environments/analytical-platform-ingestion

*****************************

Running Checkov in terraform/environments/analytical-platform-ingestion/modules/transfer-family/user-with-egress
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2024-05-02 12:39:56,556 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/iam/aws//modules/iam-policy:5.37.1 (for external modules, the --download-external-modules flag is required)
2024-05-02 12:39:56,556 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/iam/aws//modules/iam-assumable-role:5.37.1 (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 20, Failed checks: 0, Skipped checks: 6


checkov_exitcode=0

*****************************

Running Checkov in terraform/environments/analytical-platform-ingestion/modules/transfer-family/user
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2024-05-02 12:39:59,546 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/iam/aws//modules/iam-policy:5.37.1 (for external modules, the --download-external-modules flag is required)
2024-05-02 12:39:59,546 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/iam/aws//modules/iam-assumable-role:5.37.1 (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 20, Failed checks: 0, Skipped checks: 6


checkov_exitcode=0

*****************************

Running Checkov in terraform/environments/analytical-platform-ingestion
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2024-05-02 12:40:02,496 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/sns/aws:6.0.1 (for external modules, the --download-external-modules flag is required)
2024-05-02 12:40:02,496 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/iam/aws//modules/iam-policy:5.37.1 (for external modules, the --download-external-modules flag is required)
2024-05-02 12:40:02,496 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/iam/aws//modules/iam-assumable-role:5.37.1 (for external modules, the --download-external-modules flag is required)
2024-05-02 12:40:02,496 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/s3-bucket/aws:4.1.0 (for external modules, the --download-external-modules flag is required)
2024-05-02 12:40:02,497 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/security-group/aws:~> 5.0 (for external modules, the --download-external-modules flag is required)
2024-05-02 12:40:02,497 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/vpc/aws//modules/vpc-endpoints:~> 5.0 (for external modules, the --download-external-modules flag is required)
2024-05-02 12:40:02,497 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/cloudwatch/aws//modules/log-group:5.3.1 (for external modules, the --download-external-modules flag is required)
2024-05-02 12:40:02,497 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/vpc/aws:~> 5.0 (for external modules, the --download-external-modules flag is required)
2024-05-02 12:40:02,497 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/lambda/aws:7.2.5 (for external modules, the --download-external-modules flag is required)
2024-05-02 12:40:02,497 [MainThread  ] [WARNI]  Failed to download module ministryofjustice/observability-platform-tenant/aws:1.0.0 (for external modules, the --download-external-modules flag is required)
2024-05-02 12:40:02,497 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/kms/aws:2.2.1 (for external modules, the --download-external-modules flag is required)
2024-05-02 12:40:02,497 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/s3-bucket/aws//modules/notification:4.1.0 (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 102, Failed checks: 0, Skipped checks: 52


checkov_exitcode=0

`CTFLint Scan` Success

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.5.0)
tflint will check the following folders:
terraform/environments/analytical-platform-ingestion/modules/transfer-family/user-with-egress terraform/environments/analytical-platform-ingestion/modules/transfer-family/user terraform/environments/analytical-platform-ingestion

*****************************

Running tflint in terraform/environments/analytical-platform-ingestion/modules/transfer-family/user-with-egress
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=0

*****************************

Running tflint in terraform/environments/analytical-platform-ingestion/modules/transfer-family/user
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=0

*****************************

Running tflint in terraform/environments/analytical-platform-ingestion
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=0

`Trivy Scan` Success

Show Output

*****************************

Trivy will check the following folders:
terraform/environments/analytical-platform-ingestion/modules/transfer-family/user-with-egress terraform/environments/analytical-platform-ingestion/modules/transfer-family/user terraform/environments/analytical-platform-ingestion

*****************************

Running Trivy in terraform/environments/analytical-platform-ingestion/modules/transfer-family/user-with-egress
2024-05-02T12:39:42.169Z	�[34mINFO�[0m	Need to update DB
2024-05-02T12:39:42.169Z	�[34mINFO�[0m	DB Repository: ghcr.io/aquasecurity/trivy-db:2
2024-05-02T12:39:42.169Z	�[34mINFO�[0m	Downloading DB...
2024-05-02T12:39:43.981Z	�[34mINFO�[0m	Vulnerability scanning is enabled
2024-05-02T12:39:43.981Z	�[34mINFO�[0m	Misconfiguration scanning is enabled
2024-05-02T12:39:43.981Z	�[34mINFO�[0m	Need to update the built-in policies
2024-05-02T12:39:43.981Z	�[34mINFO�[0m	Downloading the built-in policies...
50.41 KiB / 50.41 KiB [-----------------------------------------------------------] 100.00% ? p/s 0s2024-05-02T12:39:44.169Z	�[34mINFO�[0m	Secret scanning is enabled
2024-05-02T12:39:44.169Z	�[34mINFO�[0m	If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-05-02T12:39:44.169Z	�[34mINFO�[0m	Please see also https://aquasecurity.github.io/trivy/v0.50/docs/scanner/secret/#recommendation for faster secret detection
2024-05-02T12:39:45.616Z	�[34mINFO�[0m	Number of language-specific files: 0
2024-05-02T12:39:45.616Z	�[34mINFO�[0m	Detected config files: 2

main.tf (terraform)
===================
Tests: 3 (SUCCESSES: 1, FAILURES: 0, EXCEPTIONS: 2)
Failures: 0 (HIGH: 0, CRITICAL: 0)

trivy_exitcode=0

*****************************

Running Trivy in terraform/environments/analytical-platform-ingestion/modules/transfer-family/user
2024-05-02T12:39:46.223Z	�[34mINFO�[0m	Vulnerability scanning is enabled
2024-05-02T12:39:46.223Z	�[34mINFO�[0m	Misconfiguration scanning is enabled
2024-05-02T12:39:46.224Z	�[34mINFO�[0m	Secret scanning is enabled
2024-05-02T12:39:46.224Z	�[34mINFO�[0m	If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-05-02T12:39:46.224Z	�[34mINFO�[0m	Please see also https://aquasecurity.github.io/trivy/v0.50/docs/scanner/secret/#recommendation for faster secret detection
2024-05-02T12:39:47.739Z	�[34mINFO�[0m	Number of language-specific files: 0
2024-05-02T12:39:47.739Z	�[34mINFO�[0m	Detected config files: 2

main.tf (terraform)
===================
Tests: 3 (SUCCESSES: 1, FAILURES: 0, EXCEPTIONS: 2)
Failures: 0 (HIGH: 0, CRITICAL: 0)

trivy_exitcode=0

*****************************

Running Trivy in terraform/environments/analytical-platform-ingestion
2024-05-02T12:39:48.350Z	�[34mINFO�[0m	Vulnerability scanning is enabled
2024-05-02T12:39:48.350Z	�[34mINFO�[0m	Misconfiguration scanning is enabled
2024-05-02T12:39:48.350Z	�[34mINFO�[0m	Secret scanning is enabled
2024-05-02T12:39:48.350Z	�[34mINFO�[0m	If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-05-02T12:39:48.350Z	�[34mINFO�[0m	Please see also https://aquasecurity.github.io/trivy/v0.50/docs/scanner/secret/#recommendation for faster secret detection
2024-05-02T12:39:54.115Z	�[34mINFO�[0m	Number of language-specific files: 0
2024-05-02T12:39:54.115Z	�[34mINFO�[0m	Detected config files: 17

git::https:/github.com/terraform-aws-modules/terraform-aws-lambda?ref=c42e75877ec6eed0e2142f7724aa661cffbb5cb8/iam.tf (terraform)
=================================================================================================================================
Tests: 4 (SUCCESSES: 0, FAILURES: 0, EXCEPTIONS: 4)
Failures: 0 (HIGH: 0, CRITICAL: 0)


iam-policies.tf (terraform)
===========================
Tests: 2 (SUCCESSES: 0, FAILURES: 0, EXCEPTIONS: 2)
Failures: 0 (HIGH: 0, CRITICAL: 0)


terraform-aws-modules/lambda/aws/iam.tf (terraform)
===================================================
Tests: 16 (SUCCESSES: 0, FAILURES: 0, EXCEPTIONS: 16)
Failures: 0 (HIGH: 0, CRITICAL: 0)

trivy_exitcode=0

* Delete Infected files after 90 days * Linting * Linting * Linting * Linting * 📌 add versions * Linting --------- Co-authored-by: Aaron Robinson <aaron.robinson@digital.justice.gov.uk>

Delete Infected files after 90 days

70900eb

github-actions bot added the environments-repository Used to exclude PRs from this repo in our Slack PR update label May 1, 2024

Gary-H9 had a problem deploying to analytical-platform-ingestion-development May 1, 2024 14:28 — with GitHub Actions Failure

Linting

ace6499

Gary-H9 had a problem deploying to analytical-platform-ingestion-development May 1, 2024 15:09 — with GitHub Actions Failure

Linting

e91a3b0

Gary-H9 had a problem deploying to analytical-platform-ingestion-development May 1, 2024 15:23 — with GitHub Actions Failure

Linting

bfe35c4

Gary-H9 had a problem deploying to analytical-platform-ingestion-development May 1, 2024 15:49 — with GitHub Actions Failure

This comment was marked as outdated.

Sign in to view

Linting

3102030

Gary-H9 had a problem deploying to analytical-platform-ingestion-development May 1, 2024 16:11 — with GitHub Actions Failure

This comment was marked as outdated.

Sign in to view

📌 add versions

1522933

ASTRobinson had a problem deploying to analytical-platform-ingestion-development May 1, 2024 17:33 — with GitHub Actions Failure

Linting

b0bf65d

Gary-H9 temporarily deployed to analytical-platform-ingestion-development May 2, 2024 12:38 — with GitHub Actions Inactive

ministryofjustice deleted a comment from github-actions bot May 2, 2024

Gary-H9 marked this pull request as ready for review May 2, 2024 12:55

Gary-H9 requested review from a team as code owners May 2, 2024 12:55

jacobwoffenden approved these changes May 2, 2024

View reviewed changes

Gary-H9 merged commit fabf92a into main May 2, 2024
12 checks passed

Gary-H9 deleted the ap-ing-quar-lp branch May 2, 2024 13:21

Gary-H9 mentioned this pull request May 2, 2024

♻️ 🪣 Ingestion: Add S3 Lifecycle Action ministryofjustice/analytical-platform#3941

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Delete Quarantined files after 90 days #5924

Delete Quarantined files after 90 days #5924

Gary-H9 commented May 1, 2024

This comment was marked as outdated.

This comment was marked as outdated.

github-actions bot commented May 1, 2024

main.tf (terraform)

main.tf (terraform)

git::https:/github.com/terraform-aws-modules/terraform-aws-lambda?ref=c42e75877ec6eed0e2142f7724aa661cffbb5cb8/iam.tf (terraform)

git::https:/github.com/terraform-aws-modules/terraform-aws-s3-bucket?ref=3a1c80b29fdf8fc682d2749456ec36ecbaf4ce14/main.tf (terraform)

iam-policies.tf (terraform)

terraform-aws-modules/lambda/aws/iam.tf (terraform)

github-actions bot commented May 2, 2024

main.tf (terraform)

main.tf (terraform)

git::https:/github.com/terraform-aws-modules/terraform-aws-lambda?ref=c42e75877ec6eed0e2142f7724aa661cffbb5cb8/iam.tf (terraform)

iam-policies.tf (terraform)

terraform-aws-modules/lambda/aws/iam.tf (terraform)

Delete Quarantined files after 90 days #5924

Delete Quarantined files after 90 days #5924

Conversation

Gary-H9 commented May 1, 2024

This comment was marked as outdated.

This comment was marked as outdated.

github-actions bot commented May 1, 2024

Trivy Scan Failed

main.tf (terraform)

main.tf (terraform)

git::https:/github.com/terraform-aws-modules/terraform-aws-lambda?ref=c42e75877ec6eed0e2142f7724aa661cffbb5cb8/iam.tf (terraform)

git::https:/github.com/terraform-aws-modules/terraform-aws-s3-bucket?ref=3a1c80b29fdf8fc682d2749456ec36ecbaf4ce14/main.tf (terraform)

iam-policies.tf (terraform)

terraform-aws-modules/lambda/aws/iam.tf (terraform)

CTFLint Scan Success

Trivy Scan Failed

github-actions bot commented May 2, 2024

Trivy Scan Success

main.tf (terraform)

main.tf (terraform)

git::https:/github.com/terraform-aws-modules/terraform-aws-lambda?ref=c42e75877ec6eed0e2142f7724aa661cffbb5cb8/iam.tf (terraform)

iam-policies.tf (terraform)

terraform-aws-modules/lambda/aws/iam.tf (terraform)

CTFLint Scan Success

Trivy Scan Success

`Trivy Scan` Failed

`CTFLint Scan` Success

`Trivy Scan` Failed

`Trivy Scan` Success

`CTFLint Scan` Success

`Trivy Scan` Success