You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
</details> #### `Checkov Scan` Success
<details><summary>Show Output</summary>
```hcl
*****************************
Checkov will check the following folders:
CTFLint Scan Success
Show Output
*****************************
Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version:0.5.0)
tflint will check the following folders:
Trivy Scan Success
Show Output
*****************************
Trivy will check the following folders:
Trivy will check the following folders:
terraform/environments/xhibit-portal
Running Trivy in terraform/environments/xhibit-portal
2024-09-12T09:18:39Z INFO [db] Need to update DB
2024-09-12T09:18:39Z INFO [db] Downloading DB... repository="ghcr.io/aquasecurity/trivy-db:2"
2024-09-12T09:18:41Z INFO [vuln] Vulnerability scanning is enabled
2024-09-12T09:18:41Z INFO [misconfig] Misconfiguration scanning is enabled
2024-09-12T09:18:41Z INFO Need to update the built-in policies
2024-09-12T09:18:41Z INFO Downloading the built-in policies...
74.86 KiB / 74.86 KiB [-----------------------------------------------------------] 100.00% ? p/s 0s2024-09-12T09:18:41Z INFO [secret] Secret scanning is enabled
2024-09-12T09:18:41Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-09-12T09:18:41Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.55/docs/scanner/secret#recommendation for faster secret detection
2024-09-12T09:18:42Z INFO [terraform scanner] Scanning root module file_path="."
2024-09-12T09:18:42Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="networking"
2024-09-12T09:18:43Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.bastion_linux.aws_s3_object.user_public_keys" value="cty.NilVal"
2024-09-12T09:18:43Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.bastion_linux.data.aws_subnet.local_account" value="cty.NilVal"
2024-09-12T09:18:43Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.bastion_linux.dynamic.tag" value="cty.NilVal"
2024-09-12T09:18:43Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.bastion_linux.dynamic.tag" value="cty.NilVal"
2024-09-12T09:18:43Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.bastion_linux.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-09-12T09:18:43Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.bastion_linux.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-09-12T09:18:43Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.bastion_linux.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-09-12T09:18:43Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.bastion_linux.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-09-12T09:18:43Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.bastion_linux.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-09-12T09:18:43Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.bastion_linux.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-09-12T09:18:43Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.bastion_linux.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-09-12T09:18:43Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.bastion_linux.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-09-12T09:18:43Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.bastion_linux.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-09-12T09:18:43Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.bastion_linux.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-09-12T09:18:43Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.bastion_linux.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-09-12T09:18:43Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.bastion_linux.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-09-12T09:18:44Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.vm-import.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-09-12T09:18:44Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.vm-import.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-09-12T09:18:44Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.vm-import.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-09-12T09:18:44Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.vm-import.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-09-12T09:18:44Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.vm-import.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-09-12T09:18:44Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.vm-import.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-09-12T09:18:44Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.vm-import.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-09-12T09:18:44Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.vm-import.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-09-12T09:18:44Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.vm-import.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-09-12T09:18:44Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.vm-import.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-09-12T09:18:44Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.vm-import.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-09-12T09:18:44Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.vm-import.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-09-12T09:18:44Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/main.tf:242-284"
2024-09-12T09:18:44Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/main.tf:242-284"
2024-09-12T09:18:44Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/main.tf:242-284"
2024-09-12T09:18:44Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/main.tf:242-284"
2024-09-12T09:18:44Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/main.tf:242-284"
2024-09-12T09:18:44Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/main.tf:242-284"
2024-09-12T09:18:44Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/main.tf:242-284"
2024-09-12T09:18:44Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/main.tf:242-284"
2024-09-12T09:18:44Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/main.tf:242-284"
2024-09-12T09:18:44Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/main.tf:303-321"
2024-09-12T09:18:44Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"
2024-09-12T09:18:44Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"
2024-09-12T09:18:44Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"
2024-09-12T09:18:44Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"
2024-09-12T09:18:44Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"
2024-09-12T09:18:44Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"
2024-09-12T09:18:44Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"
2024-09-12T09:18:44Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"
2024-09-12T09:18:44Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"
2024-09-12T09:18:44Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"
2024-09-12T09:18:44Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"
2024-09-12T09:18:44Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/main.tf:303-321"
2024-09-12T09:18:44Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"
2024-09-12T09:18:44Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"
2024-09-12T09:18:44Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"
2024-09-12T09:18:44Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"
2024-09-12T09:18:44Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"
2024-09-12T09:18:44Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"
2024-09-12T09:18:44Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"
2024-09-12T09:18:44Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"
2024-09-12T09:18:44Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"
2024-09-12T09:18:44Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"
2024-09-12T09:18:44Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"
2024-09-12T09:18:44Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-versioning" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0/main.tf:8-19"
2024-09-12T09:18:44Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-versioning" range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=8688bc15a08fbf5a4f4eef9b7433c5a417df8df1/main.tf:8-19"
2024-09-12T09:18:44Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0/main.tf:157-165"
2024-09-12T09:18:44Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=8688bc15a08fbf5a4f4eef9b7433c5a417df8df1/main.tf:157-165"
2024-09-12T09:18:44Z INFO [terraform executor] Ignore finding rule="aws-lambda-enable-tracing" range="lambda.tf:150-164"
2024-09-12T09:18:44Z INFO [terraform executor] Ignore finding rule="aws-lambda-enable-tracing" range="lambda.tf:57-69"
2024-09-12T09:18:44Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-bucket-encryption" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0/main.tf:8-19"
2024-09-12T09:18:44Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-bucket-encryption" range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=8688bc15a08fbf5a4f4eef9b7433c5a417df8df1/main.tf:8-19"
2024-09-12T09:18:44Z INFO [npm] To collect the license information of packages, "npm install" needs to be performed beforehand dir="scripts/perf/node_modules"
2024-09-12T09:18:44Z INFO Number of language-specific files num=1
2024-09-12T09:18:44Z INFO [npm] Detecting vulnerabilities...
2024-09-12T09:18:44Z INFO Detected config files num=24
For OSS Maintainers: VEX Notice
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://aquasecurity.github.io/trivy/v0.55/docs/supply-chain/vex/repo#publishing-vex-documents
To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.
scripts/perf/package-lock.json (npm)
Total: 2 (HIGH: 2, CRITICAL: 0)
┌──────────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────────┬──────────────────────────────────────────────────────────┐
│ Library │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │ Title │
├──────────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────┤
│ jsonwebtoken │ CVE-2022-23539 │ HIGH │ fixed │ 8.5.1 │ 9.0.0 │ jsonwebtoken: Unrestricted key type could lead to legacy │
│ │ │ │ │ │ │ keys usagen │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2022-23539 │
├──────────────┼────────────────┤ │ ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────┤
│ semver │ CVE-2022-25883 │ │ │ 5.7.1 │ 7.5.2, 6.3.1, 5.7.2 │ nodejs-semver: Regular expression denial of service │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2022-25883 │
└──────────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────────┴──────────────────────────────────────────────────────────┘
CRITICAL: Security group rule allows egress to multiple public internet addresses.
════════════════════════════════════════
Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.
See https://avd.aquasec.com/misconfig/avd-aws-0104
────────────────────────────────────────
importmachine.tf:29
via importmachine.tf:23-30 (egress)
via importmachine.tf:1-32 (aws_security_group.importmachine)
────────────────────────────────────────
1 resource "aws_security_group" "importmachine" {
.
29 [ ipv6_cidr_blocks = ["::/0"]
..
32 }
────────────────────────────────────────
CRITICAL: Security group rule allows egress to multiple public internet addresses.
════════════════════════════════════════
Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.
See https://avd.aquasec.com/misconfig/avd-aws-0104
────────────────────────────────────────
importmachine.tf:28
via importmachine.tf:23-30 (egress)
via importmachine.tf:1-32 (aws_security_group.importmachine)
────────────────────────────────────────
1 resource "aws_security_group" "importmachine" {
.
28 [ cidr_blocks = ["0.0.0.0/0"]
..
32 }
────────────────────────────────────────
CRITICAL: Security group rule allows ingress from public internet.
════════════════════════════════════════
Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.
See https://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
importmachine.tf:20
via importmachine.tf:14-21 (ingress)
via importmachine.tf:1-32 (aws_security_group.importmachine)
────────────────────────────────────────
1 resource "aws_security_group" "importmachine" {
.
20 [ ipv6_cidr_blocks = ["::/0"]
..
32 }
────────────────────────────────────────
CRITICAL: Security group rule allows ingress from public internet.
════════════════════════════════════════
Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.
See https://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
importmachine.tf:19
via importmachine.tf:14-21 (ingress)
via importmachine.tf:1-32 (aws_security_group.importmachine)
────────────────────────────────────────
1 resource "aws_security_group" "importmachine" {
.
19 [ cidr_blocks = ["0.0.0.0/0"]
..
32 }
────────────────────────────────────────
HIGH: Load balancer is exposed publicly.
════════════════════════════════════════
There are many scenarios in which you would want to expose a load balancer to the wider internet, but this check exists as a warning to prevent accidental exposure of internal assets. You should ensure that this resource should be exposed publicly.
HIGH: No public access block so not ignoring public acls
════════════════════════════════════════
S3 buckets should ignore public ACLs on buckets and any objects they contain. By ignoring rather than blocking, PUT calls with public ACLs will still be applied but the ACL will be ignored.
HIGH: No public access block so not restricting public buckets
════════════════════════════════════════
S3 buckets should restrict public policies for the bucket. By enabling, the restrict_public_buckets, only the bucket owner and AWS Services can access if it has a public policy.
CRITICAL: Security group rule allows ingress from public internet.
════════════════════════════════════════
Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.
See https://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
ingestion-load-balancer.tf:26-36
via ingestion-load-balancer.tf:18-40 (aws_security_group_rule.ingestion_lb_allow_web_users)
────────────────────────────────────────
18 resource "aws_security_group_rule" "ingestion_lb_allow_web_users" {
..
26 ┌ cidr_blocks = [
27 │ "10.182.60.51/32", # NLE CGI proxy
28 │ "195.59.75.151/32", # New proxy IPs from Prashanth for testing ingestion NLE DEV
29 │ "195.59.75.152/32", # New proxy IPs from Prashanth for testing ingestion NLE DEV
30 │ "194.33.192.0/24", # New proxy IPs from Prashanth for testing ingestion LE PROD
31 │ "194.33.196.0/24", # New proxy IPs from Prashanth for testing ingestion LE PROD
32 └ "194.33.248.0/24", # New proxy IPs from Prashanth for testing ingestion LE PROD
..
────────────────────────────────────────
CRITICAL: Security group rule allows egress to multiple public internet addresses.
════════════════════════════════════════
Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.
CRITICAL: Security group rule allows egress to multiple public internet addresses.
════════════════════════════════════════
Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.
CRITICAL: Security group rule allows egress to multiple public internet addresses.
════════════════════════════════════════
Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.
CRITICAL: Security group rule allows egress to multiple public internet addresses.
════════════════════════════════════════
Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.
CRITICAL: Security group rule allows egress to multiple public internet addresses.
════════════════════════════════════════
Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.
CRITICAL: Security group rule allows egress to multiple public internet addresses.
════════════════════════════════════════
Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.
CRITICAL: Security group rule allows ingress from public internet.
════════════════════════════════════════
Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.
See https://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
network-infrastructure.tf:297
via network-infrastructure.tf:288-298 (aws_security_group_rule.prtg_lb_allow_web_users)
────────────────────────────────────────
288 resource "aws_security_group_rule" "prtg_lb_allow_web_users" {
289 depends_on = [aws_security_group.prtg_lb]
290 security_group_id = aws_security_group.prtg_lb.id
291 type = "ingress"
292 description = "allow web traffic to get to prtg Load Balancer over SSL "
293 from_port = 443
294 to_port = 443
295 protocol = "TCP"
296 cidr_blocks = ["0.0.0.0/0"]
...
────────────────────────────────────────
CRITICAL: Security group rule allows ingress from public internet.
════════════════════════════════════════
Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.
See https://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
network-infrastructure.tf:296
via network-infrastructure.tf:288-298 (aws_security_group_rule.prtg_lb_allow_web_users)
────────────────────────────────────────
288 resource "aws_security_group_rule" "prtg_lb_allow_web_users" {
289 depends_on = [aws_security_group.prtg_lb]
290 security_group_id = aws_security_group.prtg_lb.id
291 type = "ingress"
292 description = "allow web traffic to get to prtg Load Balancer over SSL "
293 from_port = 443
294 to_port = 443
295 protocol = "TCP"
296 [ cidr_blocks = ["0.0.0.0/0"]
...
────────────────────────────────────────
CRITICAL: Security group rule allows ingress from public internet.
════════════════════════════════════════
Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.
See https://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
network-infrastructure.tf:285
via network-infrastructure.tf:276-286 (aws_security_group_rule.waf_lb_allow_web_users)
────────────────────────────────────────
276 resource "aws_security_group_rule" "waf_lb_allow_web_users" {
277 depends_on = [aws_security_group.waf_lb]
278 security_group_id = aws_security_group.waf_lb.id
279 type = "ingress"
280 description = "allow web traffic to get to ingestion server"
281 from_port = 443
282 to_port = 443
283 protocol = "TCP"
284 cidr_blocks = ["0.0.0.0/0"]
...
────────────────────────────────────────
CRITICAL: Security group rule allows ingress from public internet.
════════════════════════════════════════
Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.
See https://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
network-infrastructure.tf:284
via network-infrastructure.tf:276-286 (aws_security_group_rule.waf_lb_allow_web_users)
────────────────────────────────────────
276 resource "aws_security_group_rule" "waf_lb_allow_web_users" {
277 depends_on = [aws_security_group.waf_lb]
278 security_group_id = aws_security_group.waf_lb.id
279 type = "ingress"
280 description = "allow web traffic to get to ingestion server"
281 from_port = 443
282 to_port = 443
283 protocol = "TCP"
284 [ cidr_blocks = ["0.0.0.0/0"]
...
────────────────────────────────────────
CRITICAL: Listener uses an outdated TLS policy.
════════════════════════════════════════
You should not use outdated/insecure TLS versions for encryption. You should be using TLS v1.2+.
HIGH: Application load balancer is not set to drop invalid headers.
════════════════════════════════════════
Passing unknown or invalid headers through to the target poses a potential risk of compromise.
By setting drop_invalid_header_fields to true, anything that doe not conform to well known, defined headers will be removed by the load balancer.
HIGH: Load balancer is exposed publicly.
════════════════════════════════════════
There are many scenarios in which you would want to expose a load balancer to the wider internet, but this check exists as a warning to prevent accidental exposure of internal assets. You should ensure that this resource should be exposed publicly.
HIGH: No public access block so not ignoring public acls
════════════════════════════════════════
S3 buckets should ignore public ACLs on buckets and any objects they contain. By ignoring rather than blocking, PUT calls with public ACLs will still be applied but the ACL will be ignored.
HIGH: No public access block so not restricting public buckets
════════════════════════════════════════
S3 buckets should restrict public policies for the bucket. By enabling, the restrict_public_buckets, only the bucket owner and AWS Services can access if it has a public policy.
CRITICAL: Listener uses an outdated TLS policy.
════════════════════════════════════════
You should not use outdated/insecure TLS versions for encryption. You should be using TLS v1.2+.
HIGH: Application load balancer is not set to drop invalid headers.
════════════════════════════════════════
Passing unknown or invalid headers through to the target poses a potential risk of compromise.
By setting drop_invalid_header_fields to true, anything that doe not conform to well known, defined headers will be removed by the load balancer.
HIGH: Load balancer is exposed publicly.
════════════════════════════════════════
There are many scenarios in which you would want to expose a load balancer to the wider internet, but this check exists as a warning to prevent accidental exposure of internal assets. You should ensure that this resource should be exposed publicly.
HIGH: No public access block so not ignoring public acls
════════════════════════════════════════
S3 buckets should ignore public ACLs on buckets and any objects they contain. By ignoring rather than blocking, PUT calls with public ACLs will still be applied but the ACL will be ignored.
HIGH: No public access block so not ignoring public acls
════════════════════════════════════════
S3 buckets should ignore public ACLs on buckets and any objects they contain. By ignoring rather than blocking, PUT calls with public ACLs will still be applied but the ACL will be ignored.
HIGH: No public access block so not restricting public buckets
════════════════════════════════════════
S3 buckets should restrict public policies for the bucket. By enabling, the restrict_public_buckets, only the bucket owner and AWS Services can access if it has a public policy.
HIGH: No public access block so not restricting public buckets
════════════════════════════════════════
S3 buckets should restrict public policies for the bucket. By enabling, the restrict_public_buckets, only the bucket owner and AWS Services can access if it has a public policy.
*****************************
Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version:0.5.0)
tflint will check the following folders:
terraform/environments/xhibit-portal
*****************************
Running tflint in terraform/environments/xhibit-portal
Excluding the following checks: terraform_unused_declarations
18issue(s) found:
Warning: Module source "github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import" is not pinned (terraform_module_pinned_source)
on terraform/environments/xhibit-portal/importrole.tf line 3:3:source="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import"
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_module_pinned_source.md
Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)
on terraform/environments/xhibit-portal/ingestion-load-balancer.tf line 140:140:"${aws_s3_bucket.ingestion_loadbalancer_logs.arn}"
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_deprecated_interpolation.md
Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)
on terraform/environments/xhibit-portal/ingestion-load-balancer.tf line 190:190:resources=["${aws_s3_bucket.ingestion_loadbalancer_logs.arn}"]
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_deprecated_interpolation.md
Warning: Missing version constraint for provider "archive" in `required_providers` (terraform_required_providers)
on terraform/environments/xhibit-portal/lambda.tf line 141:141:data"archive_file""delete_lambda_zip" {
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_required_providers.md
Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)
on terraform/environments/xhibit-portal/prtg-load-balancer.tf line 98:98:"${local.application_data.accounts[local.environment].public_dns_name_prtg}"
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_deprecated_interpolation.md
Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)
on terraform/environments/xhibit-portal/prtg-load-balancer.tf line 237:237:log_destination_configs=["${aws_s3_bucket.prtg_logs[0].arn}"]
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_deprecated_interpolation.md
Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)
on terraform/environments/xhibit-portal/prtg-load-balancer.tf line 257:257:"${aws_s3_bucket.prtg_logs[0].arn}"
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_deprecated_interpolation.md
Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)
on terraform/environments/xhibit-portal/prtg-load-balancer.tf line 296:296:"${data.aws_caller_identity.current.account_id}"
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_deprecated_interpolation.md
Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)
on terraform/environments/xhibit-portal/prtg-load-balancer.tf line 321:321:"${aws_s3_bucket.prtg_logs[0].arn}"
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_deprecated_interpolation.md
Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)
on terraform/environments/xhibit-portal/prtg-load-balancer.tf line 328:328:"${data.aws_caller_identity.current.account_id}"
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_deprecated_interpolation.md
Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)
on terraform/environments/xhibit-portal/waf-load-balancer.tf line 184:184:"${local.application_data.accounts[local.environment].public_dns_name_web}",
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_deprecated_interpolation.md
Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)
on terraform/environments/xhibit-portal/waf-load-balancer.tf line 334:334:"${aws_s3_bucket.loadbalancer_logs.arn}"
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_deprecated_interpolation.md
Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)
on terraform/environments/xhibit-portal/waf-load-balancer.tf line 384:384:resources=["${aws_s3_bucket.loadbalancer_logs.arn}"]
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_deprecated_interpolation.md
Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)
on terraform/environments/xhibit-portal/waf-load-balancer.tf line 418:418:log_destination_configs=["${aws_s3_bucket.waf_logs[0].arn}"]
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_deprecated_interpolation.md
Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)
on terraform/environments/xhibit-portal/waf-load-balancer.tf line 438:438:"${aws_s3_bucket.waf_logs[0].arn}"
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_deprecated_interpolation.md
Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)
on terraform/environments/xhibit-portal/waf-load-balancer.tf line 477:477:"${data.aws_caller_identity.current.account_id}"
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_deprecated_interpolation.md
Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)
on terraform/environments/xhibit-portal/waf-load-balancer.tf line 502:502:"${aws_s3_bucket.waf_logs[0].arn}"
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_deprecated_interpolation.md
Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)
on terraform/environments/xhibit-portal/waf-load-balancer.tf line 509:509:"${data.aws_caller_identity.current.account_id}"
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_deprecated_interpolation.mdtflint_exitcode=2
Trivy Scan Failed
Show Output
*****************************
Trivy will check the following folders:
terraform/environments/xhibit-portal
*****************************
Running Trivy in terraform/environments/xhibit-portal
2024-09-12T09:18:39Z INFO [db] Need to update DB
2024-09-12T09:18:39Z INFO [db] Downloading DB...repository="ghcr.io/aquasecurity/trivy-db:2"2024-09-12T09:18:41Z INFO [vuln] Vulnerability scanning is enabled
2024-09-12T09:18:41Z INFO [misconfig] Misconfiguration scanning is enabled
2024-09-12T09:18:41Z INFO Need to update the built-in policies
2024-09-12T09:18:41Z INFO Downloading the built-in policies...74.86 KiB /74.86 KiB [-----------------------------------------------------------] 100.00%? p/s 0s2024-09-12T09:18:41Z INFO [secret] Secret scanning is enabled
2024-09-12T09:18:41Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-09-12T09:18:41Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.55/docs/scanner/secret#recommendation for faster secret detection2024-09-12T09:18:42Z INFO [terraformscanner] Scanning root module file_path="."2024-09-12T09:18:42Z WARN [terraformparser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.module="root"variables="networking"2024-09-12T09:18:43Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.bastion_linux.aws_s3_object.user_public_keys"value="cty.NilVal"2024-09-12T09:18:43Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.bastion_linux.data.aws_subnet.local_account"value="cty.NilVal"2024-09-12T09:18:43Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.bastion_linux.dynamic.tag"value="cty.NilVal"2024-09-12T09:18:43Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.bastion_linux.dynamic.tag"value="cty.NilVal"2024-09-12T09:18:43Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.bastion_linux.module.s3-bucket.dynamic.expiration"value="cty.NilVal"2024-09-12T09:18:43Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.bastion_linux.module.s3-bucket.dynamic.transition"value="cty.NilVal"2024-09-12T09:18:43Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.bastion_linux.module.s3-bucket.dynamic.noncurrent_version_expiration"value="cty.NilVal"2024-09-12T09:18:43Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.bastion_linux.module.s3-bucket.dynamic.noncurrent_version_transition"value="cty.NilVal"2024-09-12T09:18:43Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.bastion_linux.module.s3-bucket.dynamic.principals"value="cty.NilVal"2024-09-12T09:18:43Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.bastion_linux.module.s3-bucket.dynamic.condition"value="cty.NilVal"2024-09-12T09:18:43Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.bastion_linux.module.s3-bucket.dynamic.expiration"value="cty.NilVal"2024-09-12T09:18:43Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.bastion_linux.module.s3-bucket.dynamic.transition"value="cty.NilVal"2024-09-12T09:18:43Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.bastion_linux.module.s3-bucket.dynamic.noncurrent_version_expiration"value="cty.NilVal"2024-09-12T09:18:43Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.bastion_linux.module.s3-bucket.dynamic.noncurrent_version_transition"value="cty.NilVal"2024-09-12T09:18:43Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.bastion_linux.module.s3-bucket.dynamic.principals"value="cty.NilVal"2024-09-12T09:18:43Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.bastion_linux.module.s3-bucket.dynamic.condition"value="cty.NilVal"2024-09-12T09:18:44Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.vm-import.module.s3-bucket.dynamic.expiration"value="cty.NilVal"2024-09-12T09:18:44Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.vm-import.module.s3-bucket.dynamic.transition"value="cty.NilVal"2024-09-12T09:18:44Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.vm-import.module.s3-bucket.dynamic.noncurrent_version_expiration"value="cty.NilVal"2024-09-12T09:18:44Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.vm-import.module.s3-bucket.dynamic.noncurrent_version_transition"value="cty.NilVal"2024-09-12T09:18:44Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.vm-import.module.s3-bucket.dynamic.principals"value="cty.NilVal"2024-09-12T09:18:44Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.vm-import.module.s3-bucket.dynamic.condition"value="cty.NilVal"2024-09-12T09:18:44Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.vm-import.module.s3-bucket.dynamic.expiration"value="cty.NilVal"2024-09-12T09:18:44Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.vm-import.module.s3-bucket.dynamic.transition"value="cty.NilVal"2024-09-12T09:18:44Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.vm-import.module.s3-bucket.dynamic.noncurrent_version_expiration"value="cty.NilVal"2024-09-12T09:18:44Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.vm-import.module.s3-bucket.dynamic.noncurrent_version_transition"value="cty.NilVal"2024-09-12T09:18:44Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.vm-import.module.s3-bucket.dynamic.principals"value="cty.NilVal"2024-09-12T09:18:44Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.vm-import.module.s3-bucket.dynamic.condition"value="cty.NilVal"2024-09-12T09:18:44Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/main.tf:242-284"2024-09-12T09:18:44Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/main.tf:242-284"2024-09-12T09:18:44Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/main.tf:242-284"2024-09-12T09:18:44Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/main.tf:242-284"2024-09-12T09:18:44Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/main.tf:242-284"2024-09-12T09:18:44Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/main.tf:242-284"2024-09-12T09:18:44Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/main.tf:242-284"2024-09-12T09:18:44Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/main.tf:242-284"2024-09-12T09:18:44Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/main.tf:242-284"2024-09-12T09:18:44Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/main.tf:303-321"2024-09-12T09:18:44Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"2024-09-12T09:18:44Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"2024-09-12T09:18:44Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"2024-09-12T09:18:44Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"2024-09-12T09:18:44Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"2024-09-12T09:18:44Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"2024-09-12T09:18:44Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"2024-09-12T09:18:44Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"2024-09-12T09:18:44Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"2024-09-12T09:18:44Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"2024-09-12T09:18:44Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"2024-09-12T09:18:44Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/main.tf:303-321"2024-09-12T09:18:44Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"2024-09-12T09:18:44Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"2024-09-12T09:18:44Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"2024-09-12T09:18:44Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"2024-09-12T09:18:44Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"2024-09-12T09:18:44Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"2024-09-12T09:18:44Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"2024-09-12T09:18:44Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"2024-09-12T09:18:44Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"2024-09-12T09:18:44Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"2024-09-12T09:18:44Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"2024-09-12T09:18:44Z INFO [terraformexecutor] Ignore finding rule="aws-s3-enable-versioning"range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0/main.tf:8-19"2024-09-12T09:18:44Z INFO [terraformexecutor] Ignore finding rule="aws-s3-enable-versioning"range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=8688bc15a08fbf5a4f4eef9b7433c5a417df8df1/main.tf:8-19"2024-09-12T09:18:44Z INFO [terraformexecutor] Ignore finding rule="aws-s3-encryption-customer-key"range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0/main.tf:157-165"2024-09-12T09:18:44Z INFO [terraformexecutor] Ignore finding rule="aws-s3-encryption-customer-key"range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=8688bc15a08fbf5a4f4eef9b7433c5a417df8df1/main.tf:157-165"2024-09-12T09:18:44Z INFO [terraformexecutor] Ignore finding rule="aws-lambda-enable-tracing"range="lambda.tf:150-164"2024-09-12T09:18:44Z INFO [terraformexecutor] Ignore finding rule="aws-lambda-enable-tracing"range="lambda.tf:57-69"2024-09-12T09:18:44Z INFO [terraformexecutor] Ignore finding rule="aws-s3-enable-bucket-encryption"range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0/main.tf:8-19"2024-09-12T09:18:44Z INFO [terraformexecutor] Ignore finding rule="aws-s3-enable-bucket-encryption"range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=8688bc15a08fbf5a4f4eef9b7433c5a417df8df1/main.tf:8-19"2024-09-12T09:18:44Z INFO [npm] To collect the license information of packages, "npm install" needs to be performed beforehand dir="scripts/perf/node_modules"2024-09-12T09:18:44Z INFO Number of language-specific files num=12024-09-12T09:18:44Z INFO [npm] Detecting vulnerabilities...2024-09-12T09:18:44Z INFO Detected config files num=24
For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://aquasecurity.github.io/trivy/v0.55/docs/supply-chain/vex/repo#publishing-vex-documents
To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.
scripts/perf/package-lock.json (npm)
====================================
Total:2 (HIGH:2, CRITICAL:0)
┌──────────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────────┬──────────────────────────────────────────────────────────┐
│ Library │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │ Title │
├──────────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────┤
│ jsonwebtoken │ CVE-2022-23539 │ HIGH │ fixed │ 8.5.1 │ 9.0.0 │ jsonwebtoken: Unrestricted key type could lead to legacy │
│ │ │ │ │ │ │ keys usagen │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2022-23539 │
├──────────────┼────────────────┤ │ ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────┤
│ semver │ CVE-2022-25883 │ │ │ 5.7.1 │ 7.5.2, 6.3.1, 5.7.2 │ nodejs-semver: Regular expression denial of service │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2022-25883 │
└──────────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────────┴──────────────────────────────────────────────────────────┘
importmachine.tf (terraform)
============================
Tests:9 (SUCCESSES:5, FAILURES:4, EXCEPTIONS:0)
Failures:4 (HIGH:0, CRITICAL:4)
CRITICAL: Security group rule allows egress to multiple public internet addresses.
════════════════════════════════════════
Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.
See https://avd.aquasec.com/misconfig/avd-aws-0104
────────────────────────────────────────
importmachine.tf:29
via importmachine.tf:23-30 (egress)
via importmachine.tf:1-32 (aws_security_group.importmachine)
────────────────────────────────────────
1 resource"aws_security_group""importmachine" {
.29 [ ipv6_cidr_blocks = ["::/0"]
..32 }
────────────────────────────────────────
CRITICAL:Securitygroupruleallowsegresstomultiplepublicinternetaddresses.
════════════════════════════════════════
Openingupportstoconnectouttothepublicinternetisgenerallytobeavoided.YoushouldrestrictaccesstoIPaddressesorrangesthatareexplicitlyrequiredwherepossible.Seehttps://avd.aquasec.com/misconfig/avd-aws-0104
────────────────────────────────────────
importmachine.tf:28viaimportmachine.tf:23-30 (egress)
viaimportmachine.tf:1-32 (aws_security_group.importmachine)
────────────────────────────────────────
1resource"aws_security_group""importmachine" {
.
28 [ cidr_blocks = ["0.0.0.0/0"]
..
32 }
────────────────────────────────────────
CRITICAL:Securitygroupruleallowsingressfrompublicinternet.
════════════════════════════════════════
Openingupportstothepublicinternetisgenerallytobeavoided.YoushouldrestrictaccesstoIPaddressesorrangesthatexplicitlyrequireitwherepossible.Seehttps://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
importmachine.tf:20viaimportmachine.tf:14-21 (ingress)
viaimportmachine.tf:1-32 (aws_security_group.importmachine)
────────────────────────────────────────
1resource"aws_security_group""importmachine" {
.
20 [ ipv6_cidr_blocks = ["::/0"]
..
32 }
────────────────────────────────────────
CRITICAL:Securitygroupruleallowsingressfrompublicinternet.
════════════════════════════════════════
Openingupportstothepublicinternetisgenerallytobeavoided.YoushouldrestrictaccesstoIPaddressesorrangesthatexplicitlyrequireitwherepossible.Seehttps://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
importmachine.tf:19viaimportmachine.tf:14-21 (ingress)
viaimportmachine.tf:1-32 (aws_security_group.importmachine)
────────────────────────────────────────
1resource"aws_security_group""importmachine" {
.
19 [ cidr_blocks = ["0.0.0.0/0"]
..
32 }
────────────────────────────────────────
ingestion-load-balancer.tf (terraform)
======================================Tests:8 (SUCCESSES:2, FAILURES:6, EXCEPTIONS:0)
Failures:6 (HIGH:5, CRITICAL:1)
HIGH:Loadbalancerisexposedpublicly.
════════════════════════════════════════
Therearemanyscenariosinwhichyouwouldwanttoexposealoadbalancertothewiderinternet, butthischeckexistsasawarningtopreventaccidentalexposureofinternalassets.Youshouldensurethatthisresourceshouldbeexposedpublicly.Seehttps://avd.aquasec.com/misconfig/avd-aws-0053
────────────────────────────────────────
ingestion-load-balancer.tf:59viaingestion-load-balancer.tf:52-97 (aws_elb.ingestion_lb)
────────────────────────────────────────
52resource"aws_elb""ingestion_lb" {
..
59 [ internal =false
..
97 }
────────────────────────────────────────
HIGH:Nopublicaccessblocksonotblockingpublicacls
════════════════════════════════════════
S3bucketsshouldblockpublicACLsonbucketsandanyobjectstheycontain.Byblocking, PUTswithfailiftheobjecthasanypublicACLa.Seehttps://avd.aquasec.com/misconfig/avd-aws-0086
────────────────────────────────────────
ingestion-load-balancer.tf:104-107
────────────────────────────────────────
104 ┌ resource"aws_s3_bucket""ingestion_loadbalancer_logs" {
105 │ bucket ="${var.networking[0].application}.${var.networking[0].business-unit}-${local.environment}-ingestion-lblogs"106 │ force_destroy =true107 └ }
────────────────────────────────────────
HIGH:Nopublicaccessblocksonotblockingpublicpolicies
════════════════════════════════════════
S3bucketpolicyshouldhaveblockpublicpolicytopreventusersfromputtingapolicythatenablepublicaccess.Seehttps://avd.aquasec.com/misconfig/avd-aws-0087
────────────────────────────────────────
ingestion-load-balancer.tf:104-107
────────────────────────────────────────
104 ┌ resource"aws_s3_bucket""ingestion_loadbalancer_logs" {
105 │ bucket ="${var.networking[0].application}.${var.networking[0].business-unit}-${local.environment}-ingestion-lblogs"106 │ force_destroy =true107 └ }
────────────────────────────────────────
HIGH:Nopublicaccessblocksonotignoringpublicacls
════════════════════════════════════════
S3bucketsshouldignorepublicACLsonbucketsandanyobjectstheycontain.Byignoringratherthanblocking, PUTcallswithpublicACLswillstillbeappliedbuttheACLwillbeignored.Seehttps://avd.aquasec.com/misconfig/avd-aws-0091
────────────────────────────────────────
ingestion-load-balancer.tf:104-107
────────────────────────────────────────
104 ┌ resource"aws_s3_bucket""ingestion_loadbalancer_logs" {
105 │ bucket ="${var.networking[0].application}.${var.networking[0].business-unit}-${local.environment}-ingestion-lblogs"106 │ force_destroy =true107 └ }
────────────────────────────────────────
HIGH:Nopublicaccessblocksonotrestrictingpublicbuckets
════════════════════════════════════════
S3bucketsshouldrestrictpublicpoliciesforthebucket.Byenabling, therestrict_public_buckets, onlythebucketownerandAWSServicescanaccessifithasapublicpolicy.Seehttps://avd.aquasec.com/misconfig/avd-aws-0093
────────────────────────────────────────
ingestion-load-balancer.tf:104-107
────────────────────────────────────────
104 ┌ resource"aws_s3_bucket""ingestion_loadbalancer_logs" {
105 │ bucket ="${var.networking[0].application}.${var.networking[0].business-unit}-${local.environment}-ingestion-lblogs"106 │ force_destroy =true107 └ }
────────────────────────────────────────
CRITICAL:Securitygroupruleallowsingressfrompublicinternet.
════════════════════════════════════════
Openingupportstothepublicinternetisgenerallytobeavoided.YoushouldrestrictaccesstoIPaddressesorrangesthatexplicitlyrequireitwherepossible.Seehttps://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
ingestion-load-balancer.tf:26-36viaingestion-load-balancer.tf:18-40 (aws_security_group_rule.ingestion_lb_allow_web_users)
────────────────────────────────────────
18resource"aws_security_group_rule""ingestion_lb_allow_web_users" {
..
26 ┌ cidr_blocks = [
27 │ "10.182.60.51/32", # NLE CGI proxy 28 │ "195.59.75.151/32", # New proxy IPs from Prashanth for testing ingestion NLE DEV29 │ "195.59.75.152/32", # New proxy IPs from Prashanth for testing ingestion NLE DEV30 │ "194.33.192.0/24", # New proxy IPs from Prashanth for testing ingestion LE PROD31 │ "194.33.196.0/24", # New proxy IPs from Prashanth for testing ingestion LE PROD32 └ "194.33.248.0/24", # New proxy IPs from Prashanth for testing ingestion LE PROD
..
────────────────────────────────────────
network-infrastructure.tf (terraform)
=====================================
Tests:64 (SUCCESSES:54, FAILURES:10, EXCEPTIONS:0)
Failures:10 (HIGH:0, CRITICAL:10)
CRITICAL: Security group rule allows egress to multiple public internet addresses.
════════════════════════════════════════
Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.
See https://avd.aquasec.com/misconfig/avd-aws-0104
────────────────────────────────────────
network-infrastructure.tf:129
via network-infrastructure.tf:120-130 (aws_security_group_rule.exchange-outbound-all)
────────────────────────────────────────
120 resource "aws_security_group_rule""exchange-outbound-all" {
121 depends_on = [aws_security_group.exchange_server]
122 security_group_id = aws_security_group.exchange_server.id
123 type ="egress"124 description ="allow all"125 from_port =0126 to_port =0127 protocol ="-1"128 cidr_blocks = ["0.0.0.0/0"]
...
────────────────────────────────────────
CRITICAL: Security group rule allows egress to multiple public internet addresses.
════════════════════════════════════════
Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.
See https://avd.aquasec.com/misconfig/avd-aws-0104
────────────────────────────────────────
network-infrastructure.tf:128
via network-infrastructure.tf:120-130 (aws_security_group_rule.exchange-outbound-all)
────────────────────────────────────────
120 resource "aws_security_group_rule""exchange-outbound-all" {
121 depends_on = [aws_security_group.exchange_server]
122 security_group_id = aws_security_group.exchange_server.id
123 type ="egress"124 description ="allow all"125 from_port =0126 to_port =0127 protocol ="-1"128 [ cidr_blocks = ["0.0.0.0/0"]
...
────────────────────────────────────────
CRITICAL: Security group rule allows egress to multiple public internet addresses.
════════════════════════════════════════
Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.
See https://avd.aquasec.com/misconfig/avd-aws-0104
────────────────────────────────────────
network-infrastructure.tf:694
via network-infrastructure.tf:685-695 (aws_security_group_rule.iisrelay-outbound-all)
────────────────────────────────────────
685 resource "aws_security_group_rule""iisrelay-outbound-all" {
686 depends_on = [aws_security_group.iisrelay_server]
687 security_group_id = aws_security_group.iisrelay_server.id
688 type ="egress"689 description ="allow all"690 from_port =0691 to_port =0692 protocol ="-1"693 cidr_blocks = ["0.0.0.0/0"]
...
────────────────────────────────────────
CRITICAL: Security group rule allows egress to multiple public internet addresses.
════════════════════════════════════════
Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.
See https://avd.aquasec.com/misconfig/avd-aws-0104
────────────────────────────────────────
network-infrastructure.tf:693
via network-infrastructure.tf:685-695 (aws_security_group_rule.iisrelay-outbound-all)
────────────────────────────────────────
685 resource "aws_security_group_rule""iisrelay-outbound-all" {
686 depends_on = [aws_security_group.iisrelay_server]
687 security_group_id = aws_security_group.iisrelay_server.id
688 type ="egress"689 description ="allow all"690 from_port =0691 to_port =0692 protocol ="-1"693 [ cidr_blocks = ["0.0.0.0/0"]
...
────────────────────────────────────────
CRITICAL: Security group rule allows egress to multiple public internet addresses.
════════════════════════════════════════
Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.
See https://avd.aquasec.com/misconfig/avd-aws-0104
────────────────────────────────────────
network-infrastructure.tf:207
via network-infrastructure.tf:199-208 (aws_security_group_rule.sms-outbound-all-ipv4)
────────────────────────────────────────
199 resource "aws_security_group_rule""sms-outbound-all-ipv4" {
200 depends_on = [aws_security_group.sms_server]
201 security_group_id = aws_security_group.sms_server.id
202 type ="egress"203 description ="allow all ipv4"204 from_port =0205 to_port =0206 protocol ="-1"207 [ cidr_blocks = ["0.0.0.0/0"]
208 }
────────────────────────────────────────
CRITICAL: Security group rule allows egress to multiple public internet addresses.
════════════════════════════════════════
Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.
See https://avd.aquasec.com/misconfig/avd-aws-0104
────────────────────────────────────────
network-infrastructure.tf:218
via network-infrastructure.tf:210-219 (aws_security_group_rule.sms-outbound-all-ipv6)
────────────────────────────────────────
210 resource "aws_security_group_rule""sms-outbound-all-ipv6" {
211 depends_on = [aws_security_group.sms_server]
212 security_group_id = aws_security_group.sms_server.id
213 type ="egress"214 description ="allow all ipv6"215 from_port =0216 to_port =0217 protocol ="-1"218 [ ipv6_cidr_blocks = ["::/0"]
219 }
────────────────────────────────────────
CRITICAL: Security group rule allows ingress from public internet.
════════════════════════════════════════
Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.
See https://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
network-infrastructure.tf:297
via network-infrastructure.tf:288-298 (aws_security_group_rule.prtg_lb_allow_web_users)
────────────────────────────────────────
288 resource "aws_security_group_rule""prtg_lb_allow_web_users" {
289 depends_on = [aws_security_group.prtg_lb]
290 security_group_id = aws_security_group.prtg_lb.id
291 type ="ingress"292 description ="allow web traffic to get to prtg Load Balancer over SSL "293 from_port =443294 to_port =443295 protocol ="TCP"296 cidr_blocks = ["0.0.0.0/0"]
...
────────────────────────────────────────
CRITICAL: Security group rule allows ingress from public internet.
════════════════════════════════════════
Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.
See https://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
network-infrastructure.tf:296
via network-infrastructure.tf:288-298 (aws_security_group_rule.prtg_lb_allow_web_users)
────────────────────────────────────────
288 resource "aws_security_group_rule""prtg_lb_allow_web_users" {
289 depends_on = [aws_security_group.prtg_lb]
290 security_group_id = aws_security_group.prtg_lb.id
291 type ="ingress"292 description ="allow web traffic to get to prtg Load Balancer over SSL "293 from_port =443294 to_port =443295 protocol ="TCP"296 [ cidr_blocks = ["0.0.0.0/0"]
...
────────────────────────────────────────
CRITICAL: Security group rule allows ingress from public internet.
════════════════════════════════════════
Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.
See https://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
network-infrastructure.tf:285
via network-infrastructure.tf:276-286 (aws_security_group_rule.waf_lb_allow_web_users)
────────────────────────────────────────
276 resource "aws_security_group_rule""waf_lb_allow_web_users" {
277 depends_on = [aws_security_group.waf_lb]
278 security_group_id = aws_security_group.waf_lb.id
279 type ="ingress"280 description ="allow web traffic to get to ingestion server"281 from_port =443282 to_port =443283 protocol ="TCP"284 cidr_blocks = ["0.0.0.0/0"]
...
────────────────────────────────────────
CRITICAL: Security group rule allows ingress from public internet.
════════════════════════════════════════
Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.
See https://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
network-infrastructure.tf:284
via network-infrastructure.tf:276-286 (aws_security_group_rule.waf_lb_allow_web_users)
────────────────────────────────────────
276 resource "aws_security_group_rule""waf_lb_allow_web_users" {
277 depends_on = [aws_security_group.waf_lb]
278 security_group_id = aws_security_group.waf_lb.id
279 type ="ingress"280 description ="allow web traffic to get to ingestion server"281 from_port =443282 to_port =443283 protocol ="TCP"284 [ cidr_blocks = ["0.0.0.0/0"]
...
────────────────────────────────────────
prtg-load-balancer.tf (terraform)
=================================
Tests:11 (SUCCESSES:4, FAILURES:7, EXCEPTIONS:0)
Failures:7 (HIGH:6, CRITICAL:1)
CRITICAL: Listener uses an outdated TLS policy.
════════════════════════════════════════
You should not use outdated/insecure TLS versions forencryption.YoushouldbeusingTLSv1.2+.
See https://avd.aquasec.com/misconfig/avd-aws-0047
────────────────────────────────────────
prtg-load-balancer.tf:82
via prtg-load-balancer.tf:73-90 (aws_lb_listener.prtg_lb_listener)
────────────────────────────────────────
73 resource "aws_lb_listener""prtg_lb_listener" {
..
82 [ ssl_policy ="ELBSecurityPolicy-2016-08"
..
90 }
────────────────────────────────────────
HIGH: Application load balancer is not set to drop invalid headers.
════════════════════════════════════════
Passing unknown or invalid headers through to the target poses a potential risk of compromise.
By setting drop_invalid_header_fields to true, anything that doe not conform to well known, defined headers will be removed by the load balancer.
See https://avd.aquasec.com/misconfig/avd-aws-0052
────────────────────────────────────────
prtg-load-balancer.tf:12-37
────────────────────────────────────────
12 ┌ resource "aws_lb""prtg_lb" {
13 │
14 │ depends_on = [
15 │ aws_security_group.prtg_lb,
16 │ ]
17 │
18 │ name ="prtg-lb-${var.networking[0].application}"19 │ internal =false20 └ load_balancer_type ="application"
..
────────────────────────────────────────
HIGH: Load balancer is exposed publicly.
════════════════════════════════════════
There are many scenarios in which you would want to expose a load balancer to the wider internet, but this check exists as a warning to prevent accidental exposure of internal assets. You should ensure that this resource should be exposed publicly.
See https://avd.aquasec.com/misconfig/avd-aws-0053
────────────────────────────────────────
prtg-load-balancer.tf:19
via prtg-load-balancer.tf:12-37 (aws_lb.prtg_lb)
────────────────────────────────────────
12 resource "aws_lb""prtg_lb" {
..
19 [ internal =false
..
37 }
────────────────────────────────────────
HIGH: No public access block so not blocking public acls
════════════════════════════════════════
S3 buckets should block public ACLs on buckets and any objects they contain. By blocking, PUTs with fail iftheobjecthasanypublicACLa.
See https://avd.aquasec.com/misconfig/avd-aws-0086
────────────────────────────────────────
prtg-load-balancer.tf:212-216
────────────────────────────────────────
212 ┌ resource "aws_s3_bucket""prtg_logs" {
213 │ count = local.is-production ?0:1214 │ bucket ="aws-waf-logs-prtg-${var.networking[0].application}.${var.networking[0].business-unit}-${local.environment}"215 │ force_destroy =true216 └ }
────────────────────────────────────────
HIGH: No public access block so not blocking public policies
════════════════════════════════════════
S3 bucket policy should have block public policy to prevent users from putting a policy that enable public access.
See https://avd.aquasec.com/misconfig/avd-aws-0087
────────────────────────────────────────
prtg-load-balancer.tf:212-216
────────────────────────────────────────
212 ┌ resource "aws_s3_bucket""prtg_logs" {
213 │ count = local.is-production ?0:1214 │ bucket ="aws-waf-logs-prtg-${var.networking[0].application}.${var.networking[0].business-unit}-${local.environment}"215 │ force_destroy =true216 └ }
────────────────────────────────────────
HIGH: No public access block so not ignoring public acls
════════════════════════════════════════
S3 buckets should ignore public ACLs on buckets and any objects they contain. By ignoring rather than blocking, PUT calls with public ACLs will still be applied but the ACL will be ignored.
See https://avd.aquasec.com/misconfig/avd-aws-0091
────────────────────────────────────────
prtg-load-balancer.tf:212-216
────────────────────────────────────────
212 ┌ resource "aws_s3_bucket""prtg_logs" {
213 │ count = local.is-production ?0:1214 │ bucket ="aws-waf-logs-prtg-${var.networking[0].application}.${var.networking[0].business-unit}-${local.environment}"215 │ force_destroy =true216 └ }
────────────────────────────────────────
HIGH: No public access block so not restricting public buckets
════════════════════════════════════════
S3 buckets should restrict public policies forthebucket.Byenabling, therestrict_public_buckets, onlythebucketownerandAWSServicescanaccessifithasapublicpolicy.
See https://avd.aquasec.com/misconfig/avd-aws-0093
────────────────────────────────────────
prtg-load-balancer.tf:212-216
────────────────────────────────────────
212 ┌ resource "aws_s3_bucket""prtg_logs" {
213 │ count = local.is-production ?0:1214 │ bucket ="aws-waf-logs-prtg-${var.networking[0].application}.${var.networking[0].business-unit}-${local.environment}"215 │ force_destroy =true216 └ }
────────────────────────────────────────
waf-load-balancer.tf (terraform)
================================
Tests:18 (SUCCESSES:7, FAILURES:11, EXCEPTIONS:0)
Failures:11 (HIGH:10, CRITICAL:1)
CRITICAL: Listener uses an outdated TLS policy.
════════════════════════════════════════
You should not use outdated/insecure TLS versions forencryption.YoushouldbeusingTLSv1.2+.
See https://avd.aquasec.com/misconfig/avd-aws-0047
────────────────────────────────────────
waf-load-balancer.tf:96
via waf-load-balancer.tf:87-104 (aws_lb_listener.waf_lb_listener)
────────────────────────────────────────
87 resource "aws_lb_listener""waf_lb_listener" {
..
96 [ ssl_policy ="ELBSecurityPolicy-2016-08"...104 }
────────────────────────────────────────
HIGH: Application load balancer is not set to drop invalid headers.
════════════════════════════════════════
Passing unknown or invalid headers through to the target poses a potential risk of compromise.
By setting drop_invalid_header_fields to true, anything that doe not conform to well known, defined headers will be removed by the load balancer.
See https://avd.aquasec.com/misconfig/avd-aws-0052
────────────────────────────────────────
waf-load-balancer.tf:27-52
────────────────────────────────────────
27 ┌ resource "aws_lb""waf_lb" {
28 │
29 │ depends_on = [
30 │ aws_security_group.waf_lb,
31 │ ]
32 │
33 │ name ="waf-lb-${var.networking[0].application}"34 │ internal =false35 └ load_balancer_type ="application"
..
────────────────────────────────────────
HIGH: Load balancer is exposed publicly.
════════════════════════════════════════
There are many scenarios in which you would want to expose a load balancer to the wider internet, but this check exists as a warning to prevent accidental exposure of internal assets. You should ensure that this resource should be exposed publicly.
See https://avd.aquasec.com/misconfig/avd-aws-0053
────────────────────────────────────────
waf-load-balancer.tf:34
via waf-load-balancer.tf:27-52 (aws_lb.waf_lb)
────────────────────────────────────────
27 resource "aws_lb""waf_lb" {
..
34 [ internal =false
..
52 }
────────────────────────────────────────
HIGH: No public access block so not blocking public acls
════════════════════════════════════════
S3 buckets should block public ACLs on buckets and any objects they contain. By blocking, PUTs with fail iftheobjecthasanypublicACLa.
See https://avd.aquasec.com/misconfig/avd-aws-0086
────────────────────────────────────────
waf-load-balancer.tf:298-301
────────────────────────────────────────
298 ┌ resource "aws_s3_bucket""loadbalancer_logs" {
299 │ bucket ="${var.networking[0].application}.${var.networking[0].business-unit}-${local.environment}-lblogs"300 │ force_destroy =true301 └ }
────────────────────────────────────────
HIGH: No public access block so not blocking public acls
════════════════════════════════════════
S3 buckets should block public ACLs on buckets and any objects they contain. By blocking, PUTs with fail iftheobjecthasanypublicACLa.
See https://avd.aquasec.com/misconfig/avd-aws-0086
────────────────────────────────────────
waf-load-balancer.tf:393-397
────────────────────────────────────────
393 ┌ resource "aws_s3_bucket""waf_logs" {
394 │ count = local.is-production ?0:1395 │ bucket ="aws-waf-logs-${var.networking[0].application}.${var.networking[0].business-unit}-${local.environment}"396 │ force_destroy =true397 └ }
────────────────────────────────────────
HIGH: No public access block so not blocking public policies
════════════════════════════════════════
S3 bucket policy should have block public policy to prevent users from putting a policy that enable public access.
See https://avd.aquasec.com/misconfig/avd-aws-0087
────────────────────────────────────────
waf-load-balancer.tf:298-301
────────────────────────────────────────
298 ┌ resource "aws_s3_bucket""loadbalancer_logs" {
299 │ bucket ="${var.networking[0].application}.${var.networking[0].business-unit}-${local.environment}-lblogs"300 │ force_destroy =true301 └ }
────────────────────────────────────────
HIGH: No public access block so not blocking public policies
════════════════════════════════════════
S3 bucket policy should have block public policy to prevent users from putting a policy that enable public access.
See https://avd.aquasec.com/misconfig/avd-aws-0087
────────────────────────────────────────
waf-load-balancer.tf:393-397
────────────────────────────────────────
393 ┌ resource "aws_s3_bucket""waf_logs" {
394 │ count = local.is-production ?0:1395 │ bucket ="aws-waf-logs-${var.networking[0].application}.${var.networking[0].business-unit}-${local.environment}"396 │ force_destroy =true397 └ }
────────────────────────────────────────
HIGH: No public access block so not ignoring public acls
════════════════════════════════════════
S3 buckets should ignore public ACLs on buckets and any objects they contain. By ignoring rather than blocking, PUT calls with public ACLs will still be applied but the ACL will be ignored.
See https://avd.aquasec.com/misconfig/avd-aws-0091
────────────────────────────────────────
waf-load-balancer.tf:298-301
────────────────────────────────────────
298 ┌ resource "aws_s3_bucket""loadbalancer_logs" {
299 │ bucket ="${var.networking[0].application}.${var.networking[0].business-unit}-${local.environment}-lblogs"300 │ force_destroy =true301 └ }
────────────────────────────────────────
HIGH: No public access block so not ignoring public acls
════════════════════════════════════════
S3 buckets should ignore public ACLs on buckets and any objects they contain. By ignoring rather than blocking, PUT calls with public ACLs will still be applied but the ACL will be ignored.
See https://avd.aquasec.com/misconfig/avd-aws-0091
────────────────────────────────────────
waf-load-balancer.tf:393-397
────────────────────────────────────────
393 ┌ resource "aws_s3_bucket""waf_logs" {
394 │ count = local.is-production ?0:1395 │ bucket ="aws-waf-logs-${var.networking[0].application}.${var.networking[0].business-unit}-${local.environment}"396 │ force_destroy =true397 └ }
────────────────────────────────────────
HIGH: No public access block so not restricting public buckets
════════════════════════════════════════
S3 buckets should restrict public policies forthebucket.Byenabling, therestrict_public_buckets, onlythebucketownerandAWSServicescanaccessifithasapublicpolicy.
See https://avd.aquasec.com/misconfig/avd-aws-0093
────────────────────────────────────────
waf-load-balancer.tf:298-301
────────────────────────────────────────
298 ┌ resource "aws_s3_bucket""loadbalancer_logs" {
299 │ bucket ="${var.networking[0].application}.${var.networking[0].business-unit}-${local.environment}-lblogs"300 │ force_destroy =true301 └ }
────────────────────────────────────────
HIGH: No public access block so not restricting public buckets
════════════════════════════════════════
S3 buckets should restrict public policies forthebucket.Byenabling, therestrict_public_buckets, onlythebucketownerandAWSServicescanaccessifithasapublicpolicy.
See https://avd.aquasec.com/misconfig/avd-aws-0093
────────────────────────────────────────
waf-load-balancer.tf:393-397
────────────────────────────────────────
393 ┌ resource "aws_s3_bucket""waf_logs" {
394 │ count = local.is-production ?0:1395 │ bucket ="aws-waf-logs-${var.networking[0].application}.${var.networking[0].business-unit}-${local.environment}"396 │ force_destroy =true397 └ }
────────────────────────────────────────
trivy_exitcode=1
</details> #### `Checkov Scan` Success
<details><summary>Show Output</summary>
```hcl
*****************************
Checkov will check the following folders:
CTFLint Scan Success
Show Output
*****************************
Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version:0.5.0)
tflint will check the following folders:
Trivy Scan Success
Show Output
*****************************
Trivy will check the following folders:
Trivy will check the following folders:
terraform/environments/xhibit-portal
Running Trivy in terraform/environments/xhibit-portal
2024-09-17T15:09:28Z INFO [db] Need to update DB
2024-09-17T15:09:28Z INFO [db] Downloading DB... repository="ghcr.io/aquasecurity/trivy-db:2"
2024-09-17T15:09:31Z INFO [vuln] Vulnerability scanning is enabled
2024-09-17T15:09:31Z INFO [misconfig] Misconfiguration scanning is enabled
2024-09-17T15:09:31Z INFO Need to update the built-in policies
2024-09-17T15:09:31Z INFO Downloading the built-in policies...
74.86 KiB / 74.86 KiB [-----------------------------------------------------------] 100.00% ? p/s 0s2024-09-17T15:09:31Z INFO [secret] Secret scanning is enabled
2024-09-17T15:09:31Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-09-17T15:09:31Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.55/docs/scanner/secret#recommendation for faster secret detection
2024-09-17T15:09:31Z INFO [npm] To collect the license information of packages, "npm install" needs to be performed beforehand dir="scripts/perf/node_modules"
2024-09-17T15:09:32Z INFO [terraform scanner] Scanning root module file_path="."
2024-09-17T15:09:32Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="networking"
2024-09-17T15:09:34Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.bastion_linux.aws_s3_object.user_public_keys" value="cty.NilVal"
2024-09-17T15:09:34Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.bastion_linux.data.aws_subnet.local_account" value="cty.NilVal"
2024-09-17T15:09:34Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.bastion_linux.dynamic.tag" value="cty.NilVal"
2024-09-17T15:09:34Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.bastion_linux.dynamic.tag" value="cty.NilVal"
2024-09-17T15:09:34Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.bastion_linux.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-09-17T15:09:34Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.bastion_linux.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-09-17T15:09:34Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.bastion_linux.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-09-17T15:09:34Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.bastion_linux.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-09-17T15:09:34Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.bastion_linux.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-09-17T15:09:34Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.bastion_linux.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-09-17T15:09:34Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.bastion_linux.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-09-17T15:09:34Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.bastion_linux.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-09-17T15:09:34Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.bastion_linux.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-09-17T15:09:34Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.bastion_linux.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-09-17T15:09:34Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.bastion_linux.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-09-17T15:09:34Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.bastion_linux.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-09-17T15:09:35Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.vm-import.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-09-17T15:09:35Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.vm-import.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-09-17T15:09:35Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.vm-import.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-09-17T15:09:35Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.vm-import.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-09-17T15:09:35Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.vm-import.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-09-17T15:09:35Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.vm-import.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-09-17T15:09:35Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.vm-import.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-09-17T15:09:35Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.vm-import.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-09-17T15:09:35Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.vm-import.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-09-17T15:09:35Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.vm-import.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-09-17T15:09:35Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.vm-import.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-09-17T15:09:35Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.vm-import.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-09-17T15:09:35Z INFO [terraform executor] Ignore finding rule="aws-lambda-enable-tracing" range="lambda.tf:150-164"
2024-09-17T15:09:35Z INFO [terraform executor] Ignore finding rule="aws-lambda-enable-tracing" range="lambda.tf:57-69"
2024-09-17T15:09:35Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-bucket-encryption" range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=8688bc15a08fbf5a4f4eef9b7433c5a417df8df1/main.tf:8-19"
2024-09-17T15:09:35Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-bucket-encryption" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0/main.tf:8-19"
2024-09-17T15:09:35Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-versioning" range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=8688bc15a08fbf5a4f4eef9b7433c5a417df8df1/main.tf:8-19"
2024-09-17T15:09:35Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-versioning" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0/main.tf:8-19"
2024-09-17T15:09:35Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=8688bc15a08fbf5a4f4eef9b7433c5a417df8df1/main.tf:157-165"
2024-09-17T15:09:35Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0/main.tf:157-165"
2024-09-17T15:09:35Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/main.tf:242-284"
2024-09-17T15:09:35Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/main.tf:242-284"
2024-09-17T15:09:35Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/main.tf:242-284"
2024-09-17T15:09:35Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/main.tf:242-284"
2024-09-17T15:09:35Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/main.tf:242-284"
2024-09-17T15:09:35Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/main.tf:242-284"
2024-09-17T15:09:35Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/main.tf:242-284"
2024-09-17T15:09:35Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/main.tf:242-284"
2024-09-17T15:09:35Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/main.tf:242-284"
2024-09-17T15:09:35Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/main.tf:303-321"
2024-09-17T15:09:35Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"
2024-09-17T15:09:35Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"
2024-09-17T15:09:35Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"
2024-09-17T15:09:35Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"
2024-09-17T15:09:35Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"
2024-09-17T15:09:35Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"
2024-09-17T15:09:35Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"
2024-09-17T15:09:35Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"
2024-09-17T15:09:35Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"
2024-09-17T15:09:35Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"
2024-09-17T15:09:35Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"
2024-09-17T15:09:35Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/main.tf:303-321"
2024-09-17T15:09:35Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"
2024-09-17T15:09:35Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"
2024-09-17T15:09:35Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"
2024-09-17T15:09:35Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"
2024-09-17T15:09:35Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"
2024-09-17T15:09:35Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"
2024-09-17T15:09:35Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"
2024-09-17T15:09:35Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"
2024-09-17T15:09:35Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"
2024-09-17T15:09:35Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"
2024-09-17T15:09:35Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"
2024-09-17T15:09:35Z INFO Number of language-specific files num=1
2024-09-17T15:09:35Z INFO [npm] Detecting vulnerabilities...
2024-09-17T15:09:35Z INFO Detected config files num=24
For OSS Maintainers: VEX Notice
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://aquasecurity.github.io/trivy/v0.55/docs/supply-chain/vex/repo#publishing-vex-documents
To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.
scripts/perf/package-lock.json (npm)
Total: 2 (HIGH: 2, CRITICAL: 0)
┌──────────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────────┬──────────────────────────────────────────────────────────┐
│ Library │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │ Title │
├──────────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────┤
│ jsonwebtoken │ CVE-2022-23539 │ HIGH │ fixed │ 8.5.1 │ 9.0.0 │ jsonwebtoken: Unrestricted key type could lead to legacy │
│ │ │ │ │ │ │ keys usagen │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2022-23539 │
├──────────────┼────────────────┤ │ ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────┤
│ semver │ CVE-2022-25883 │ │ │ 5.7.1 │ 7.5.2, 6.3.1, 5.7.2 │ nodejs-semver: Regular expression denial of service │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2022-25883 │
└──────────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────────┴──────────────────────────────────────────────────────────┘
CRITICAL: Security group rule allows egress to multiple public internet addresses.
════════════════════════════════════════
Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.
See https://avd.aquasec.com/misconfig/avd-aws-0104
────────────────────────────────────────
importmachine.tf:29
via importmachine.tf:23-30 (egress)
via importmachine.tf:1-32 (aws_security_group.importmachine)
────────────────────────────────────────
1 resource "aws_security_group" "importmachine" {
.
29 [ ipv6_cidr_blocks = ["::/0"]
..
32 }
────────────────────────────────────────
CRITICAL: Security group rule allows egress to multiple public internet addresses.
════════════════════════════════════════
Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.
See https://avd.aquasec.com/misconfig/avd-aws-0104
────────────────────────────────────────
importmachine.tf:28
via importmachine.tf:23-30 (egress)
via importmachine.tf:1-32 (aws_security_group.importmachine)
────────────────────────────────────────
1 resource "aws_security_group" "importmachine" {
.
28 [ cidr_blocks = ["0.0.0.0/0"]
..
32 }
────────────────────────────────────────
CRITICAL: Security group rule allows ingress from public internet.
════════════════════════════════════════
Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.
See https://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
importmachine.tf:20
via importmachine.tf:14-21 (ingress)
via importmachine.tf:1-32 (aws_security_group.importmachine)
────────────────────────────────────────
1 resource "aws_security_group" "importmachine" {
.
20 [ ipv6_cidr_blocks = ["::/0"]
..
32 }
────────────────────────────────────────
CRITICAL: Security group rule allows ingress from public internet.
════════════════════════════════════════
Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.
See https://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
importmachine.tf:19
via importmachine.tf:14-21 (ingress)
via importmachine.tf:1-32 (aws_security_group.importmachine)
────────────────────────────────────────
1 resource "aws_security_group" "importmachine" {
.
19 [ cidr_blocks = ["0.0.0.0/0"]
..
32 }
────────────────────────────────────────
HIGH: Load balancer is exposed publicly.
════════════════════════════════════════
There are many scenarios in which you would want to expose a load balancer to the wider internet, but this check exists as a warning to prevent accidental exposure of internal assets. You should ensure that this resource should be exposed publicly.
HIGH: No public access block so not ignoring public acls
════════════════════════════════════════
S3 buckets should ignore public ACLs on buckets and any objects they contain. By ignoring rather than blocking, PUT calls with public ACLs will still be applied but the ACL will be ignored.
HIGH: No public access block so not restricting public buckets
════════════════════════════════════════
S3 buckets should restrict public policies for the bucket. By enabling, the restrict_public_buckets, only the bucket owner and AWS Services can access if it has a public policy.
CRITICAL: Security group rule allows ingress from public internet.
════════════════════════════════════════
Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.
See https://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
ingestion-load-balancer.tf:26-36
via ingestion-load-balancer.tf:18-40 (aws_security_group_rule.ingestion_lb_allow_web_users)
────────────────────────────────────────
18 resource "aws_security_group_rule" "ingestion_lb_allow_web_users" {
..
26 ┌ cidr_blocks = [
27 │ "10.182.60.51/32", # NLE CGI proxy
28 │ "195.59.75.151/32", # New proxy IPs from Prashanth for testing ingestion NLE DEV
29 │ "195.59.75.152/32", # New proxy IPs from Prashanth for testing ingestion NLE DEV
30 │ "194.33.192.0/24", # New proxy IPs from Prashanth for testing ingestion LE PROD
31 │ "194.33.196.0/24", # New proxy IPs from Prashanth for testing ingestion LE PROD
32 └ "194.33.248.0/24", # New proxy IPs from Prashanth for testing ingestion LE PROD
..
────────────────────────────────────────
CRITICAL: Security group rule allows egress to multiple public internet addresses.
════════════════════════════════════════
Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.
CRITICAL: Security group rule allows egress to multiple public internet addresses.
════════════════════════════════════════
Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.
CRITICAL: Security group rule allows egress to multiple public internet addresses.
════════════════════════════════════════
Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.
CRITICAL: Security group rule allows egress to multiple public internet addresses.
════════════════════════════════════════
Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.
CRITICAL: Security group rule allows egress to multiple public internet addresses.
════════════════════════════════════════
Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.
CRITICAL: Security group rule allows egress to multiple public internet addresses.
════════════════════════════════════════
Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.
CRITICAL: Security group rule allows ingress from public internet.
════════════════════════════════════════
Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.
See https://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
network-infrastructure.tf:297
via network-infrastructure.tf:288-298 (aws_security_group_rule.prtg_lb_allow_web_users)
────────────────────────────────────────
288 resource "aws_security_group_rule" "prtg_lb_allow_web_users" {
289 depends_on = [aws_security_group.prtg_lb]
290 security_group_id = aws_security_group.prtg_lb.id
291 type = "ingress"
292 description = "allow web traffic to get to prtg Load Balancer over SSL "
293 from_port = 443
294 to_port = 443
295 protocol = "TCP"
296 cidr_blocks = ["0.0.0.0/0"]
...
────────────────────────────────────────
CRITICAL: Security group rule allows ingress from public internet.
════════════════════════════════════════
Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.
See https://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
network-infrastructure.tf:296
via network-infrastructure.tf:288-298 (aws_security_group_rule.prtg_lb_allow_web_users)
────────────────────────────────────────
288 resource "aws_security_group_rule" "prtg_lb_allow_web_users" {
289 depends_on = [aws_security_group.prtg_lb]
290 security_group_id = aws_security_group.prtg_lb.id
291 type = "ingress"
292 description = "allow web traffic to get to prtg Load Balancer over SSL "
293 from_port = 443
294 to_port = 443
295 protocol = "TCP"
296 [ cidr_blocks = ["0.0.0.0/0"]
...
────────────────────────────────────────
CRITICAL: Security group rule allows ingress from public internet.
════════════════════════════════════════
Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.
See https://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
network-infrastructure.tf:285
via network-infrastructure.tf:276-286 (aws_security_group_rule.waf_lb_allow_web_users)
────────────────────────────────────────
276 resource "aws_security_group_rule" "waf_lb_allow_web_users" {
277 depends_on = [aws_security_group.waf_lb]
278 security_group_id = aws_security_group.waf_lb.id
279 type = "ingress"
280 description = "allow web traffic to get to ingestion server"
281 from_port = 443
282 to_port = 443
283 protocol = "TCP"
284 cidr_blocks = ["0.0.0.0/0"]
...
────────────────────────────────────────
CRITICAL: Security group rule allows ingress from public internet.
════════════════════════════════════════
Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.
See https://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
network-infrastructure.tf:284
via network-infrastructure.tf:276-286 (aws_security_group_rule.waf_lb_allow_web_users)
────────────────────────────────────────
276 resource "aws_security_group_rule" "waf_lb_allow_web_users" {
277 depends_on = [aws_security_group.waf_lb]
278 security_group_id = aws_security_group.waf_lb.id
279 type = "ingress"
280 description = "allow web traffic to get to ingestion server"
281 from_port = 443
282 to_port = 443
283 protocol = "TCP"
284 [ cidr_blocks = ["0.0.0.0/0"]
...
────────────────────────────────────────
CRITICAL: Listener uses an outdated TLS policy.
════════════════════════════════════════
You should not use outdated/insecure TLS versions for encryption. You should be using TLS v1.2+.
HIGH: Application load balancer is not set to drop invalid headers.
════════════════════════════════════════
Passing unknown or invalid headers through to the target poses a potential risk of compromise.
By setting drop_invalid_header_fields to true, anything that doe not conform to well known, defined headers will be removed by the load balancer.
HIGH: Load balancer is exposed publicly.
════════════════════════════════════════
There are many scenarios in which you would want to expose a load balancer to the wider internet, but this check exists as a warning to prevent accidental exposure of internal assets. You should ensure that this resource should be exposed publicly.
HIGH: No public access block so not ignoring public acls
════════════════════════════════════════
S3 buckets should ignore public ACLs on buckets and any objects they contain. By ignoring rather than blocking, PUT calls with public ACLs will still be applied but the ACL will be ignored.
HIGH: No public access block so not restricting public buckets
════════════════════════════════════════
S3 buckets should restrict public policies for the bucket. By enabling, the restrict_public_buckets, only the bucket owner and AWS Services can access if it has a public policy.
CRITICAL: Listener uses an outdated TLS policy.
════════════════════════════════════════
You should not use outdated/insecure TLS versions for encryption. You should be using TLS v1.2+.
HIGH: Application load balancer is not set to drop invalid headers.
════════════════════════════════════════
Passing unknown or invalid headers through to the target poses a potential risk of compromise.
By setting drop_invalid_header_fields to true, anything that doe not conform to well known, defined headers will be removed by the load balancer.
HIGH: Load balancer is exposed publicly.
════════════════════════════════════════
There are many scenarios in which you would want to expose a load balancer to the wider internet, but this check exists as a warning to prevent accidental exposure of internal assets. You should ensure that this resource should be exposed publicly.
HIGH: No public access block so not ignoring public acls
════════════════════════════════════════
S3 buckets should ignore public ACLs on buckets and any objects they contain. By ignoring rather than blocking, PUT calls with public ACLs will still be applied but the ACL will be ignored.
HIGH: No public access block so not ignoring public acls
════════════════════════════════════════
S3 buckets should ignore public ACLs on buckets and any objects they contain. By ignoring rather than blocking, PUT calls with public ACLs will still be applied but the ACL will be ignored.
HIGH: No public access block so not restricting public buckets
════════════════════════════════════════
S3 buckets should restrict public policies for the bucket. By enabling, the restrict_public_buckets, only the bucket owner and AWS Services can access if it has a public policy.
HIGH: No public access block so not restricting public buckets
════════════════════════════════════════
S3 buckets should restrict public policies for the bucket. By enabling, the restrict_public_buckets, only the bucket owner and AWS Services can access if it has a public policy.
*****************************
Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version:0.9.1)
tflint will check the following folders:
terraform/environments/xhibit-portal
*****************************
Running tflint in terraform/environments/xhibit-portal
Excluding the following checks: terraform_unused_declarations
18issue(s) found:
Warning: Module source "github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import" is not pinned (terraform_module_pinned_source)
on terraform/environments/xhibit-portal/importrole.tf line 3:3:source="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import"
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_module_pinned_source.md
Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)
on terraform/environments/xhibit-portal/ingestion-load-balancer.tf line 140:140:"${aws_s3_bucket.ingestion_loadbalancer_logs.arn}"
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md
Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)
on terraform/environments/xhibit-portal/ingestion-load-balancer.tf line 190:190:resources=["${aws_s3_bucket.ingestion_loadbalancer_logs.arn}"]
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md
Warning: Missing version constraint for provider "archive" in `required_providers` (terraform_required_providers)
on terraform/environments/xhibit-portal/lambda.tf line 141:141:data"archive_file""delete_lambda_zip" {
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md
Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)
on terraform/environments/xhibit-portal/prtg-load-balancer.tf line 98:98:"${local.application_data.accounts[local.environment].public_dns_name_prtg}"
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md
Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)
on terraform/environments/xhibit-portal/prtg-load-balancer.tf line 237:237:log_destination_configs=["${aws_s3_bucket.prtg_logs[0].arn}"]
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md
Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)
on terraform/environments/xhibit-portal/prtg-load-balancer.tf line 257:257:"${aws_s3_bucket.prtg_logs[0].arn}"
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md
Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)
on terraform/environments/xhibit-portal/prtg-load-balancer.tf line 296:296:"${data.aws_caller_identity.current.account_id}"
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md
Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)
on terraform/environments/xhibit-portal/prtg-load-balancer.tf line 321:321:"${aws_s3_bucket.prtg_logs[0].arn}"
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md
Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)
on terraform/environments/xhibit-portal/prtg-load-balancer.tf line 328:328:"${data.aws_caller_identity.current.account_id}"
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md
Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)
on terraform/environments/xhibit-portal/waf-load-balancer.tf line 184:184:"${local.application_data.accounts[local.environment].public_dns_name_web}",
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md
Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)
on terraform/environments/xhibit-portal/waf-load-balancer.tf line 334:334:"${aws_s3_bucket.loadbalancer_logs.arn}"
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md
Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)
on terraform/environments/xhibit-portal/waf-load-balancer.tf line 384:384:resources=["${aws_s3_bucket.loadbalancer_logs.arn}"]
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md
Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)
on terraform/environments/xhibit-portal/waf-load-balancer.tf line 418:418:log_destination_configs=["${aws_s3_bucket.waf_logs[0].arn}"]
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md
Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)
on terraform/environments/xhibit-portal/waf-load-balancer.tf line 438:438:"${aws_s3_bucket.waf_logs[0].arn}"
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md
Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)
on terraform/environments/xhibit-portal/waf-load-balancer.tf line 477:477:"${data.aws_caller_identity.current.account_id}"
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md
Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)
on terraform/environments/xhibit-portal/waf-load-balancer.tf line 502:502:"${aws_s3_bucket.waf_logs[0].arn}"
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md
Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)
on terraform/environments/xhibit-portal/waf-load-balancer.tf line 509:509:"${data.aws_caller_identity.current.account_id}"
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.mdtflint_exitcode=2
Trivy Scan Failed
Show Output
*****************************
Trivy will check the following folders:
terraform/environments/xhibit-portal
*****************************
Running Trivy in terraform/environments/xhibit-portal
2024-09-17T15:09:28Z INFO [db] Need to update DB
2024-09-17T15:09:28Z INFO [db] Downloading DB...repository="ghcr.io/aquasecurity/trivy-db:2"2024-09-17T15:09:31Z INFO [vuln] Vulnerability scanning is enabled
2024-09-17T15:09:31Z INFO [misconfig] Misconfiguration scanning is enabled
2024-09-17T15:09:31Z INFO Need to update the built-in policies
2024-09-17T15:09:31Z INFO Downloading the built-in policies...74.86 KiB /74.86 KiB [-----------------------------------------------------------] 100.00%? p/s 0s2024-09-17T15:09:31Z INFO [secret] Secret scanning is enabled
2024-09-17T15:09:31Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-09-17T15:09:31Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.55/docs/scanner/secret#recommendation for faster secret detection2024-09-17T15:09:31Z INFO [npm] To collect the license information of packages, "npm install" needs to be performed beforehand dir="scripts/perf/node_modules"2024-09-17T15:09:32Z INFO [terraformscanner] Scanning root module file_path="."2024-09-17T15:09:32Z WARN [terraformparser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.module="root"variables="networking"2024-09-17T15:09:34Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.bastion_linux.aws_s3_object.user_public_keys"value="cty.NilVal"2024-09-17T15:09:34Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.bastion_linux.data.aws_subnet.local_account"value="cty.NilVal"2024-09-17T15:09:34Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.bastion_linux.dynamic.tag"value="cty.NilVal"2024-09-17T15:09:34Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.bastion_linux.dynamic.tag"value="cty.NilVal"2024-09-17T15:09:34Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.bastion_linux.module.s3-bucket.dynamic.expiration"value="cty.NilVal"2024-09-17T15:09:34Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.bastion_linux.module.s3-bucket.dynamic.transition"value="cty.NilVal"2024-09-17T15:09:34Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.bastion_linux.module.s3-bucket.dynamic.noncurrent_version_expiration"value="cty.NilVal"2024-09-17T15:09:34Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.bastion_linux.module.s3-bucket.dynamic.noncurrent_version_transition"value="cty.NilVal"2024-09-17T15:09:34Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.bastion_linux.module.s3-bucket.dynamic.principals"value="cty.NilVal"2024-09-17T15:09:34Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.bastion_linux.module.s3-bucket.dynamic.condition"value="cty.NilVal"2024-09-17T15:09:34Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.bastion_linux.module.s3-bucket.dynamic.expiration"value="cty.NilVal"2024-09-17T15:09:34Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.bastion_linux.module.s3-bucket.dynamic.transition"value="cty.NilVal"2024-09-17T15:09:34Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.bastion_linux.module.s3-bucket.dynamic.noncurrent_version_expiration"value="cty.NilVal"2024-09-17T15:09:34Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.bastion_linux.module.s3-bucket.dynamic.noncurrent_version_transition"value="cty.NilVal"2024-09-17T15:09:34Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.bastion_linux.module.s3-bucket.dynamic.principals"value="cty.NilVal"2024-09-17T15:09:34Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.bastion_linux.module.s3-bucket.dynamic.condition"value="cty.NilVal"2024-09-17T15:09:35Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.vm-import.module.s3-bucket.dynamic.expiration"value="cty.NilVal"2024-09-17T15:09:35Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.vm-import.module.s3-bucket.dynamic.transition"value="cty.NilVal"2024-09-17T15:09:35Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.vm-import.module.s3-bucket.dynamic.noncurrent_version_expiration"value="cty.NilVal"2024-09-17T15:09:35Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.vm-import.module.s3-bucket.dynamic.noncurrent_version_transition"value="cty.NilVal"2024-09-17T15:09:35Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.vm-import.module.s3-bucket.dynamic.principals"value="cty.NilVal"2024-09-17T15:09:35Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.vm-import.module.s3-bucket.dynamic.condition"value="cty.NilVal"2024-09-17T15:09:35Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.vm-import.module.s3-bucket.dynamic.expiration"value="cty.NilVal"2024-09-17T15:09:35Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.vm-import.module.s3-bucket.dynamic.transition"value="cty.NilVal"2024-09-17T15:09:35Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.vm-import.module.s3-bucket.dynamic.noncurrent_version_expiration"value="cty.NilVal"2024-09-17T15:09:35Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.vm-import.module.s3-bucket.dynamic.noncurrent_version_transition"value="cty.NilVal"2024-09-17T15:09:35Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.vm-import.module.s3-bucket.dynamic.principals"value="cty.NilVal"2024-09-17T15:09:35Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.vm-import.module.s3-bucket.dynamic.condition"value="cty.NilVal"2024-09-17T15:09:35Z INFO [terraformexecutor] Ignore finding rule="aws-lambda-enable-tracing"range="lambda.tf:150-164"2024-09-17T15:09:35Z INFO [terraformexecutor] Ignore finding rule="aws-lambda-enable-tracing"range="lambda.tf:57-69"2024-09-17T15:09:35Z INFO [terraformexecutor] Ignore finding rule="aws-s3-enable-bucket-encryption"range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=8688bc15a08fbf5a4f4eef9b7433c5a417df8df1/main.tf:8-19"2024-09-17T15:09:35Z INFO [terraformexecutor] Ignore finding rule="aws-s3-enable-bucket-encryption"range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0/main.tf:8-19"2024-09-17T15:09:35Z INFO [terraformexecutor] Ignore finding rule="aws-s3-enable-versioning"range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=8688bc15a08fbf5a4f4eef9b7433c5a417df8df1/main.tf:8-19"2024-09-17T15:09:35Z INFO [terraformexecutor] Ignore finding rule="aws-s3-enable-versioning"range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0/main.tf:8-19"2024-09-17T15:09:35Z INFO [terraformexecutor] Ignore finding rule="aws-s3-encryption-customer-key"range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=8688bc15a08fbf5a4f4eef9b7433c5a417df8df1/main.tf:157-165"2024-09-17T15:09:35Z INFO [terraformexecutor] Ignore finding rule="aws-s3-encryption-customer-key"range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.0.0/main.tf:157-165"2024-09-17T15:09:35Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/main.tf:242-284"2024-09-17T15:09:35Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/main.tf:242-284"2024-09-17T15:09:35Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/main.tf:242-284"2024-09-17T15:09:35Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/main.tf:242-284"2024-09-17T15:09:35Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/main.tf:242-284"2024-09-17T15:09:35Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/main.tf:242-284"2024-09-17T15:09:35Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/main.tf:242-284"2024-09-17T15:09:35Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/main.tf:242-284"2024-09-17T15:09:35Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/main.tf:242-284"2024-09-17T15:09:35Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/main.tf:303-321"2024-09-17T15:09:35Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"2024-09-17T15:09:35Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"2024-09-17T15:09:35Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"2024-09-17T15:09:35Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"2024-09-17T15:09:35Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"2024-09-17T15:09:35Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"2024-09-17T15:09:35Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"2024-09-17T15:09:35Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"2024-09-17T15:09:35Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"2024-09-17T15:09:35Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"2024-09-17T15:09:35Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"2024-09-17T15:09:35Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.0.0/main.tf:303-321"2024-09-17T15:09:35Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"2024-09-17T15:09:35Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"2024-09-17T15:09:35Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"2024-09-17T15:09:35Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"2024-09-17T15:09:35Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"2024-09-17T15:09:35Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"2024-09-17T15:09:35Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"2024-09-17T15:09:35Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"2024-09-17T15:09:35Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"2024-09-17T15:09:35Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"2024-09-17T15:09:35Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-policy-wildcards"range="github.com/ministryofjustice/modernisation-platform-terraform-aws-vm-import/main.tf:88-118"2024-09-17T15:09:35Z INFO Number of language-specific files num=12024-09-17T15:09:35Z INFO [npm] Detecting vulnerabilities...2024-09-17T15:09:35Z INFO Detected config files num=24
For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://aquasecurity.github.io/trivy/v0.55/docs/supply-chain/vex/repo#publishing-vex-documents
To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.
scripts/perf/package-lock.json (npm)
====================================
Total:2 (HIGH:2, CRITICAL:0)
┌──────────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────────┬──────────────────────────────────────────────────────────┐
│ Library │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │ Title │
├──────────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────┤
│ jsonwebtoken │ CVE-2022-23539 │ HIGH │ fixed │ 8.5.1 │ 9.0.0 │ jsonwebtoken: Unrestricted key type could lead to legacy │
│ │ │ │ │ │ │ keys usagen │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2022-23539 │
├──────────────┼────────────────┤ │ ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────┤
│ semver │ CVE-2022-25883 │ │ │ 5.7.1 │ 7.5.2, 6.3.1, 5.7.2 │ nodejs-semver: Regular expression denial of service │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2022-25883 │
└──────────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────────┴──────────────────────────────────────────────────────────┘
importmachine.tf (terraform)
============================
Tests:9 (SUCCESSES:5, FAILURES:4, EXCEPTIONS:0)
Failures:4 (HIGH:0, CRITICAL:4)
CRITICAL: Security group rule allows egress to multiple public internet addresses.
════════════════════════════════════════
Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.
See https://avd.aquasec.com/misconfig/avd-aws-0104
────────────────────────────────────────
importmachine.tf:29
via importmachine.tf:23-30 (egress)
via importmachine.tf:1-32 (aws_security_group.importmachine)
────────────────────────────────────────
1 resource"aws_security_group""importmachine" {
.29 [ ipv6_cidr_blocks = ["::/0"]
..32 }
────────────────────────────────────────
CRITICAL:Securitygroupruleallowsegresstomultiplepublicinternetaddresses.
════════════════════════════════════════
Openingupportstoconnectouttothepublicinternetisgenerallytobeavoided.YoushouldrestrictaccesstoIPaddressesorrangesthatareexplicitlyrequiredwherepossible.Seehttps://avd.aquasec.com/misconfig/avd-aws-0104
────────────────────────────────────────
importmachine.tf:28viaimportmachine.tf:23-30 (egress)
viaimportmachine.tf:1-32 (aws_security_group.importmachine)
────────────────────────────────────────
1resource"aws_security_group""importmachine" {
.
28 [ cidr_blocks = ["0.0.0.0/0"]
..
32 }
────────────────────────────────────────
CRITICAL:Securitygroupruleallowsingressfrompublicinternet.
════════════════════════════════════════
Openingupportstothepublicinternetisgenerallytobeavoided.YoushouldrestrictaccesstoIPaddressesorrangesthatexplicitlyrequireitwherepossible.Seehttps://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
importmachine.tf:20viaimportmachine.tf:14-21 (ingress)
viaimportmachine.tf:1-32 (aws_security_group.importmachine)
────────────────────────────────────────
1resource"aws_security_group""importmachine" {
.
20 [ ipv6_cidr_blocks = ["::/0"]
..
32 }
────────────────────────────────────────
CRITICAL:Securitygroupruleallowsingressfrompublicinternet.
════════════════════════════════════════
Openingupportstothepublicinternetisgenerallytobeavoided.YoushouldrestrictaccesstoIPaddressesorrangesthatexplicitlyrequireitwherepossible.Seehttps://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
importmachine.tf:19viaimportmachine.tf:14-21 (ingress)
viaimportmachine.tf:1-32 (aws_security_group.importmachine)
────────────────────────────────────────
1resource"aws_security_group""importmachine" {
.
19 [ cidr_blocks = ["0.0.0.0/0"]
..
32 }
────────────────────────────────────────
ingestion-load-balancer.tf (terraform)
======================================Tests:8 (SUCCESSES:2, FAILURES:6, EXCEPTIONS:0)
Failures:6 (HIGH:5, CRITICAL:1)
HIGH:Loadbalancerisexposedpublicly.
════════════════════════════════════════
Therearemanyscenariosinwhichyouwouldwanttoexposealoadbalancertothewiderinternet, butthischeckexistsasawarningtopreventaccidentalexposureofinternalassets.Youshouldensurethatthisresourceshouldbeexposedpublicly.Seehttps://avd.aquasec.com/misconfig/avd-aws-0053
────────────────────────────────────────
ingestion-load-balancer.tf:59viaingestion-load-balancer.tf:52-97 (aws_elb.ingestion_lb)
────────────────────────────────────────
52resource"aws_elb""ingestion_lb" {
..
59 [ internal =false
..
97 }
────────────────────────────────────────
HIGH:Nopublicaccessblocksonotblockingpublicacls
════════════════════════════════════════
S3bucketsshouldblockpublicACLsonbucketsandanyobjectstheycontain.Byblocking, PUTswithfailiftheobjecthasanypublicACLa.Seehttps://avd.aquasec.com/misconfig/avd-aws-0086
────────────────────────────────────────
ingestion-load-balancer.tf:104-107
────────────────────────────────────────
104 ┌ resource"aws_s3_bucket""ingestion_loadbalancer_logs" {
105 │ bucket ="${var.networking[0].application}.${var.networking[0].business-unit}-${local.environment}-ingestion-lblogs"106 │ force_destroy =true107 └ }
────────────────────────────────────────
HIGH:Nopublicaccessblocksonotblockingpublicpolicies
════════════════════════════════════════
S3bucketpolicyshouldhaveblockpublicpolicytopreventusersfromputtingapolicythatenablepublicaccess.Seehttps://avd.aquasec.com/misconfig/avd-aws-0087
────────────────────────────────────────
ingestion-load-balancer.tf:104-107
────────────────────────────────────────
104 ┌ resource"aws_s3_bucket""ingestion_loadbalancer_logs" {
105 │ bucket ="${var.networking[0].application}.${var.networking[0].business-unit}-${local.environment}-ingestion-lblogs"106 │ force_destroy =true107 └ }
────────────────────────────────────────
HIGH:Nopublicaccessblocksonotignoringpublicacls
════════════════════════════════════════
S3bucketsshouldignorepublicACLsonbucketsandanyobjectstheycontain.Byignoringratherthanblocking, PUTcallswithpublicACLswillstillbeappliedbuttheACLwillbeignored.Seehttps://avd.aquasec.com/misconfig/avd-aws-0091
────────────────────────────────────────
ingestion-load-balancer.tf:104-107
────────────────────────────────────────
104 ┌ resource"aws_s3_bucket""ingestion_loadbalancer_logs" {
105 │ bucket ="${var.networking[0].application}.${var.networking[0].business-unit}-${local.environment}-ingestion-lblogs"106 │ force_destroy =true107 └ }
────────────────────────────────────────
HIGH:Nopublicaccessblocksonotrestrictingpublicbuckets
════════════════════════════════════════
S3bucketsshouldrestrictpublicpoliciesforthebucket.Byenabling, therestrict_public_buckets, onlythebucketownerandAWSServicescanaccessifithasapublicpolicy.Seehttps://avd.aquasec.com/misconfig/avd-aws-0093
────────────────────────────────────────
ingestion-load-balancer.tf:104-107
────────────────────────────────────────
104 ┌ resource"aws_s3_bucket""ingestion_loadbalancer_logs" {
105 │ bucket ="${var.networking[0].application}.${var.networking[0].business-unit}-${local.environment}-ingestion-lblogs"106 │ force_destroy =true107 └ }
────────────────────────────────────────
CRITICAL:Securitygroupruleallowsingressfrompublicinternet.
════════════════════════════════════════
Openingupportstothepublicinternetisgenerallytobeavoided.YoushouldrestrictaccesstoIPaddressesorrangesthatexplicitlyrequireitwherepossible.Seehttps://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
ingestion-load-balancer.tf:26-36viaingestion-load-balancer.tf:18-40 (aws_security_group_rule.ingestion_lb_allow_web_users)
────────────────────────────────────────
18resource"aws_security_group_rule""ingestion_lb_allow_web_users" {
..
26 ┌ cidr_blocks = [
27 │ "10.182.60.51/32", # NLE CGI proxy 28 │ "195.59.75.151/32", # New proxy IPs from Prashanth for testing ingestion NLE DEV29 │ "195.59.75.152/32", # New proxy IPs from Prashanth for testing ingestion NLE DEV30 │ "194.33.192.0/24", # New proxy IPs from Prashanth for testing ingestion LE PROD31 │ "194.33.196.0/24", # New proxy IPs from Prashanth for testing ingestion LE PROD32 └ "194.33.248.0/24", # New proxy IPs from Prashanth for testing ingestion LE PROD
..
────────────────────────────────────────
network-infrastructure.tf (terraform)
=====================================
Tests:64 (SUCCESSES:54, FAILURES:10, EXCEPTIONS:0)
Failures:10 (HIGH:0, CRITICAL:10)
CRITICAL: Security group rule allows egress to multiple public internet addresses.
════════════════════════════════════════
Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.
See https://avd.aquasec.com/misconfig/avd-aws-0104
────────────────────────────────────────
network-infrastructure.tf:129
via network-infrastructure.tf:120-130 (aws_security_group_rule.exchange-outbound-all)
────────────────────────────────────────
120 resource "aws_security_group_rule""exchange-outbound-all" {
121 depends_on = [aws_security_group.exchange_server]
122 security_group_id = aws_security_group.exchange_server.id
123 type ="egress"124 description ="allow all"125 from_port =0126 to_port =0127 protocol ="-1"128 cidr_blocks = ["0.0.0.0/0"]
...
────────────────────────────────────────
CRITICAL: Security group rule allows egress to multiple public internet addresses.
════════════════════════════════════════
Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.
See https://avd.aquasec.com/misconfig/avd-aws-0104
────────────────────────────────────────
network-infrastructure.tf:128
via network-infrastructure.tf:120-130 (aws_security_group_rule.exchange-outbound-all)
────────────────────────────────────────
120 resource "aws_security_group_rule""exchange-outbound-all" {
121 depends_on = [aws_security_group.exchange_server]
122 security_group_id = aws_security_group.exchange_server.id
123 type ="egress"124 description ="allow all"125 from_port =0126 to_port =0127 protocol ="-1"128 [ cidr_blocks = ["0.0.0.0/0"]
...
────────────────────────────────────────
CRITICAL: Security group rule allows egress to multiple public internet addresses.
════════════════════════════════════════
Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.
See https://avd.aquasec.com/misconfig/avd-aws-0104
────────────────────────────────────────
network-infrastructure.tf:694
via network-infrastructure.tf:685-695 (aws_security_group_rule.iisrelay-outbound-all)
────────────────────────────────────────
685 resource "aws_security_group_rule""iisrelay-outbound-all" {
686 depends_on = [aws_security_group.iisrelay_server]
687 security_group_id = aws_security_group.iisrelay_server.id
688 type ="egress"689 description ="allow all"690 from_port =0691 to_port =0692 protocol ="-1"693 cidr_blocks = ["0.0.0.0/0"]
...
────────────────────────────────────────
CRITICAL: Security group rule allows egress to multiple public internet addresses.
════════════════════════════════════════
Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.
See https://avd.aquasec.com/misconfig/avd-aws-0104
────────────────────────────────────────
network-infrastructure.tf:693
via network-infrastructure.tf:685-695 (aws_security_group_rule.iisrelay-outbound-all)
────────────────────────────────────────
685 resource "aws_security_group_rule""iisrelay-outbound-all" {
686 depends_on = [aws_security_group.iisrelay_server]
687 security_group_id = aws_security_group.iisrelay_server.id
688 type ="egress"689 description ="allow all"690 from_port =0691 to_port =0692 protocol ="-1"693 [ cidr_blocks = ["0.0.0.0/0"]
...
────────────────────────────────────────
CRITICAL: Security group rule allows egress to multiple public internet addresses.
════════════════════════════════════════
Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.
See https://avd.aquasec.com/misconfig/avd-aws-0104
────────────────────────────────────────
network-infrastructure.tf:207
via network-infrastructure.tf:199-208 (aws_security_group_rule.sms-outbound-all-ipv4)
────────────────────────────────────────
199 resource "aws_security_group_rule""sms-outbound-all-ipv4" {
200 depends_on = [aws_security_group.sms_server]
201 security_group_id = aws_security_group.sms_server.id
202 type ="egress"203 description ="allow all ipv4"204 from_port =0205 to_port =0206 protocol ="-1"207 [ cidr_blocks = ["0.0.0.0/0"]
208 }
────────────────────────────────────────
CRITICAL: Security group rule allows egress to multiple public internet addresses.
════════════════════════════════════════
Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.
See https://avd.aquasec.com/misconfig/avd-aws-0104
────────────────────────────────────────
network-infrastructure.tf:218
via network-infrastructure.tf:210-219 (aws_security_group_rule.sms-outbound-all-ipv6)
────────────────────────────────────────
210 resource "aws_security_group_rule""sms-outbound-all-ipv6" {
211 depends_on = [aws_security_group.sms_server]
212 security_group_id = aws_security_group.sms_server.id
213 type ="egress"214 description ="allow all ipv6"215 from_port =0216 to_port =0217 protocol ="-1"218 [ ipv6_cidr_blocks = ["::/0"]
219 }
────────────────────────────────────────
CRITICAL: Security group rule allows ingress from public internet.
════════════════════════════════════════
Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.
See https://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
network-infrastructure.tf:297
via network-infrastructure.tf:288-298 (aws_security_group_rule.prtg_lb_allow_web_users)
────────────────────────────────────────
288 resource "aws_security_group_rule""prtg_lb_allow_web_users" {
289 depends_on = [aws_security_group.prtg_lb]
290 security_group_id = aws_security_group.prtg_lb.id
291 type ="ingress"292 description ="allow web traffic to get to prtg Load Balancer over SSL "293 from_port =443294 to_port =443295 protocol ="TCP"296 cidr_blocks = ["0.0.0.0/0"]
...
────────────────────────────────────────
CRITICAL: Security group rule allows ingress from public internet.
════════════════════════════════════════
Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.
See https://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
network-infrastructure.tf:296
via network-infrastructure.tf:288-298 (aws_security_group_rule.prtg_lb_allow_web_users)
────────────────────────────────────────
288 resource "aws_security_group_rule""prtg_lb_allow_web_users" {
289 depends_on = [aws_security_group.prtg_lb]
290 security_group_id = aws_security_group.prtg_lb.id
291 type ="ingress"292 description ="allow web traffic to get to prtg Load Balancer over SSL "293 from_port =443294 to_port =443295 protocol ="TCP"296 [ cidr_blocks = ["0.0.0.0/0"]
...
────────────────────────────────────────
CRITICAL: Security group rule allows ingress from public internet.
════════════════════════════════════════
Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.
See https://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
network-infrastructure.tf:285
via network-infrastructure.tf:276-286 (aws_security_group_rule.waf_lb_allow_web_users)
────────────────────────────────────────
276 resource "aws_security_group_rule""waf_lb_allow_web_users" {
277 depends_on = [aws_security_group.waf_lb]
278 security_group_id = aws_security_group.waf_lb.id
279 type ="ingress"280 description ="allow web traffic to get to ingestion server"281 from_port =443282 to_port =443283 protocol ="TCP"284 cidr_blocks = ["0.0.0.0/0"]
...
────────────────────────────────────────
CRITICAL: Security group rule allows ingress from public internet.
════════════════════════════════════════
Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.
See https://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
network-infrastructure.tf:284
via network-infrastructure.tf:276-286 (aws_security_group_rule.waf_lb_allow_web_users)
────────────────────────────────────────
276 resource "aws_security_group_rule""waf_lb_allow_web_users" {
277 depends_on = [aws_security_group.waf_lb]
278 security_group_id = aws_security_group.waf_lb.id
279 type ="ingress"280 description ="allow web traffic to get to ingestion server"281 from_port =443282 to_port =443283 protocol ="TCP"284 [ cidr_blocks = ["0.0.0.0/0"]
...
────────────────────────────────────────
prtg-load-balancer.tf (terraform)
=================================
Tests:11 (SUCCESSES:4, FAILURES:7, EXCEPTIONS:0)
Failures:7 (HIGH:6, CRITICAL:1)
CRITICAL: Listener uses an outdated TLS policy.
════════════════════════════════════════
You should not use outdated/insecure TLS versions forencryption.YoushouldbeusingTLSv1.2+.
See https://avd.aquasec.com/misconfig/avd-aws-0047
────────────────────────────────────────
prtg-load-balancer.tf:82
via prtg-load-balancer.tf:73-90 (aws_lb_listener.prtg_lb_listener)
────────────────────────────────────────
73 resource "aws_lb_listener""prtg_lb_listener" {
..
82 [ ssl_policy ="ELBSecurityPolicy-2016-08"
..
90 }
────────────────────────────────────────
HIGH: Application load balancer is not set to drop invalid headers.
════════════════════════════════════════
Passing unknown or invalid headers through to the target poses a potential risk of compromise.
By setting drop_invalid_header_fields to true, anything that doe not conform to well known, defined headers will be removed by the load balancer.
See https://avd.aquasec.com/misconfig/avd-aws-0052
────────────────────────────────────────
prtg-load-balancer.tf:12-37
────────────────────────────────────────
12 ┌ resource "aws_lb""prtg_lb" {
13 │
14 │ depends_on = [
15 │ aws_security_group.prtg_lb,
16 │ ]
17 │
18 │ name ="prtg-lb-${var.networking[0].application}"19 │ internal =false20 └ load_balancer_type ="application"
..
────────────────────────────────────────
HIGH: Load balancer is exposed publicly.
════════════════════════════════════════
There are many scenarios in which you would want to expose a load balancer to the wider internet, but this check exists as a warning to prevent accidental exposure of internal assets. You should ensure that this resource should be exposed publicly.
See https://avd.aquasec.com/misconfig/avd-aws-0053
────────────────────────────────────────
prtg-load-balancer.tf:19
via prtg-load-balancer.tf:12-37 (aws_lb.prtg_lb)
────────────────────────────────────────
12 resource "aws_lb""prtg_lb" {
..
19 [ internal =false
..
37 }
────────────────────────────────────────
HIGH: No public access block so not blocking public acls
════════════════════════════════════════
S3 buckets should block public ACLs on buckets and any objects they contain. By blocking, PUTs with fail iftheobjecthasanypublicACLa.
See https://avd.aquasec.com/misconfig/avd-aws-0086
────────────────────────────────────────
prtg-load-balancer.tf:212-216
────────────────────────────────────────
212 ┌ resource "aws_s3_bucket""prtg_logs" {
213 │ count = local.is-production ?0:1214 │ bucket ="aws-waf-logs-prtg-${var.networking[0].application}.${var.networking[0].business-unit}-${local.environment}"215 │ force_destroy =true216 └ }
────────────────────────────────────────
HIGH: No public access block so not blocking public policies
════════════════════════════════════════
S3 bucket policy should have block public policy to prevent users from putting a policy that enable public access.
See https://avd.aquasec.com/misconfig/avd-aws-0087
────────────────────────────────────────
prtg-load-balancer.tf:212-216
────────────────────────────────────────
212 ┌ resource "aws_s3_bucket""prtg_logs" {
213 │ count = local.is-production ?0:1214 │ bucket ="aws-waf-logs-prtg-${var.networking[0].application}.${var.networking[0].business-unit}-${local.environment}"215 │ force_destroy =true216 └ }
────────────────────────────────────────
HIGH: No public access block so not ignoring public acls
════════════════════════════════════════
S3 buckets should ignore public ACLs on buckets and any objects they contain. By ignoring rather than blocking, PUT calls with public ACLs will still be applied but the ACL will be ignored.
See https://avd.aquasec.com/misconfig/avd-aws-0091
────────────────────────────────────────
prtg-load-balancer.tf:212-216
────────────────────────────────────────
212 ┌ resource "aws_s3_bucket""prtg_logs" {
213 │ count = local.is-production ?0:1214 │ bucket ="aws-waf-logs-prtg-${var.networking[0].application}.${var.networking[0].business-unit}-${local.environment}"215 │ force_destroy =true216 └ }
────────────────────────────────────────
HIGH: No public access block so not restricting public buckets
════════════════════════════════════════
S3 buckets should restrict public policies forthebucket.Byenabling, therestrict_public_buckets, onlythebucketownerandAWSServicescanaccessifithasapublicpolicy.
See https://avd.aquasec.com/misconfig/avd-aws-0093
────────────────────────────────────────
prtg-load-balancer.tf:212-216
────────────────────────────────────────
212 ┌ resource "aws_s3_bucket""prtg_logs" {
213 │ count = local.is-production ?0:1214 │ bucket ="aws-waf-logs-prtg-${var.networking[0].application}.${var.networking[0].business-unit}-${local.environment}"215 │ force_destroy =true216 └ }
────────────────────────────────────────
waf-load-balancer.tf (terraform)
================================
Tests:18 (SUCCESSES:7, FAILURES:11, EXCEPTIONS:0)
Failures:11 (HIGH:10, CRITICAL:1)
CRITICAL: Listener uses an outdated TLS policy.
════════════════════════════════════════
You should not use outdated/insecure TLS versions forencryption.YoushouldbeusingTLSv1.2+.
See https://avd.aquasec.com/misconfig/avd-aws-0047
────────────────────────────────────────
waf-load-balancer.tf:96
via waf-load-balancer.tf:87-104 (aws_lb_listener.waf_lb_listener)
────────────────────────────────────────
87 resource "aws_lb_listener""waf_lb_listener" {
..
96 [ ssl_policy ="ELBSecurityPolicy-2016-08"...104 }
────────────────────────────────────────
HIGH: Application load balancer is not set to drop invalid headers.
════════════════════════════════════════
Passing unknown or invalid headers through to the target poses a potential risk of compromise.
By setting drop_invalid_header_fields to true, anything that doe not conform to well known, defined headers will be removed by the load balancer.
See https://avd.aquasec.com/misconfig/avd-aws-0052
────────────────────────────────────────
waf-load-balancer.tf:27-52
────────────────────────────────────────
27 ┌ resource "aws_lb""waf_lb" {
28 │
29 │ depends_on = [
30 │ aws_security_group.waf_lb,
31 │ ]
32 │
33 │ name ="waf-lb-${var.networking[0].application}"34 │ internal =false35 └ load_balancer_type ="application"
..
────────────────────────────────────────
HIGH: Load balancer is exposed publicly.
════════════════════════════════════════
There are many scenarios in which you would want to expose a load balancer to the wider internet, but this check exists as a warning to prevent accidental exposure of internal assets. You should ensure that this resource should be exposed publicly.
See https://avd.aquasec.com/misconfig/avd-aws-0053
────────────────────────────────────────
waf-load-balancer.tf:34
via waf-load-balancer.tf:27-52 (aws_lb.waf_lb)
────────────────────────────────────────
27 resource "aws_lb""waf_lb" {
..
34 [ internal =false
..
52 }
────────────────────────────────────────
HIGH: No public access block so not blocking public acls
════════════════════════════════════════
S3 buckets should block public ACLs on buckets and any objects they contain. By blocking, PUTs with fail iftheobjecthasanypublicACLa.
See https://avd.aquasec.com/misconfig/avd-aws-0086
────────────────────────────────────────
waf-load-balancer.tf:298-301
────────────────────────────────────────
298 ┌ resource "aws_s3_bucket""loadbalancer_logs" {
299 │ bucket ="${var.networking[0].application}.${var.networking[0].business-unit}-${local.environment}-lblogs"300 │ force_destroy =true301 └ }
────────────────────────────────────────
HIGH: No public access block so not blocking public acls
════════════════════════════════════════
S3 buckets should block public ACLs on buckets and any objects they contain. By blocking, PUTs with fail iftheobjecthasanypublicACLa.
See https://avd.aquasec.com/misconfig/avd-aws-0086
────────────────────────────────────────
waf-load-balancer.tf:393-397
────────────────────────────────────────
393 ┌ resource "aws_s3_bucket""waf_logs" {
394 │ count = local.is-production ?0:1395 │ bucket ="aws-waf-logs-${var.networking[0].application}.${var.networking[0].business-unit}-${local.environment}"396 │ force_destroy =true397 └ }
────────────────────────────────────────
HIGH: No public access block so not blocking public policies
════════════════════════════════════════
S3 bucket policy should have block public policy to prevent users from putting a policy that enable public access.
See https://avd.aquasec.com/misconfig/avd-aws-0087
────────────────────────────────────────
waf-load-balancer.tf:298-301
────────────────────────────────────────
298 ┌ resource "aws_s3_bucket""loadbalancer_logs" {
299 │ bucket ="${var.networking[0].application}.${var.networking[0].business-unit}-${local.environment}-lblogs"300 │ force_destroy =true301 └ }
────────────────────────────────────────
HIGH: No public access block so not blocking public policies
════════════════════════════════════════
S3 bucket policy should have block public policy to prevent users from putting a policy that enable public access.
See https://avd.aquasec.com/misconfig/avd-aws-0087
────────────────────────────────────────
waf-load-balancer.tf:393-397
────────────────────────────────────────
393 ┌ resource "aws_s3_bucket""waf_logs" {
394 │ count = local.is-production ?0:1395 │ bucket ="aws-waf-logs-${var.networking[0].application}.${var.networking[0].business-unit}-${local.environment}"396 │ force_destroy =true397 └ }
────────────────────────────────────────
HIGH: No public access block so not ignoring public acls
════════════════════════════════════════
S3 buckets should ignore public ACLs on buckets and any objects they contain. By ignoring rather than blocking, PUT calls with public ACLs will still be applied but the ACL will be ignored.
See https://avd.aquasec.com/misconfig/avd-aws-0091
────────────────────────────────────────
waf-load-balancer.tf:298-301
────────────────────────────────────────
298 ┌ resource "aws_s3_bucket""loadbalancer_logs" {
299 │ bucket ="${var.networking[0].application}.${var.networking[0].business-unit}-${local.environment}-lblogs"300 │ force_destroy =true301 └ }
────────────────────────────────────────
HIGH: No public access block so not ignoring public acls
════════════════════════════════════════
S3 buckets should ignore public ACLs on buckets and any objects they contain. By ignoring rather than blocking, PUT calls with public ACLs will still be applied but the ACL will be ignored.
See https://avd.aquasec.com/misconfig/avd-aws-0091
────────────────────────────────────────
waf-load-balancer.tf:393-397
────────────────────────────────────────
393 ┌ resource "aws_s3_bucket""waf_logs" {
394 │ count = local.is-production ?0:1395 │ bucket ="aws-waf-logs-${var.networking[0].application}.${var.networking[0].business-unit}-${local.environment}"396 │ force_destroy =true397 └ }
────────────────────────────────────────
HIGH: No public access block so not restricting public buckets
════════════════════════════════════════
S3 buckets should restrict public policies forthebucket.Byenabling, therestrict_public_buckets, onlythebucketownerandAWSServicescanaccessifithasapublicpolicy.
See https://avd.aquasec.com/misconfig/avd-aws-0093
────────────────────────────────────────
waf-load-balancer.tf:298-301
────────────────────────────────────────
298 ┌ resource "aws_s3_bucket""loadbalancer_logs" {
299 │ bucket ="${var.networking[0].application}.${var.networking[0].business-unit}-${local.environment}-lblogs"300 │ force_destroy =true301 └ }
────────────────────────────────────────
HIGH: No public access block so not restricting public buckets
════════════════════════════════════════
S3 buckets should restrict public policies forthebucket.Byenabling, therestrict_public_buckets, onlythebucketownerandAWSServicescanaccessifithasapublicpolicy.
See https://avd.aquasec.com/misconfig/avd-aws-0093
────────────────────────────────────────
waf-load-balancer.tf:393-397
────────────────────────────────────────
393 ┌ resource "aws_s3_bucket""waf_logs" {
394 │ count = local.is-production ?0:1395 │ bucket ="aws-waf-logs-${var.networking[0].application}.${var.networking[0].business-unit}-${local.environment}"396 │ force_destroy =true397 └ }
────────────────────────────────────────
trivy_exitcode=1
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
github-actions
bot
added
the
environments-repository
luigidifraiawork
temporarily deployed
to
xhibit-portal-development
No description provided.