Elm 2794 modularize glue jobs

[madhu-k-sr2]

No description provided.

[github-actions]

Trivy Scan Failed

Show Output

```hcl

---

Trivy will check the following folders:
terraform/environments/electronic-monitoring-data

---

Running Trivy in terraform/environments/electronic-monitoring-data
2024-10-10T09:28:42Z INFO [vulndb] Need to update DB
2024-10-10T09:28:42Z INFO [vulndb] Downloading vulnerability DB...
2024-10-10T09:28:42Z INFO [vulndb] Downloading artifact... repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-10T09:28:44Z INFO [vulndb] Artifact successfully downloaded repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-10T09:28:44Z INFO [vuln] Vulnerability scanning is enabled
2024-10-10T09:28:44Z INFO [misconfig] Misconfiguration scanning is enabled
2024-10-10T09:28:44Z INFO [misconfig] Need to update the built-in checks
2024-10-10T09:28:44Z INFO [misconfig] Downloading the built-in checks...
156.02 KiB / 156.02 KiB [---------------------------------------------------------] 100.00% ? p/s 0s2024-10-10T09:28:45Z INFO [secret] Secret scanning is enabled
2024-10-10T09:28:45Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-10T09:28:45Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-10-10T09:28:45Z WARN [pip] Unable to find python site-packages directory. License detection is skipped. err="site-packages directory not found"
2024-10-10T09:28:46Z INFO [terraform scanner] Scanning root module file_path="."
2024-10-10T09:28:46Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="networking"
2024-10-10T09:28:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T09:28:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T09:28:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T09:28:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T09:28:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T09:28:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.aws_s3_object.user_public_keys" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.data.aws_subnet.local_account" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:49Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:54Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-10T09:28:54Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-10T09:28:54Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-versioning" range="s3.tf:1042-1061"
2024-10-10T09:28:54Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-logging" range="s3.tf:1042-1061"
2024-10-10T09:28:54Z INFO [terraform executor] Ignore finding rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:281-286"
2024-10-10T09:28:54Z INFO [terraform executor] Ignore finding rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:407-411"
2024-10-10T09:28:54Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-bucket-encryption" range="s3.tf:1042-1061"
2024-10-10T09:28:54Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-10T09:28:54Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-10T09:28:54Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-10T09:28:54Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-10T09:28:54Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-10T09:28:54Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-10T09:28:54Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-10T09:28:54Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-10T09:28:54Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-10T09:28:54Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-10T09:28:54Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-10T09:28:54Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.2.1/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=568694e50e03630d99cb569eafa06a0b879a1239/main.tf:171-179"
2024-10-10T09:28:54Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="s3.tf:1042-1061"
2024-10-10T09:28:54Z INFO Number of language-specific files num=1
2024-10-10T09:28:54Z INFO [pip] Detecting vulnerabilities...
2024-10-10T09:28:54Z INFO Detected config files num=17

data_store.tf (terraform)

Tests: 1 (SUCCESSES: 0, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Topic does not have encryption enabled.
════════════════════════════════════════
Topics should be encrypted to protect their contents.

See https://avd.aquasec.com/misconfig/avd-aws-0095
────────────────────────────────────────
data_store.tf:17-19
────────────────────────────────────────
17 ┌ resource "aws_sns_topic" "s3_events" {
18 │ name = "${module.s3-data-bucket.bucket.id}-object-created-topic"
19 └ }
────────────────────────────────────────

lambdas/update_log_table/Dockerfile (dockerfile)

Tests: 20 (SUCCESSES: 19, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Specify at least 1 USER command in Dockerfile with non-root user as argument
════════════════════════════════════════
Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

See https://avd.aquasec.com/misconfig/ds002
────────────────────────────────────────

trivy_exitcode=1

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/electronic-monitoring-data

*****************************

Running Checkov in terraform/environments/electronic-monitoring-data
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2024-10-10 09:28:56,870 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.2.1:None (for external modules, the --download-external-modules flag is required)
2024-10-10 09:28:56,870 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060:None (for external modules, the --download-external-modules flag is required)
2024-10-10 09:28:56,870 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/secrets-manager/aws:1.3.0 (for external modules, the --download-external-modules flag is required)
2024-10-10 09:28:56,870 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=52a40b0:None (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 2005, Failed checks: 76, Skipped checks: 25

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: rds_bastion
	File: /bastion_linux.tf:6-39
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		6  | module "rds_bastion" {
		7  |   source = "github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.2.1"
		8  | 
		9  |   providers = {
		10 |     aws.share-host   = aws.core-vpc # core-vpc-(environment) holds the networking for all accounts
		11 |     aws.share-tenant = aws          # The default provider (unaliased, `aws`) is the tenant
		12 |   }
		13 | 
		14 |   # s3 - used for logs and user ssh public keys
		15 |   bucket_name = "rds-bastion"
		16 | 
		17 |   # public keys
		18 |   public_key_data = local.public_key_data.keys[local.environment]
		19 | 
		20 |   # logs
		21 |   log_auto_clean       = "Enabled"
		22 |   log_standard_ia_days = 30  # days before moving to IA storage
		23 |   log_glacier_days     = 60  # days before moving to Glacier
		24 |   log_expiry_days      = 180 # days before log expiration
		25 | 
		26 |   # bastion
		27 |   # instance_name = "s3_rds_bastion_linux"
		28 | 
		29 |   allow_ssh_commands = true
		30 |   app_name           = var.networking[0].application
		31 |   business_unit      = local.vpc_name
		32 |   subnet_set         = local.subnet_set
		33 |   environment        = local.environment
		34 |   region             = "eu-west-2"
		35 |   volume_size        = 20
		36 |   # tags
		37 |   tags_common = local.tags
		38 |   tags_prefix = terraform.workspace
		39 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: zip_bastion
	File: /bastion_linux.tf:153-187
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		153 | module "zip_bastion" {
		154 |   source = "github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.2.1"
		155 | 
		156 |   providers = {
		157 |     aws.share-host   = aws.core-vpc # core-vpc-(environment) holds the networking for all accounts
		158 |     aws.share-tenant = aws          # The default provider (unaliased, `aws`) is the tenant
		159 |   }
		160 | 
		161 |   # s3 - used for logs and user ssh public keys
		162 |   bucket_name   = "zip-bastion"
		163 |   instance_name = "zip_bastion_linux"
		164 |   # public keys
		165 |   public_key_data = local.public_key_data.keys[local.environment]
		166 | 
		167 |   # logs
		168 |   log_auto_clean       = "Enabled"
		169 |   log_standard_ia_days = 30  # days before moving to IA storage
		170 |   log_glacier_days     = 60  # days before moving to Glacier
		171 |   log_expiry_days      = 180 # days before log expiration
		172 | 
		173 |   allow_ssh_commands = true
		174 |   # autoscaling_cron   = {
		175 |   #   "down": "0 20 * * *",
		176 |   #   "up": "*/30 * * * *"
		177 |   # }
		178 |   app_name      = var.networking[0].application
		179 |   business_unit = local.vpc_name
		180 |   subnet_set    = local.subnet_set
		181 |   environment   = local.environment
		182 |   region        = "eu-west-2"
		183 |   volume_size   = 96
		184 |   # tags
		185 |   tags_common = local.tags
		186 |   tags_prefix = terraform.workspace
		187 | }

Check: CKV_AWS_26: "Ensure all data stored in the SNS topic is encrypted"
	FAILED for resource: aws_sns_topic.s3_events
	File: /data_store.tf:17-19
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-15

		17 | resource "aws_sns_topic" "s3_events" {
		18 |   name = "${module.s3-data-bucket.bucket.id}-object-created-topic"
		19 | }

Check: CKV_AWS_115: "Ensure that AWS Lambda function is configured for function-level concurrent execution limit"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-function-level-concurrent-execution-limit

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_173: "Check encryption settings for Lambda environmental variable"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-5

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_116: "Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-a-dead-letter-queue-dlq

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_272: "Ensure AWS Lambda function is configured to validate code-signing"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-272

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_117: "Ensure that AWS Lambda function is configured inside a VPC"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-inside-a-vpc-1

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_115: "Ensure that AWS Lambda function is configured for function-level concurrent execution limit"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-function-level-concurrent-execution-limit

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_116: "Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-a-dead-letter-queue-dlq

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_272: "Ensure AWS Lambda function is configured to validate code-signing"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-272

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_117: "Ensure that AWS Lambda function is configured inside a VPC"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-inside-a-vpc-1

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group
	File: /dms_data_validation_glue_job.tf:65-68
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		65 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group" {
		66 |   name              = "dms-dv-glue-job"
		67 |   retention_in_days = 14
		68 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group
	File: /dms_data_validation_glue_job.tf:65-68
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		65 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group" {
		66 |   name              = "dms-dv-glue-job"
		67 |   retention_in_days = 14
		68 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group_v2
	File: /dms_data_validation_glue_job.tf:70-73
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		70 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group_v2" {
		71 |   name              = "dms-dv-glue-job-v2"
		72 |   retention_in_days = 14
		73 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group_v2
	File: /dms_data_validation_glue_job.tf:70-73
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		70 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group_v2" {
		71 |   name              = "dms-dv-glue-job-v2"
		72 |   retention_in_days = 14
		73 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.rds_to_s3_parquet_migration
	File: /dms_data_validation_glue_job.tf:75-78
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		75 | resource "aws_cloudwatch_log_group" "rds_to_s3_parquet_migration" {
		76 |   name              = "rds-to-s3-parquet-migration"
		77 |   retention_in_days = 14
		78 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.rds_to_s3_parquet_migration
	File: /dms_data_validation_glue_job.tf:75-78
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		75 | resource "aws_cloudwatch_log_group" "rds_to_s3_parquet_migration" {
		76 |   name              = "rds-to-s3-parquet-migration"
		77 |   retention_in_days = 14
		78 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.resizing_parquet_files
	File: /dms_data_validation_glue_job.tf:80-83
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		80 | resource "aws_cloudwatch_log_group" "resizing_parquet_files" {
		81 |   name              = "resizing-parquet-files"
		82 |   retention_in_days = 14
		83 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.resizing_parquet_files
	File: /dms_data_validation_glue_job.tf:80-83
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		80 | resource "aws_cloudwatch_log_group" "resizing_parquet_files" {
		81 |   name              = "resizing-parquet-files"
		82 |   retention_in_days = 14
		83 | }

Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.dms_dv_glue_job_v2
	File: /dms_data_validation_glue_job.tf:86-139
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.dms_dv_glue_job_v4d
	File: /dms_data_validation_glue_job.tf:147-200
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.rds_to_s3_parquet_migration
	File: /dms_data_validation_glue_job.tf:203-267
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.rds_to_s3_parquet_migration_monthly
	File: /dms_data_validation_glue_job.tf:271-324
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.resizing_parquet_files
	File: /dms_data_validation_glue_job.tf:327-379
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.catalog_dv_table_glue_job
	File: /dms_data_validation_glue_job.tf:382-410
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		382 | resource "aws_glue_job" "catalog_dv_table_glue_job" {
		383 |   name              = "catalog-dv-table-glue-job"
		384 |   description       = "Python script uses Boto3-Athena-Client to run sql-statements"
		385 |   role_arn          = aws_iam_role.dms_dv_glue_job_iam_role.arn
		386 |   glue_version      = "4.0"
		387 |   worker_type       = "G.1X"
		388 |   number_of_workers = 2
		389 |   default_arguments = {
		390 |     "--parquet_output_bucket_name"       = module.s3-dms-data-validation-bucket.bucket.id
		391 |     "--glue_catalog_db_name"             = aws_glue_catalog_database.dms_dv_glue_catalog_db.name
		392 |     "--glue_catalog_tbl_name"            = "glue_df_output"
		393 |     "--continuous-log-logGroup"          = aws_cloudwatch_log_group.dms_dv_cw_log_group.name
		394 |     "--enable-continuous-cloudwatch-log" = "true"
		395 |     "--enable-continuous-log-filter"     = "true"
		396 |     "--enable-metrics"                   = ""
		397 |   }
		398 |   command {
		399 |     python_version  = "3"
		400 |     script_location = "s3://${module.s3-glue-job-script-bucket.bucket.id}/create_or_replace_dv_table.py"
		401 |   }
		402 | 
		403 |   tags = merge(
		404 |     local.tags,
		405 |     {
		406 |       Resource_Type = "Py script as glue-job that creates dv table / refreshes its partitions",
		407 |     }
		408 |   )
		409 | 
		410 | }

Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_crawler.rds_sqlserver_db_glue_crawler
	File: /dms_glue_crawler.tf:35-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		35 | resource "aws_glue_crawler" "rds_sqlserver_db_glue_crawler" {
		36 |   name          = "rds-sqlserver-${aws_db_instance.database_2022.identifier}-tf"
		37 |   role          = aws_iam_role.dms_dv_glue_job_iam_role.arn
		38 |   database_name = aws_glue_catalog_database.rds_sqlserver_glue_catalog_db.name
		39 |   description   = "Crawler to fetch database names"
		40 |   #   table_prefix  = "your_table_prefix"
		41 | 
		42 |   jdbc_target {
		43 |     connection_name = aws_glue_connection.glue_rds_sqlserver_db_connection.name
		44 |     path            = "%"
		45 |   }
		46 |   tags = merge(
		47 |     local.tags,
		48 |     {
		49 |       Resource_Type = "RDS-SQLServer Glue-Crawler for DMS",
		50 |     }
		51 |   )
		52 | 
		53 |   # provisioner "local-exec" {
		54 |   #   command = "aws glue start-crawler --name ${self.name}"
		55 |   # }
		56 | }

Check: CKV_AWS_212: "Ensure DMS replication instance is encrypted by KMS using a customer managed Key (CMK)"
	FAILED for resource: aws_dms_replication_instance.dms_replication_instance
	File: /dms_replication_instance.tf:24-55
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-ebs-volume-is-encrypted-by-key-management-service-kms-using-a-customer-managed-key-cmk

		24 | resource "aws_dms_replication_instance" "dms_replication_instance" {
		25 |   allocated_storage          = var.dms_allocated_storage_gib
		26 |   apply_immediately          = true
		27 |   auto_minor_version_upgrade = true
		28 |   availability_zone          = var.dms_availability_zone
		29 |   engine_version             = var.dms_engine_version
		30 |   #   kms_key_arn                  = "arn:aws:kms:eu-west-2:800964199911:key/b7f54acb-16a3-4958-9340-3bdf5f5842d8"
		31 |   multi_az = false
		32 |   #   preferred_maintenance_window = "sun:10:30-sun:14:30"
		33 |   publicly_accessible         = false
		34 |   replication_instance_class  = var.dms_replication_instance_class
		35 |   replication_instance_id     = "dms-replication-instance-tf"
		36 |   replication_subnet_group_id = aws_dms_replication_subnet_group.dms_replication_subnet_group.id
		37 | 
		38 |   tags = merge(
		39 |     local.tags,
		40 |     {
		41 |       Resource_Type = "DMS Replication Instance",
		42 |     }
		43 |   )
		44 | 
		45 |   vpc_security_group_ids = [
		46 |     aws_security_group.dms_ri_security_group.id,
		47 |   ]
		48 | 
		49 |   depends_on = [
		50 |     aws_iam_role.dms_vpc_role,
		51 |     aws_iam_role.dms_cloudwatch_logs_role,
		52 |     aws_iam_role.dms_endpoint_role
		53 |   ]
		54 | 
		55 | }

Check: CKV_AWS_260: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 80"
	FAILED for resource: aws_vpc_security_group_ingress_rule.glue_rds_conn_inbound
	File: /dms_security_groups.tf:69-77
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-aws-security-groups-do-not-allow-ingress-from-00000-to-port-80

		69 | resource "aws_vpc_security_group_ingress_rule" "glue_rds_conn_inbound" {
		70 |   security_group_id = aws_security_group.glue_rds_conn_security_group.id
		71 | 
		72 |   referenced_security_group_id = aws_security_group.glue_rds_conn_security_group.id
		73 |   ip_protocol                  = "tcp"
		74 |   from_port                    = 0
		75 |   to_port                      = 65535
		76 |   description                  = "Required ports open for Glue-RDS-Connection"
		77 | }

Check: CKV_AWS_24: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 22"
	FAILED for resource: aws_vpc_security_group_ingress_rule.glue_rds_conn_inbound
	File: /dms_security_groups.tf:69-77
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-1-port-security

		69 | resource "aws_vpc_security_group_ingress_rule" "glue_rds_conn_inbound" {
		70 |   security_group_id = aws_security_group.glue_rds_conn_security_group.id
		71 | 
		72 |   referenced_security_group_id = aws_security_group.glue_rds_conn_security_group.id
		73 |   ip_protocol                  = "tcp"
		74 |   from_port                    = 0
		75 |   to_port                      = 65535
		76 |   description                  = "Required ports open for Glue-RDS-Connection"
		77 | }

Check: CKV_AWS_25: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389"
	FAILED for resource: aws_vpc_security_group_ingress_rule.glue_rds_conn_inbound
	File: /dms_security_groups.tf:69-77
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-2

		69 | resource "aws_vpc_security_group_ingress_rule" "glue_rds_conn_inbound" {
		70 |   security_group_id = aws_security_group.glue_rds_conn_security_group.id
		71 | 
		72 |   referenced_security_group_id = aws_security_group.glue_rds_conn_security_group.id
		73 |   ip_protocol                  = "tcp"
		74 |   from_port                    = 0
		75 |   to_port                      = 65535
		76 |   description                  = "Required ports open for Glue-RDS-Connection"
		77 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.glue_notebook_ec2_iam_policy_document
	File: /glue_data.tf:102-117
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		102 | data "aws_iam_policy_document" "glue_notebook_ec2_iam_policy_document" {
		103 |   statement {
		104 |     effect = "Allow"
		105 |     actions = [
		106 |       "ec2:CreateNetworkInterface",
		107 |       "ec2:DescribeNetworkInterfaces",
		108 |       "ec2:DeleteNetworkInterface",
		109 |       "ec2:DescribeVpcEndpoints",
		110 |       "ec2:DescribeSubnets",
		111 |       "ec2:DescribeVpcAttribute",
		112 |       "ec2:DescribeRouteTables",
		113 |       "ec2:DescribeSecurityGroups"
		114 |     ]
		115 |     resources = ["*"]
		116 |   }
		117 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.glue_notebook_ec2_iam_policy_document
	File: /glue_data.tf:102-117
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		102 | data "aws_iam_policy_document" "glue_notebook_ec2_iam_policy_document" {
		103 |   statement {
		104 |     effect = "Allow"
		105 |     actions = [
		106 |       "ec2:CreateNetworkInterface",
		107 |       "ec2:DescribeNetworkInterfaces",
		108 |       "ec2:DeleteNetworkInterface",
		109 |       "ec2:DescribeVpcEndpoints",
		110 |       "ec2:DescribeSubnets",
		111 |       "ec2:DescribeVpcAttribute",
		112 |       "ec2:DescribeRouteTables",
		113 |       "ec2:DescribeSecurityGroups"
		114 |     ]
		115 |     resources = ["*"]
		116 |   }
		117 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.load_json_table_s3_policy_document
	File: /lambdas_iam.tf:430-487
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.load_json_table_s3_policy_document
	File: /lambdas_iam.tf:430-487
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.db_glue_connection
	File: /lambdas_secrets.tf:1-3
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		1 | resource "aws_secretsmanager_secret" "db_glue_connection" {
		2 |   name = "db_glue_connection"
		3 | }

Check: CKV_AWS_296: "Ensure DMS endpoint uses Customer Managed Key (CMK)"
	FAILED for resource: module.dms_task.aws_dms_endpoint.dms_rds_source
	File: /modules/dms/endpoints_rds_s3.tf:2-23
	Calling File: /dms_main.tf:1-39
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-296

		2  | resource "aws_dms_endpoint" "dms_rds_source" {
		3  | 
		4  |   #   certificate_arn             = ""
		5  |   database_name = var.database_name
		6  |   endpoint_id   = "rds-mssql-${replace(var.database_name, "_", "-")}-tf"
		7  |   endpoint_type = "source"
		8  |   engine_name   = "sqlserver"
		9  |   #   extra_connection_attributes = ""
		10 |   #   kms_key_arn                 = aws_db_instance.database_2022.kms_key_id
		11 |   password    = var.rds_db_instance_pasword
		12 |   port        = var.rds_db_instance_port
		13 |   server_name = var.rds_db_server_name
		14 |   ssl_mode    = "require"
		15 |   username    = var.rds_db_username
		16 | 
		17 |   tags = merge(
		18 |     var.local_tags,
		19 |     {
		20 |       Resource_Type = "DMS Source Endpoint - RDS MSSQL",
		21 |     },
		22 |   )
		23 | }

Check: CKV_AWS_298: "Ensure DMS S3 uses Customer Managed Key (CMK)"
	FAILED for resource: module.dms_task.aws_dms_s3_endpoint.dms_s3_parquet_target
	File: /modules/dms/endpoints_rds_s3.tf:28-84
	Calling File: /dms_main.tf:1-39
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-298

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:38-47
	Calling File: /step_functions_main.tf:233-243
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		38 | data "aws_iam_policy_document" "step_function_base_permissions" {
		39 |   statement {
		40 |     effect = "Allow"
		41 |     actions = [
		42 |       "sns:Publish",
		43 |       "sqs:SendMessage"
		44 |     ]
		45 |     resources = ["*"]
		46 |   }
		47 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:38-47
	Calling File: /step_functions_main.tf:233-243
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		38 | data "aws_iam_policy_document" "step_function_base_permissions" {
		39 |   statement {
		40 |     effect = "Allow"
		41 |     actions = [
		42 |       "sns:Publish",
		43 |       "sqs:SendMessage"
		44 |     ]
		45 |     resources = ["*"]
		46 |   }
		47 | }

Check: CKV_AWS_109: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:54-82
	Calling File: /step_functions_main.tf:233-243
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-permissions-management-resource-exposure-without-constraint

		54 | data "aws_iam_policy_document" "this_log_key_document" {
		55 |   statement {
		56 |     sid    = "EnableIAMUserPermissions"
		57 |     effect = "Allow"
		58 |     principals {
		59 |       type        = "AWS"
		60 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		61 |     }
		62 |     actions   = ["kms:*"]
		63 |     resources = ["*"]
		64 |   }
		65 | 
		66 |   statement {
		67 |     sid    = "EnableLogServicePermissions"
		68 |     effect = "Allow"
		69 |     principals {
		70 |       type        = "Service"
		71 |       identifiers = ["logs.eu-west-2.amazonaws.com"]
		72 |     }
		73 |     actions = [
		74 |       "kms:Encrypt*",
		75 |       "kms:Decrypt*",
		76 |       "kms:ReEncrypt*",
		77 |       "kms:GenerateDataKey*",
		78 |       "kms:Describe*",
		79 |     ]
		80 |     resources = ["*"]
		81 |   }
		82 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:54-82
	Calling File: /step_functions_main.tf:233-243
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		54 | data "aws_iam_policy_document" "this_log_key_document" {
		55 |   statement {
		56 |     sid    = "EnableIAMUserPermissions"
		57 |     effect = "Allow"
		58 |     principals {
		59 |       type        = "AWS"
		60 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		61 |     }
		62 |     actions   = ["kms:*"]
		63 |     resources = ["*"]
		64 |   }
		65 | 
		66 |   statement {
		67 |     sid    = "EnableLogServicePermissions"
		68 |     effect = "Allow"
		69 |     principals {
		70 |       type        = "Service"
		71 |       identifiers = ["logs.eu-west-2.amazonaws.com"]
		72 |     }
		73 |     actions = [
		74 |       "kms:Encrypt*",
		75 |       "kms:Decrypt*",
		76 |       "kms:ReEncrypt*",
		77 |       "kms:GenerateDataKey*",
		78 |       "kms:Describe*",
		79 |     ]
		80 |     resources = ["*"]
		81 |   }
		82 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:54-82
	Calling File: /step_functions_main.tf:233-243
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		54 | data "aws_iam_policy_document" "this_log_key_document" {
		55 |   statement {
		56 |     sid    = "EnableIAMUserPermissions"
		57 |     effect = "Allow"
		58 |     principals {
		59 |       type        = "AWS"
		60 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		61 |     }
		62 |     actions   = ["kms:*"]
		63 |     resources = ["*"]
		64 |   }
		65 | 
		66 |   statement {
		67 |     sid    = "EnableLogServicePermissions"
		68 |     effect = "Allow"
		69 |     principals {
		70 |       type        = "Service"
		71 |       identifiers = ["logs.eu-west-2.amazonaws.com"]
		72 |     }
		73 |     actions = [
		74 |       "kms:Encrypt*",
		75 |       "kms:Decrypt*",
		76 |       "kms:ReEncrypt*",
		77 |       "kms:GenerateDataKey*",
		78 |       "kms:Describe*",
		79 |     ]
		80 |     resources = ["*"]
		81 |   }
		82 | }

Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: module.get_zipped_file.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:3-7
	Calling File: /step_functions_main.tf:233-243
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		3 | resource "aws_sfn_state_machine" "this" {
		4 |   name       = var.name
		5 |   role_arn   = aws_iam_role.step_function_role.arn
		6 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		7 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: module.get_zipped_file.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:3-7
	Calling File: /step_functions_main.tf:233-243
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		3 | resource "aws_sfn_state_machine" "this" {
		4 |   name       = var.name
		5 |   role_arn   = aws_iam_role.step_function_role.arn
		6 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		7 | }

Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.db_password
	File: /server_backups.tf:4-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		4 | resource "aws_secretsmanager_secret" "db_password" {
		5 |   name = "db_password"
		6 | }

Check: CKV_AWS_354: "Ensure RDS Performance Insights are encrypted using KMS CMKs"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-354

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_157: "Ensure that RDS instances have Multi-AZ enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-73

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_118: "Ensure that enhanced monitoring is enabled for Amazon RDS instances"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/ensure-that-enhanced-monitoring-is-enabled-for-amazon-rds-instances

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_353: "Ensure that RDS instances have performance insights enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-353

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_293: "Ensure that AWS database instances have deletion protection enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-293

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_129: "Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-that-respective-logs-of-amazon-relational-database-service-amazon-rds-are-enabled

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_260: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 80"
	FAILED for resource: aws_vpc_security_group_ingress_rule.db_glue_access
	File: /server_backups.tf:123-131
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-aws-security-groups-do-not-allow-ingress-from-00000-to-port-80

		123 | resource "aws_vpc_security_group_ingress_rule" "db_glue_access" {
		124 | 
		125 |   security_group_id            = aws_security_group.db.id
		126 |   description                  = "glue"
		127 |   ip_protocol                  = "tcp"
		128 |   from_port                    = 0
		129 |   to_port                      = 65535
		130 |   referenced_security_group_id = aws_security_group.db.id
		131 | }

Check: CKV_AWS_24: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 22"
	FAILED for resource: aws_vpc_security_group_ingress_rule.db_glue_access
	File: /server_backups.tf:123-131
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-1-port-security

		123 | resource "aws_vpc_security_group_ingress_rule" "db_glue_access" {
		124 | 
		125 |   security_group_id            = aws_security_group.db.id
		126 |   description                  = "glue"
		127 |   ip_protocol                  = "tcp"
		128 |   from_port                    = 0
		129 |   to_port                      = 65535
		130 |   referenced_security_group_id = aws_security_group.db.id
		131 | }

Check: CKV_AWS_25: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389"
	FAILED for resource: aws_vpc_security_group_ingress_rule.db_glue_access
	File: /server_backups.tf:123-131
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-2

		123 | resource "aws_vpc_security_group_ingress_rule" "db_glue_access" {
		124 | 
		125 |   security_group_id            = aws_security_group.db.id
		126 |   description                  = "glue"
		127 |   ip_protocol                  = "tcp"
		128 |   from_port                    = 0
		129 |   to_port                      = 65535
		130 |   referenced_security_group_id = aws_security_group.db.id
		131 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.send_database_to_ap_athena_queries
	File: /step_functions_iam.tf:151-196
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		151 | data "aws_iam_policy_document" "send_database_to_ap_athena_queries" {
		152 |   statement {
		153 |     effect = "Allow"
		154 | 
		155 |     actions = [
		156 |       "athena:startQueryExecution",
		157 |       "athena:getQueryExecution",
		158 |       "athena:getQueryResults"
		159 |     ]
		160 | 
		161 |     resources = [
		162 |       "*"
		163 |     ]
		164 |   }
		165 |   statement {
		166 |     effect = "Allow"
		167 | 
		168 |     actions = [
		169 |       "s3:PutObject",
		170 |       "s3:GetObject",
		171 |       "s3:ListBucket",
		172 |       "s3:GetBucketLocation"
		173 |     ]
		174 | 
		175 |     resources = [
		176 |       module.s3-athena-bucket.bucket.arn,
		177 |       "${module.s3-athena-bucket.bucket.arn}/*",
		178 |       "${module.s3-dms-data-validation-bucket.bucket.arn}/*",
		179 |       module.s3-dms-data-validation-bucket.bucket.arn
		180 |     ]
		181 |   }
		182 |   statement {
		183 |     effect = "Allow"
		184 | 
		185 |     actions = [
		186 |       "glue:GetDatabase",
		187 |       "glue:GetTable",
		188 |       "glue:GetPartitions",
		189 |       "glue:GetTables"
		190 |     ]
		191 | 
		192 |     resources = [
		193 |       "*"
		194 |     ]
		195 |   }
		196 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.send_database_to_ap_athena_queries
	File: /step_functions_iam.tf:151-196
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		151 | data "aws_iam_policy_document" "send_database_to_ap_athena_queries" {
		152 |   statement {
		153 |     effect = "Allow"
		154 | 
		155 |     actions = [
		156 |       "athena:startQueryExecution",
		157 |       "athena:getQueryExecution",
		158 |       "athena:getQueryResults"
		159 |     ]
		160 | 
		161 |     resources = [
		162 |       "*"
		163 |     ]
		164 |   }
		165 |   statement {
		166 |     effect = "Allow"
		167 | 
		168 |     actions = [
		169 |       "s3:PutObject",
		170 |       "s3:GetObject",
		171 |       "s3:ListBucket",
		172 |       "s3:GetBucketLocation"
		173 |     ]
		174 | 
		175 |     resources = [
		176 |       module.s3-athena-bucket.bucket.arn,
		177 |       "${module.s3-athena-bucket.bucket.arn}/*",
		178 |       "${module.s3-dms-data-validation-bucket.bucket.arn}/*",
		179 |       module.s3-dms-data-validation-bucket.bucket.arn
		180 |     ]
		181 |   }
		182 |   statement {
		183 |     effect = "Allow"
		184 | 
		185 |     actions = [
		186 |       "glue:GetDatabase",
		187 |       "glue:GetTable",
		188 |       "glue:GetPartitions",
		189 |       "glue:GetTables"
		190 |     ]
		191 | 
		192 |     resources = [
		193 |       "*"
		194 |     ]
		195 |   }
		196 | }

Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: aws_sfn_state_machine.athena_layer
	File: /step_functions_main.tf:1-36
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		1  | resource "aws_sfn_state_machine" "athena_layer" {
		2  |   name     = "athena-layer"
		3  |   role_arn = aws_iam_role.step_functions_role.arn
		4  | 
		5  |   definition = jsonencode(
		6  |     {
		7  |       "StartAt" : "GetMetadataList",
		8  |       "States" : {
		9  |         "GetMetadataList" : {
		10 |           "Type" : "Task",
		11 |           "Resource" : "${module.get_metadata_from_rds_lambda.lambda_function_arn}",
		12 |           "ResultPath" : "$.metadata_list",
		13 |           "Next" : "LoopThroughMetadataList"
		14 |         },
		15 |         "LoopThroughMetadataList" : {
		16 |           "Type" : "Map",
		17 |           "ItemsPath" : "$.metadata_list.metadata_list",
		18 |           "MaxConcurrency" : 4,
		19 |           "Iterator" : {
		20 |             "StartAt" : "CreateAthenaTable",
		21 |             "States" : {
		22 |               "CreateAthenaTable" : {
		23 |                 "Type" : "Task",
		24 |                 "Resource" : "${module.create_athena_table.lambda_function_arn}",
		25 |                 "ResultPath" : "$.result",
		26 |                 "End" : true
		27 |               }
		28 |             }
		29 |           },
		30 |           "End" : true
		31 |         }
		32 |       }
		33 |     }
		34 |   )
		35 | 
		36 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: aws_sfn_state_machine.athena_layer
	File: /step_functions_main.tf:1-36
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		1  | resource "aws_sfn_state_machine" "athena_layer" {
		2  |   name     = "athena-layer"
		3  |   role_arn = aws_iam_role.step_functions_role.arn
		4  | 
		5  |   definition = jsonencode(
		6  |     {
		7  |       "StartAt" : "GetMetadataList",
		8  |       "States" : {
		9  |         "GetMetadataList" : {
		10 |           "Type" : "Task",
		11 |           "Resource" : "${module.get_metadata_from_rds_lambda.lambda_function_arn}",
		12 |           "ResultPath" : "$.metadata_list",
		13 |           "Next" : "LoopThroughMetadataList"
		14 |         },
		15 |         "LoopThroughMetadataList" : {
		16 |           "Type" : "Map",
		17 |           "ItemsPath" : "$.metadata_list.metadata_list",
		18 |           "MaxConcurrency" : 4,
		19 |           "Iterator" : {
		20 |             "StartAt" : "CreateAthenaTable",
		21 |             "States" : {
		22 |               "CreateAthenaTable" : {
		23 |                 "Type" : "Task",
		24 |                 "Resource" : "${module.create_athena_table.lambda_function_arn}",
		25 |                 "ResultPath" : "$.result",
		26 |                 "End" : true
		27 |               }
		28 |             }
		29 |           },
		30 |           "End" : true
		31 |         }
		32 |       }
		33 |     }
		34 |   )
		35 | 
		36 | }

Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: aws_sfn_state_machine.send_database_to_ap
	File: /step_functions_main.tf:85-171
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: aws_sfn_state_machine.send_database_to_ap
	File: /step_functions_main.tf:85-171
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.db_glue_connection
	File: /lambdas_secrets.tf:1-3
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		1 | resource "aws_secretsmanager_secret" "db_glue_connection" {
		2 |   name = "db_glue_connection"
		3 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.db_password
	File: /server_backups.tf:4-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		4 | resource "aws_secretsmanager_secret" "db_password" {
		5 |   name = "db_password"
		6 | }

Check: CKV2_AWS_62: "Ensure S3 buckets should have event notifications enabled"
	FAILED for resource: aws_s3_bucket.data_store
	File: /s3.tf:1042-1061
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-2-62

		1042 | resource "aws_s3_bucket" "data_store" {
		1043 |   #checkov:skip:CKV_AWS_145
		1044 |   #checkov:skip:CKV_AWS_144
		1045 |   #checkov:skip:CKV_AWS_21
		1046 |   #checkov:skip:CKV2_AWS_65
		1047 |   #checkov:skip:CKV2_AWS_62
		1048 |   #checkov:skip:CKV_AWS_18
		1049 |   #checkov:skip:CKV2_AWS_61
		1050 |   bucket_prefix = "em-data-store-"
		1051 |   force_destroy = false
		1052 |   tags = {
		1053 |     "application"            = "electronic-monitoring-data"
		1054 |     "business-unit"          = "HMPPS"
		1055 |     "environment-name"       = "electronic-monitoring-data-production"
		1056 |     "infrastructure-support" = "dataengineering@digital.justice.gov.uk"
		1057 |     "is-production"          = "true"
		1058 |     "owner"                  = "Data engineering: dataengineering@digital.justice.gov.uk"
		1059 |     "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
		1060 |   }
		1061 | }

Check: CKV2_AWS_60: "Ensure RDS instance with copy tags to snapshots is enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-60

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: aws_security_group.glue_rds_conn_security_group
	File: /dms_security_groups.tf:46-57
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		46 | resource "aws_security_group" "glue_rds_conn_security_group" {
		47 |   name        = "glue-rds-sqlserver-connection-tf"
		48 |   description = "Secuity Group for Glue-RDS-Connection"
		49 |   vpc_id      = data.aws_vpc.shared.id
		50 | 
		51 |   tags = merge(
		52 |     local.tags,
		53 |     {
		54 |       Resource_Type = "Secuity Group for Glue-RDS-Connection",
		55 |     }
		56 |   )
		57 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: module.buddi.module.landing_zone_security_groups.aws_security_group.this
	File: /modules/landing_zone/server_security_group/main.tf:7-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		7  | resource "aws_security_group" "this" {
		8  |   name        = "${var.supplier}-${var.user_name}-inbound-ips"
		9  |   description = "Allowed IP addresses for ${var.user_name} on ${var.supplier} server"
		10 |   vpc_id      = var.vpc_id
		11 | 
		12 |   lifecycle {
		13 |     create_before_destroy = true
		14 |   }
		15 | 
		16 |   tags = merge(
		17 |     var.local_tags,
		18 |     {
		19 |       supplier = var.user_name,
		20 |     },
		21 |   )
		22 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: module.g4s.module.landing_zone_security_groups.aws_security_group.this
	File: /modules/landing_zone/server_security_group/main.tf:7-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		7  | resource "aws_security_group" "this" {
		8  |   name        = "${var.supplier}-${var.user_name}-inbound-ips"
		9  |   description = "Allowed IP addresses for ${var.user_name} on ${var.supplier} server"
		10 |   vpc_id      = var.vpc_id
		11 | 
		12 |   lifecycle {
		13 |     create_before_destroy = true
		14 |   }
		15 | 
		16 |   tags = merge(
		17 |     var.local_tags,
		18 |     {
		19 |       supplier = var.user_name,
		20 |     },
		21 |   )
		22 | }

Check: CKV_AWS_18: "Ensure the S3 bucket has access logging enabled"
	FAILED for resource: aws_s3_bucket.data_store
	File: /s3.tf:1042-1061
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-13-enable-logging

		1042 | resource "aws_s3_bucket" "data_store" {
		1043 |   #checkov:skip:CKV_AWS_145
		1044 |   #checkov:skip:CKV_AWS_144
		1045 |   #checkov:skip:CKV_AWS_21
		1046 |   #checkov:skip:CKV2_AWS_65
		1047 |   #checkov:skip:CKV2_AWS_62
		1048 |   #checkov:skip:CKV_AWS_18
		1049 |   #checkov:skip:CKV2_AWS_61
		1050 |   bucket_prefix = "em-data-store-"
		1051 |   force_destroy = false
		1052 |   tags = {
		1053 |     "application"            = "electronic-monitoring-data"
		1054 |     "business-unit"          = "HMPPS"
		1055 |     "environment-name"       = "electronic-monitoring-data-production"
		1056 |     "infrastructure-support" = "dataengineering@digital.justice.gov.uk"
		1057 |     "is-production"          = "true"
		1058 |     "owner"                  = "Data engineering: dataengineering@digital.justice.gov.uk"
		1059 |     "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
		1060 |   }
		1061 | }

Check: CKV_AWS_144: "Ensure that S3 bucket has cross-region replication enabled"
	FAILED for resource: aws_s3_bucket.data_store
	File: /s3.tf:1042-1061
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-s3-bucket-has-cross-region-replication-enabled

		1042 | resource "aws_s3_bucket" "data_store" {
		1043 |   #checkov:skip:CKV_AWS_145
		1044 |   #checkov:skip:CKV_AWS_144
		1045 |   #checkov:skip:CKV_AWS_21
		1046 |   #checkov:skip:CKV2_AWS_65
		1047 |   #checkov:skip:CKV2_AWS_62
		1048 |   #checkov:skip:CKV_AWS_18
		1049 |   #checkov:skip:CKV2_AWS_61
		1050 |   bucket_prefix = "em-data-store-"
		1051 |   force_destroy = false
		1052 |   tags = {
		1053 |     "application"            = "electronic-monitoring-data"
		1054 |     "business-unit"          = "HMPPS"
		1055 |     "environment-name"       = "electronic-monitoring-data-production"
		1056 |     "infrastructure-support" = "dataengineering@digital.justice.gov.uk"
		1057 |     "is-production"          = "true"
		1058 |     "owner"                  = "Data engineering: dataengineering@digital.justice.gov.uk"
		1059 |     "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
		1060 |   }
		1061 | }

Check: CKV2_AWS_65: "Ensure access control lists for S3 buckets are disabled"
	FAILED for resource: aws_s3_bucket_ownership_controls.bucket
	File: /s3.tf:1071-1076
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-general-112

		1071 | resource "aws_s3_bucket_ownership_controls" "bucket" {
		1072 |   bucket = aws_s3_bucket.data_store.id
		1073 |   rule {
		1074 |     object_ownership = "ObjectWriter"
		1075 |   }
		1076 | }

Check: CKV_AWS_145: "Ensure that S3 buckets are encrypted with KMS by default"
	FAILED for resource: aws_s3_bucket.data_store
	File: /s3.tf:1042-1061
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-s3-buckets-are-encrypted-with-kms-by-default

		1042 | resource "aws_s3_bucket" "data_store" {
		1043 |   #checkov:skip:CKV_AWS_145
		1044 |   #checkov:skip:CKV_AWS_144
		1045 |   #checkov:skip:CKV_AWS_21
		1046 |   #checkov:skip:CKV2_AWS_65
		1047 |   #checkov:skip:CKV2_AWS_62
		1048 |   #checkov:skip:CKV_AWS_18
		1049 |   #checkov:skip:CKV2_AWS_61
		1050 |   bucket_prefix = "em-data-store-"
		1051 |   force_destroy = false
		1052 |   tags = {
		1053 |     "application"            = "electronic-monitoring-data"
		1054 |     "business-unit"          = "HMPPS"
		1055 |     "environment-name"       = "electronic-monitoring-data-production"
		1056 |     "infrastructure-support" = "dataengineering@digital.justice.gov.uk"
		1057 |     "is-production"          = "true"
		1058 |     "owner"                  = "Data engineering: dataengineering@digital.justice.gov.uk"
		1059 |     "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
		1060 |   }
		1061 | }

Check: CKV_AWS_21: "Ensure all data stored in the S3 bucket have versioning enabled"
	FAILED for resource: aws_s3_bucket.data_store
	File: /s3.tf:1042-1061
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-16-enable-versioning

		1042 | resource "aws_s3_bucket" "data_store" {
		1043 |   #checkov:skip:CKV_AWS_145
		1044 |   #checkov:skip:CKV_AWS_144
		1045 |   #checkov:skip:CKV_AWS_21
		1046 |   #checkov:skip:CKV2_AWS_65
		1047 |   #checkov:skip:CKV2_AWS_62
		1048 |   #checkov:skip:CKV_AWS_18
		1049 |   #checkov:skip:CKV2_AWS_61
		1050 |   bucket_prefix = "em-data-store-"
		1051 |   force_destroy = false
		1052 |   tags = {
		1053 |     "application"            = "electronic-monitoring-data"
		1054 |     "business-unit"          = "HMPPS"
		1055 |     "environment-name"       = "electronic-monitoring-data-production"
		1056 |     "infrastructure-support" = "dataengineering@digital.justice.gov.uk"
		1057 |     "is-production"          = "true"
		1058 |     "owner"                  = "Data engineering: dataengineering@digital.justice.gov.uk"
		1059 |     "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
		1060 |   }
		1061 | }

Check: CKV2_AWS_61: "Ensure that an S3 bucket has a lifecycle configuration"
	FAILED for resource: aws_s3_bucket.data_store
	File: /s3.tf:1042-1061
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-2-61

		1042 | resource "aws_s3_bucket" "data_store" {
		1043 |   #checkov:skip:CKV_AWS_145
		1044 |   #checkov:skip:CKV_AWS_144
		1045 |   #checkov:skip:CKV_AWS_21
		1046 |   #checkov:skip:CKV2_AWS_65
		1047 |   #checkov:skip:CKV2_AWS_62
		1048 |   #checkov:skip:CKV_AWS_18
		1049 |   #checkov:skip:CKV2_AWS_61
		1050 |   bucket_prefix = "em-data-store-"
		1051 |   force_destroy = false
		1052 |   tags = {
		1053 |     "application"            = "electronic-monitoring-data"
		1054 |     "business-unit"          = "HMPPS"
		1055 |     "environment-name"       = "electronic-monitoring-data-production"
		1056 |     "infrastructure-support" = "dataengineering@digital.justice.gov.uk"
		1057 |     "is-production"          = "true"
		1058 |     "owner"                  = "Data engineering: dataengineering@digital.justice.gov.uk"
		1059 |     "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
		1060 |   }
		1061 | }

dockerfile scan results:

Passed checks: 21, Failed checks: 2, Skipped checks: 0

Check: CKV_DOCKER_2: "Ensure that HEALTHCHECK instructions have been added to container images"
	FAILED for resource: /lambdas/update_log_table/Dockerfile.
	File: /lambdas/update_log_table/Dockerfile:1-9
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/docker-policies/docker-policy-index/ensure-that-healthcheck-instructions-have-been-added-to-container-images

		1 | FROM public.ecr.aws/lambda/python:3.11
		2 | 
		3 | COPY requirements.txt .
		4 | 
		5 | RUN pip install -r requirements.txt --target "${LAMBDA_TASK_ROOT}"
		6 | 
		7 | COPY update_log_table.py ${LAMBDA_TASK_ROOT}
		8 | 
		9 | CMD ["update_log_table.handler"]

Check: CKV_DOCKER_3: "Ensure that a user for the container has been created"
	FAILED for resource: /lambdas/update_log_table/Dockerfile.
	File: /lambdas/update_log_table/Dockerfile:1-9
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/docker-policies/docker-policy-index/ensure-that-a-user-for-the-container-has-been-created

		1 | FROM public.ecr.aws/lambda/python:3.11
		2 | 
		3 | COPY requirements.txt .
		4 | 
		5 | RUN pip install -r requirements.txt --target "${LAMBDA_TASK_ROOT}"
		6 | 
		7 | COPY update_log_table.py ${LAMBDA_TASK_ROOT}
		8 | 
		9 | CMD ["update_log_table.handler"]


checkov_exitcode=1

CTFLint Scan Failed

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
terraform/environments/electronic-monitoring-data

*****************************

Running tflint in terraform/environments/electronic-monitoring-data
Excluding the following checks: terraform_unused_declarations
11 issue(s) found:

Warning: `s3_pylib_dir_path` variable has no type (terraform_typed_variables)

  on terraform/environments/electronic-monitoring-data/glue_variables.tf line 1:
   1: variable "s3_pylib_dir_path" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_typed_variables.md

Warning: Missing version constraint for provider "archive" in `required_providers` (terraform_required_providers)

  on terraform/environments/electronic-monitoring-data/lambdas_main.tf line 189:
 189: data "archive_file" "query_output_to_list" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

Warning: Missing version constraint for provider "random" in `required_providers` (terraform_required_providers)

  on terraform/environments/electronic-monitoring-data/server_backups.tf line 13:
  13: resource "random_password" "random_password" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 11:
  11:           "Resource" : "${module.get_metadata_from_rds_lambda.lambda_function_arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 24:
  24:                 "Resource" : "${module.create_athena_table.lambda_function_arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 98:
  98:             "WorkGroup" : "${aws_athena_workgroup.default.name}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 114:
 114:           "Resource" : "${module.query_output_to_list.lambda_function_arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 127:
 127:                 "Resource" : "${module.get_file_keys_for_table.lambda_function_arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 141:
 141:                       "Resource" : "${module.send_table_to_ap.lambda_function_arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 152:
 152:                 "Resource" : "${module.update_log_table.lambda_function_arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 164:
 164:             "WorkGroup" : "${aws_athena_workgroup.default.name}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

tflint_exitcode=2

Trivy Scan Failed

Show Output

*****************************

Trivy will check the following folders:
terraform/environments/electronic-monitoring-data

*****************************

Running Trivy in terraform/environments/electronic-monitoring-data
2024-10-10T09:28:42Z	INFO	[vulndb] Need to update DB
2024-10-10T09:28:42Z	INFO	[vulndb] Downloading vulnerability DB...
2024-10-10T09:28:42Z	INFO	[vulndb] Downloading artifact...	repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-10T09:28:44Z	INFO	[vulndb] Artifact successfully downloaded	repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-10T09:28:44Z	INFO	[vuln] Vulnerability scanning is enabled
2024-10-10T09:28:44Z	INFO	[misconfig] Misconfiguration scanning is enabled
2024-10-10T09:28:44Z	INFO	[misconfig] Need to update the built-in checks
2024-10-10T09:28:44Z	INFO	[misconfig] Downloading the built-in checks...
156.02 KiB / 156.02 KiB [---------------------------------------------------------] 100.00% ? p/s 0s2024-10-10T09:28:45Z	INFO	[secret] Secret scanning is enabled
2024-10-10T09:28:45Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-10T09:28:45Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-10-10T09:28:45Z	WARN	[pip] Unable to find python `site-packages` directory. License detection is skipped.	err="site-packages directory not found"
2024-10-10T09:28:46Z	INFO	[terraform scanner] Scanning root module	file_path="."
2024-10-10T09:28:46Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="networking"
2024-10-10T09:28:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T09:28:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T09:28:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T09:28:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T09:28:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T09:28:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.aws_s3_object.user_public_keys" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.data.aws_subnet.local_account" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T09:28:49Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T09:28:54Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-10T09:28:54Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-10T09:28:54Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-versioning" range="s3.tf:1042-1061"
2024-10-10T09:28:54Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-logging" range="s3.tf:1042-1061"
2024-10-10T09:28:54Z	INFO	[terraform executor] Ignore finding	rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:281-286"
2024-10-10T09:28:54Z	INFO	[terraform executor] Ignore finding	rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:407-411"
2024-10-10T09:28:54Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-bucket-encryption" range="s3.tf:1042-1061"
2024-10-10T09:28:54Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-10T09:28:54Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-10T09:28:54Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-10T09:28:54Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-10T09:28:54Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-10T09:28:54Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-10T09:28:54Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-10T09:28:54Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-10T09:28:54Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-10T09:28:54Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-10T09:28:54Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-10T09:28:54Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.2.1/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=568694e50e03630d99cb569eafa06a0b879a1239/main.tf:171-179"
2024-10-10T09:28:54Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="s3.tf:1042-1061"
2024-10-10T09:28:54Z	INFO	Number of language-specific files	num=1
2024-10-10T09:28:54Z	INFO	[pip] Detecting vulnerabilities...
2024-10-10T09:28:54Z	INFO	Detected config files	num=17

data_store.tf (terraform)
=========================
Tests: 1 (SUCCESSES: 0, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Topic does not have encryption enabled.
════════════════════════════════════════
Topics should be encrypted to protect their contents.


See https://avd.aquasec.com/misconfig/avd-aws-0095
────────────────────────────────────────
 data_store.tf:17-19
────────────────────────────────────────
  17 ┌ resource "aws_sns_topic" "s3_events" {
  18 │   name = "${module.s3-data-bucket.bucket.id}-object-created-topic"
  19 └ }
────────────────────────────────────────



lambdas/update_log_table/Dockerfile (dockerfile)
================================================
Tests: 20 (SUCCESSES: 19, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Specify at least 1 USER command in Dockerfile with non-root user as argument
════════════════════════════════════════
Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

See https://avd.aquasec.com/misconfig/ds002
────────────────────────────────────────


trivy_exitcode=1

[github-actions]

Trivy Scan Failed

Show Output

```hcl

---

Trivy will check the following folders:
terraform/environments/electronic-monitoring-data

---

Running Trivy in terraform/environments/electronic-monitoring-data
2024-10-10T10:15:15Z INFO [vulndb] Need to update DB
2024-10-10T10:15:15Z INFO [vulndb] Downloading vulnerability DB...
2024-10-10T10:15:15Z INFO [vulndb] Downloading artifact... repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-10T10:15:15Z ERROR [vulndb] Failed to download artifact repo="ghcr.io/aquasecurity/trivy-db:2" err="oci download error: failed to fetch the layer: GET https://ghcr.io/v2/aquasecurity/trivy-db/blobs/sha256:57a9180d97a1dc07fad121ef6d3537359af362216eab6bbe79ed84a2b885ecdc: TOOMANYREQUESTS: retry-after: 850.945µs, allowed: 44000/minute"
2024-10-10T10:15:15Z FATAL Fatal error init error: DB error: failed to download vulnerability DB: OCI artifact error: failed to download vulnerability DB: failed to download artifact from any source
trivy_exitcode=1

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/electronic-monitoring-data

*****************************

Running Checkov in terraform/environments/electronic-monitoring-data
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2024-10-10 10:15:17,598 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.2.1:None (for external modules, the --download-external-modules flag is required)
2024-10-10 10:15:17,598 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060:None (for external modules, the --download-external-modules flag is required)
2024-10-10 10:15:17,598 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/secrets-manager/aws:1.3.0 (for external modules, the --download-external-modules flag is required)
2024-10-10 10:15:17,598 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=52a40b0:None (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 2005, Failed checks: 76, Skipped checks: 25

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: rds_bastion
	File: /bastion_linux.tf:6-39
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		6  | module "rds_bastion" {
		7  |   source = "github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.2.1"
		8  | 
		9  |   providers = {
		10 |     aws.share-host   = aws.core-vpc # core-vpc-(environment) holds the networking for all accounts
		11 |     aws.share-tenant = aws          # The default provider (unaliased, `aws`) is the tenant
		12 |   }
		13 | 
		14 |   # s3 - used for logs and user ssh public keys
		15 |   bucket_name = "rds-bastion"
		16 | 
		17 |   # public keys
		18 |   public_key_data = local.public_key_data.keys[local.environment]
		19 | 
		20 |   # logs
		21 |   log_auto_clean       = "Enabled"
		22 |   log_standard_ia_days = 30  # days before moving to IA storage
		23 |   log_glacier_days     = 60  # days before moving to Glacier
		24 |   log_expiry_days      = 180 # days before log expiration
		25 | 
		26 |   # bastion
		27 |   # instance_name = "s3_rds_bastion_linux"
		28 | 
		29 |   allow_ssh_commands = true
		30 |   app_name           = var.networking[0].application
		31 |   business_unit      = local.vpc_name
		32 |   subnet_set         = local.subnet_set
		33 |   environment        = local.environment
		34 |   region             = "eu-west-2"
		35 |   volume_size        = 20
		36 |   # tags
		37 |   tags_common = local.tags
		38 |   tags_prefix = terraform.workspace
		39 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: zip_bastion
	File: /bastion_linux.tf:153-187
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		153 | module "zip_bastion" {
		154 |   source = "github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.2.1"
		155 | 
		156 |   providers = {
		157 |     aws.share-host   = aws.core-vpc # core-vpc-(environment) holds the networking for all accounts
		158 |     aws.share-tenant = aws          # The default provider (unaliased, `aws`) is the tenant
		159 |   }
		160 | 
		161 |   # s3 - used for logs and user ssh public keys
		162 |   bucket_name   = "zip-bastion"
		163 |   instance_name = "zip_bastion_linux"
		164 |   # public keys
		165 |   public_key_data = local.public_key_data.keys[local.environment]
		166 | 
		167 |   # logs
		168 |   log_auto_clean       = "Enabled"
		169 |   log_standard_ia_days = 30  # days before moving to IA storage
		170 |   log_glacier_days     = 60  # days before moving to Glacier
		171 |   log_expiry_days      = 180 # days before log expiration
		172 | 
		173 |   allow_ssh_commands = true
		174 |   # autoscaling_cron   = {
		175 |   #   "down": "0 20 * * *",
		176 |   #   "up": "*/30 * * * *"
		177 |   # }
		178 |   app_name      = var.networking[0].application
		179 |   business_unit = local.vpc_name
		180 |   subnet_set    = local.subnet_set
		181 |   environment   = local.environment
		182 |   region        = "eu-west-2"
		183 |   volume_size   = 96
		184 |   # tags
		185 |   tags_common = local.tags
		186 |   tags_prefix = terraform.workspace
		187 | }

Check: CKV_AWS_26: "Ensure all data stored in the SNS topic is encrypted"
	FAILED for resource: aws_sns_topic.s3_events
	File: /data_store.tf:17-19
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-15

		17 | resource "aws_sns_topic" "s3_events" {
		18 |   name = "${module.s3-data-bucket.bucket.id}-object-created-topic"
		19 | }

Check: CKV_AWS_115: "Ensure that AWS Lambda function is configured for function-level concurrent execution limit"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-function-level-concurrent-execution-limit

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_173: "Check encryption settings for Lambda environmental variable"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-5

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_116: "Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-a-dead-letter-queue-dlq

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_272: "Ensure AWS Lambda function is configured to validate code-signing"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-272

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_117: "Ensure that AWS Lambda function is configured inside a VPC"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-inside-a-vpc-1

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_115: "Ensure that AWS Lambda function is configured for function-level concurrent execution limit"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-function-level-concurrent-execution-limit

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_116: "Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-a-dead-letter-queue-dlq

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_272: "Ensure AWS Lambda function is configured to validate code-signing"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-272

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_117: "Ensure that AWS Lambda function is configured inside a VPC"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-inside-a-vpc-1

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group
	File: /dms_data_validation_glue_job.tf:65-68
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		65 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group" {
		66 |   name              = "dms-dv-glue-job"
		67 |   retention_in_days = 14
		68 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group
	File: /dms_data_validation_glue_job.tf:65-68
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		65 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group" {
		66 |   name              = "dms-dv-glue-job"
		67 |   retention_in_days = 14
		68 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group_v2
	File: /dms_data_validation_glue_job.tf:70-73
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		70 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group_v2" {
		71 |   name              = "dms-dv-glue-job-v2"
		72 |   retention_in_days = 14
		73 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group_v2
	File: /dms_data_validation_glue_job.tf:70-73
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		70 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group_v2" {
		71 |   name              = "dms-dv-glue-job-v2"
		72 |   retention_in_days = 14
		73 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.rds_to_s3_parquet_migration
	File: /dms_data_validation_glue_job.tf:75-78
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		75 | resource "aws_cloudwatch_log_group" "rds_to_s3_parquet_migration" {
		76 |   name              = "rds-to-s3-parquet-migration"
		77 |   retention_in_days = 14
		78 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.rds_to_s3_parquet_migration
	File: /dms_data_validation_glue_job.tf:75-78
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		75 | resource "aws_cloudwatch_log_group" "rds_to_s3_parquet_migration" {
		76 |   name              = "rds-to-s3-parquet-migration"
		77 |   retention_in_days = 14
		78 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.resizing_parquet_files
	File: /dms_data_validation_glue_job.tf:80-83
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		80 | resource "aws_cloudwatch_log_group" "resizing_parquet_files" {
		81 |   name              = "resizing-parquet-files"
		82 |   retention_in_days = 14
		83 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.resizing_parquet_files
	File: /dms_data_validation_glue_job.tf:80-83
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		80 | resource "aws_cloudwatch_log_group" "resizing_parquet_files" {
		81 |   name              = "resizing-parquet-files"
		82 |   retention_in_days = 14
		83 | }

Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.dms_dv_glue_job_v2
	File: /dms_data_validation_glue_job.tf:86-139
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.dms_dv_glue_job_v4d
	File: /dms_data_validation_glue_job.tf:147-200
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.rds_to_s3_parquet_migration
	File: /dms_data_validation_glue_job.tf:203-267
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.rds_to_s3_parquet_migration_monthly
	File: /dms_data_validation_glue_job.tf:271-325
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.resizing_parquet_files
	File: /dms_data_validation_glue_job.tf:328-380
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.catalog_dv_table_glue_job
	File: /dms_data_validation_glue_job.tf:383-411
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		383 | resource "aws_glue_job" "catalog_dv_table_glue_job" {
		384 |   name              = "catalog-dv-table-glue-job"
		385 |   description       = "Python script uses Boto3-Athena-Client to run sql-statements"
		386 |   role_arn          = aws_iam_role.dms_dv_glue_job_iam_role.arn
		387 |   glue_version      = "4.0"
		388 |   worker_type       = "G.1X"
		389 |   number_of_workers = 2
		390 |   default_arguments = {
		391 |     "--parquet_output_bucket_name"       = module.s3-dms-data-validation-bucket.bucket.id
		392 |     "--glue_catalog_db_name"             = aws_glue_catalog_database.dms_dv_glue_catalog_db.name
		393 |     "--glue_catalog_tbl_name"            = "glue_df_output"
		394 |     "--continuous-log-logGroup"          = aws_cloudwatch_log_group.dms_dv_cw_log_group.name
		395 |     "--enable-continuous-cloudwatch-log" = "true"
		396 |     "--enable-continuous-log-filter"     = "true"
		397 |     "--enable-metrics"                   = ""
		398 |   }
		399 |   command {
		400 |     python_version  = "3"
		401 |     script_location = "s3://${module.s3-glue-job-script-bucket.bucket.id}/create_or_replace_dv_table.py"
		402 |   }
		403 | 
		404 |   tags = merge(
		405 |     local.tags,
		406 |     {
		407 |       Resource_Type = "Py script as glue-job that creates dv table / refreshes its partitions",
		408 |     }
		409 |   )
		410 | 
		411 | }

Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_crawler.rds_sqlserver_db_glue_crawler
	File: /dms_glue_crawler.tf:35-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		35 | resource "aws_glue_crawler" "rds_sqlserver_db_glue_crawler" {
		36 |   name          = "rds-sqlserver-${aws_db_instance.database_2022.identifier}-tf"
		37 |   role          = aws_iam_role.dms_dv_glue_job_iam_role.arn
		38 |   database_name = aws_glue_catalog_database.rds_sqlserver_glue_catalog_db.name
		39 |   description   = "Crawler to fetch database names"
		40 |   #   table_prefix  = "your_table_prefix"
		41 | 
		42 |   jdbc_target {
		43 |     connection_name = aws_glue_connection.glue_rds_sqlserver_db_connection.name
		44 |     path            = "%"
		45 |   }
		46 |   tags = merge(
		47 |     local.tags,
		48 |     {
		49 |       Resource_Type = "RDS-SQLServer Glue-Crawler for DMS",
		50 |     }
		51 |   )
		52 | 
		53 |   # provisioner "local-exec" {
		54 |   #   command = "aws glue start-crawler --name ${self.name}"
		55 |   # }
		56 | }

Check: CKV_AWS_212: "Ensure DMS replication instance is encrypted by KMS using a customer managed Key (CMK)"
	FAILED for resource: aws_dms_replication_instance.dms_replication_instance
	File: /dms_replication_instance.tf:24-55
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-ebs-volume-is-encrypted-by-key-management-service-kms-using-a-customer-managed-key-cmk

		24 | resource "aws_dms_replication_instance" "dms_replication_instance" {
		25 |   allocated_storage          = var.dms_allocated_storage_gib
		26 |   apply_immediately          = true
		27 |   auto_minor_version_upgrade = true
		28 |   availability_zone          = var.dms_availability_zone
		29 |   engine_version             = var.dms_engine_version
		30 |   #   kms_key_arn                  = "arn:aws:kms:eu-west-2:800964199911:key/b7f54acb-16a3-4958-9340-3bdf5f5842d8"
		31 |   multi_az = false
		32 |   #   preferred_maintenance_window = "sun:10:30-sun:14:30"
		33 |   publicly_accessible         = false
		34 |   replication_instance_class  = var.dms_replication_instance_class
		35 |   replication_instance_id     = "dms-replication-instance-tf"
		36 |   replication_subnet_group_id = aws_dms_replication_subnet_group.dms_replication_subnet_group.id
		37 | 
		38 |   tags = merge(
		39 |     local.tags,
		40 |     {
		41 |       Resource_Type = "DMS Replication Instance",
		42 |     }
		43 |   )
		44 | 
		45 |   vpc_security_group_ids = [
		46 |     aws_security_group.dms_ri_security_group.id,
		47 |   ]
		48 | 
		49 |   depends_on = [
		50 |     aws_iam_role.dms_vpc_role,
		51 |     aws_iam_role.dms_cloudwatch_logs_role,
		52 |     aws_iam_role.dms_endpoint_role
		53 |   ]
		54 | 
		55 | }

Check: CKV_AWS_260: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 80"
	FAILED for resource: aws_vpc_security_group_ingress_rule.glue_rds_conn_inbound
	File: /dms_security_groups.tf:69-77
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-aws-security-groups-do-not-allow-ingress-from-00000-to-port-80

		69 | resource "aws_vpc_security_group_ingress_rule" "glue_rds_conn_inbound" {
		70 |   security_group_id = aws_security_group.glue_rds_conn_security_group.id
		71 | 
		72 |   referenced_security_group_id = aws_security_group.glue_rds_conn_security_group.id
		73 |   ip_protocol                  = "tcp"
		74 |   from_port                    = 0
		75 |   to_port                      = 65535
		76 |   description                  = "Required ports open for Glue-RDS-Connection"
		77 | }

Check: CKV_AWS_24: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 22"
	FAILED for resource: aws_vpc_security_group_ingress_rule.glue_rds_conn_inbound
	File: /dms_security_groups.tf:69-77
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-1-port-security

		69 | resource "aws_vpc_security_group_ingress_rule" "glue_rds_conn_inbound" {
		70 |   security_group_id = aws_security_group.glue_rds_conn_security_group.id
		71 | 
		72 |   referenced_security_group_id = aws_security_group.glue_rds_conn_security_group.id
		73 |   ip_protocol                  = "tcp"
		74 |   from_port                    = 0
		75 |   to_port                      = 65535
		76 |   description                  = "Required ports open for Glue-RDS-Connection"
		77 | }

Check: CKV_AWS_25: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389"
	FAILED for resource: aws_vpc_security_group_ingress_rule.glue_rds_conn_inbound
	File: /dms_security_groups.tf:69-77
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-2

		69 | resource "aws_vpc_security_group_ingress_rule" "glue_rds_conn_inbound" {
		70 |   security_group_id = aws_security_group.glue_rds_conn_security_group.id
		71 | 
		72 |   referenced_security_group_id = aws_security_group.glue_rds_conn_security_group.id
		73 |   ip_protocol                  = "tcp"
		74 |   from_port                    = 0
		75 |   to_port                      = 65535
		76 |   description                  = "Required ports open for Glue-RDS-Connection"
		77 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.glue_notebook_ec2_iam_policy_document
	File: /glue_data.tf:102-117
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		102 | data "aws_iam_policy_document" "glue_notebook_ec2_iam_policy_document" {
		103 |   statement {
		104 |     effect = "Allow"
		105 |     actions = [
		106 |       "ec2:CreateNetworkInterface",
		107 |       "ec2:DescribeNetworkInterfaces",
		108 |       "ec2:DeleteNetworkInterface",
		109 |       "ec2:DescribeVpcEndpoints",
		110 |       "ec2:DescribeSubnets",
		111 |       "ec2:DescribeVpcAttribute",
		112 |       "ec2:DescribeRouteTables",
		113 |       "ec2:DescribeSecurityGroups"
		114 |     ]
		115 |     resources = ["*"]
		116 |   }
		117 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.glue_notebook_ec2_iam_policy_document
	File: /glue_data.tf:102-117
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		102 | data "aws_iam_policy_document" "glue_notebook_ec2_iam_policy_document" {
		103 |   statement {
		104 |     effect = "Allow"
		105 |     actions = [
		106 |       "ec2:CreateNetworkInterface",
		107 |       "ec2:DescribeNetworkInterfaces",
		108 |       "ec2:DeleteNetworkInterface",
		109 |       "ec2:DescribeVpcEndpoints",
		110 |       "ec2:DescribeSubnets",
		111 |       "ec2:DescribeVpcAttribute",
		112 |       "ec2:DescribeRouteTables",
		113 |       "ec2:DescribeSecurityGroups"
		114 |     ]
		115 |     resources = ["*"]
		116 |   }
		117 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.load_json_table_s3_policy_document
	File: /lambdas_iam.tf:430-487
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.load_json_table_s3_policy_document
	File: /lambdas_iam.tf:430-487
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.db_glue_connection
	File: /lambdas_secrets.tf:1-3
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		1 | resource "aws_secretsmanager_secret" "db_glue_connection" {
		2 |   name = "db_glue_connection"
		3 | }

Check: CKV_AWS_296: "Ensure DMS endpoint uses Customer Managed Key (CMK)"
	FAILED for resource: module.dms_task.aws_dms_endpoint.dms_rds_source
	File: /modules/dms/endpoints_rds_s3.tf:2-23
	Calling File: /dms_main.tf:1-39
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-296

		2  | resource "aws_dms_endpoint" "dms_rds_source" {
		3  | 
		4  |   #   certificate_arn             = ""
		5  |   database_name = var.database_name
		6  |   endpoint_id   = "rds-mssql-${replace(var.database_name, "_", "-")}-tf"
		7  |   endpoint_type = "source"
		8  |   engine_name   = "sqlserver"
		9  |   #   extra_connection_attributes = ""
		10 |   #   kms_key_arn                 = aws_db_instance.database_2022.kms_key_id
		11 |   password    = var.rds_db_instance_pasword
		12 |   port        = var.rds_db_instance_port
		13 |   server_name = var.rds_db_server_name
		14 |   ssl_mode    = "require"
		15 |   username    = var.rds_db_username
		16 | 
		17 |   tags = merge(
		18 |     var.local_tags,
		19 |     {
		20 |       Resource_Type = "DMS Source Endpoint - RDS MSSQL",
		21 |     },
		22 |   )
		23 | }

Check: CKV_AWS_298: "Ensure DMS S3 uses Customer Managed Key (CMK)"
	FAILED for resource: module.dms_task.aws_dms_s3_endpoint.dms_s3_parquet_target
	File: /modules/dms/endpoints_rds_s3.tf:28-84
	Calling File: /dms_main.tf:1-39
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-298

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: module.get_zipped_file.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:3-7
	Calling File: /step_functions_main.tf:233-243
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		3 | resource "aws_sfn_state_machine" "this" {
		4 |   name       = var.name
		5 |   role_arn   = aws_iam_role.step_function_role.arn
		6 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		7 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: module.get_zipped_file.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:3-7
	Calling File: /step_functions_main.tf:233-243
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		3 | resource "aws_sfn_state_machine" "this" {
		4 |   name       = var.name
		5 |   role_arn   = aws_iam_role.step_function_role.arn
		6 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		7 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:38-47
	Calling File: /step_functions_main.tf:233-243
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		38 | data "aws_iam_policy_document" "step_function_base_permissions" {
		39 |   statement {
		40 |     effect = "Allow"
		41 |     actions = [
		42 |       "sns:Publish",
		43 |       "sqs:SendMessage"
		44 |     ]
		45 |     resources = ["*"]
		46 |   }
		47 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:38-47
	Calling File: /step_functions_main.tf:233-243
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		38 | data "aws_iam_policy_document" "step_function_base_permissions" {
		39 |   statement {
		40 |     effect = "Allow"
		41 |     actions = [
		42 |       "sns:Publish",
		43 |       "sqs:SendMessage"
		44 |     ]
		45 |     resources = ["*"]
		46 |   }
		47 | }

Check: CKV_AWS_109: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:54-82
	Calling File: /step_functions_main.tf:233-243
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-permissions-management-resource-exposure-without-constraint

		54 | data "aws_iam_policy_document" "this_log_key_document" {
		55 |   statement {
		56 |     sid    = "EnableIAMUserPermissions"
		57 |     effect = "Allow"
		58 |     principals {
		59 |       type        = "AWS"
		60 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		61 |     }
		62 |     actions   = ["kms:*"]
		63 |     resources = ["*"]
		64 |   }
		65 | 
		66 |   statement {
		67 |     sid    = "EnableLogServicePermissions"
		68 |     effect = "Allow"
		69 |     principals {
		70 |       type        = "Service"
		71 |       identifiers = ["logs.eu-west-2.amazonaws.com"]
		72 |     }
		73 |     actions = [
		74 |       "kms:Encrypt*",
		75 |       "kms:Decrypt*",
		76 |       "kms:ReEncrypt*",
		77 |       "kms:GenerateDataKey*",
		78 |       "kms:Describe*",
		79 |     ]
		80 |     resources = ["*"]
		81 |   }
		82 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:54-82
	Calling File: /step_functions_main.tf:233-243
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		54 | data "aws_iam_policy_document" "this_log_key_document" {
		55 |   statement {
		56 |     sid    = "EnableIAMUserPermissions"
		57 |     effect = "Allow"
		58 |     principals {
		59 |       type        = "AWS"
		60 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		61 |     }
		62 |     actions   = ["kms:*"]
		63 |     resources = ["*"]
		64 |   }
		65 | 
		66 |   statement {
		67 |     sid    = "EnableLogServicePermissions"
		68 |     effect = "Allow"
		69 |     principals {
		70 |       type        = "Service"
		71 |       identifiers = ["logs.eu-west-2.amazonaws.com"]
		72 |     }
		73 |     actions = [
		74 |       "kms:Encrypt*",
		75 |       "kms:Decrypt*",
		76 |       "kms:ReEncrypt*",
		77 |       "kms:GenerateDataKey*",
		78 |       "kms:Describe*",
		79 |     ]
		80 |     resources = ["*"]
		81 |   }
		82 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:54-82
	Calling File: /step_functions_main.tf:233-243
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		54 | data "aws_iam_policy_document" "this_log_key_document" {
		55 |   statement {
		56 |     sid    = "EnableIAMUserPermissions"
		57 |     effect = "Allow"
		58 |     principals {
		59 |       type        = "AWS"
		60 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		61 |     }
		62 |     actions   = ["kms:*"]
		63 |     resources = ["*"]
		64 |   }
		65 | 
		66 |   statement {
		67 |     sid    = "EnableLogServicePermissions"
		68 |     effect = "Allow"
		69 |     principals {
		70 |       type        = "Service"
		71 |       identifiers = ["logs.eu-west-2.amazonaws.com"]
		72 |     }
		73 |     actions = [
		74 |       "kms:Encrypt*",
		75 |       "kms:Decrypt*",
		76 |       "kms:ReEncrypt*",
		77 |       "kms:GenerateDataKey*",
		78 |       "kms:Describe*",
		79 |     ]
		80 |     resources = ["*"]
		81 |   }
		82 | }

Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.db_password
	File: /server_backups.tf:4-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		4 | resource "aws_secretsmanager_secret" "db_password" {
		5 |   name = "db_password"
		6 | }

Check: CKV_AWS_354: "Ensure RDS Performance Insights are encrypted using KMS CMKs"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-354

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_157: "Ensure that RDS instances have Multi-AZ enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-73

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_118: "Ensure that enhanced monitoring is enabled for Amazon RDS instances"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/ensure-that-enhanced-monitoring-is-enabled-for-amazon-rds-instances

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_353: "Ensure that RDS instances have performance insights enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-353

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_293: "Ensure that AWS database instances have deletion protection enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-293

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_129: "Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-that-respective-logs-of-amazon-relational-database-service-amazon-rds-are-enabled

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_260: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 80"
	FAILED for resource: aws_vpc_security_group_ingress_rule.db_glue_access
	File: /server_backups.tf:123-131
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-aws-security-groups-do-not-allow-ingress-from-00000-to-port-80

		123 | resource "aws_vpc_security_group_ingress_rule" "db_glue_access" {
		124 | 
		125 |   security_group_id            = aws_security_group.db.id
		126 |   description                  = "glue"
		127 |   ip_protocol                  = "tcp"
		128 |   from_port                    = 0
		129 |   to_port                      = 65535
		130 |   referenced_security_group_id = aws_security_group.db.id
		131 | }

Check: CKV_AWS_24: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 22"
	FAILED for resource: aws_vpc_security_group_ingress_rule.db_glue_access
	File: /server_backups.tf:123-131
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-1-port-security

		123 | resource "aws_vpc_security_group_ingress_rule" "db_glue_access" {
		124 | 
		125 |   security_group_id            = aws_security_group.db.id
		126 |   description                  = "glue"
		127 |   ip_protocol                  = "tcp"
		128 |   from_port                    = 0
		129 |   to_port                      = 65535
		130 |   referenced_security_group_id = aws_security_group.db.id
		131 | }

Check: CKV_AWS_25: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389"
	FAILED for resource: aws_vpc_security_group_ingress_rule.db_glue_access
	File: /server_backups.tf:123-131
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-2

		123 | resource "aws_vpc_security_group_ingress_rule" "db_glue_access" {
		124 | 
		125 |   security_group_id            = aws_security_group.db.id
		126 |   description                  = "glue"
		127 |   ip_protocol                  = "tcp"
		128 |   from_port                    = 0
		129 |   to_port                      = 65535
		130 |   referenced_security_group_id = aws_security_group.db.id
		131 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.send_database_to_ap_athena_queries
	File: /step_functions_iam.tf:151-196
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		151 | data "aws_iam_policy_document" "send_database_to_ap_athena_queries" {
		152 |   statement {
		153 |     effect = "Allow"
		154 | 
		155 |     actions = [
		156 |       "athena:startQueryExecution",
		157 |       "athena:getQueryExecution",
		158 |       "athena:getQueryResults"
		159 |     ]
		160 | 
		161 |     resources = [
		162 |       "*"
		163 |     ]
		164 |   }
		165 |   statement {
		166 |     effect = "Allow"
		167 | 
		168 |     actions = [
		169 |       "s3:PutObject",
		170 |       "s3:GetObject",
		171 |       "s3:ListBucket",
		172 |       "s3:GetBucketLocation"
		173 |     ]
		174 | 
		175 |     resources = [
		176 |       module.s3-athena-bucket.bucket.arn,
		177 |       "${module.s3-athena-bucket.bucket.arn}/*",
		178 |       "${module.s3-dms-data-validation-bucket.bucket.arn}/*",
		179 |       module.s3-dms-data-validation-bucket.bucket.arn
		180 |     ]
		181 |   }
		182 |   statement {
		183 |     effect = "Allow"
		184 | 
		185 |     actions = [
		186 |       "glue:GetDatabase",
		187 |       "glue:GetTable",
		188 |       "glue:GetPartitions",
		189 |       "glue:GetTables"
		190 |     ]
		191 | 
		192 |     resources = [
		193 |       "*"
		194 |     ]
		195 |   }
		196 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.send_database_to_ap_athena_queries
	File: /step_functions_iam.tf:151-196
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		151 | data "aws_iam_policy_document" "send_database_to_ap_athena_queries" {
		152 |   statement {
		153 |     effect = "Allow"
		154 | 
		155 |     actions = [
		156 |       "athena:startQueryExecution",
		157 |       "athena:getQueryExecution",
		158 |       "athena:getQueryResults"
		159 |     ]
		160 | 
		161 |     resources = [
		162 |       "*"
		163 |     ]
		164 |   }
		165 |   statement {
		166 |     effect = "Allow"
		167 | 
		168 |     actions = [
		169 |       "s3:PutObject",
		170 |       "s3:GetObject",
		171 |       "s3:ListBucket",
		172 |       "s3:GetBucketLocation"
		173 |     ]
		174 | 
		175 |     resources = [
		176 |       module.s3-athena-bucket.bucket.arn,
		177 |       "${module.s3-athena-bucket.bucket.arn}/*",
		178 |       "${module.s3-dms-data-validation-bucket.bucket.arn}/*",
		179 |       module.s3-dms-data-validation-bucket.bucket.arn
		180 |     ]
		181 |   }
		182 |   statement {
		183 |     effect = "Allow"
		184 | 
		185 |     actions = [
		186 |       "glue:GetDatabase",
		187 |       "glue:GetTable",
		188 |       "glue:GetPartitions",
		189 |       "glue:GetTables"
		190 |     ]
		191 | 
		192 |     resources = [
		193 |       "*"
		194 |     ]
		195 |   }
		196 | }

Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: aws_sfn_state_machine.athena_layer
	File: /step_functions_main.tf:1-36
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		1  | resource "aws_sfn_state_machine" "athena_layer" {
		2  |   name     = "athena-layer"
		3  |   role_arn = aws_iam_role.step_functions_role.arn
		4  | 
		5  |   definition = jsonencode(
		6  |     {
		7  |       "StartAt" : "GetMetadataList",
		8  |       "States" : {
		9  |         "GetMetadataList" : {
		10 |           "Type" : "Task",
		11 |           "Resource" : "${module.get_metadata_from_rds_lambda.lambda_function_arn}",
		12 |           "ResultPath" : "$.metadata_list",
		13 |           "Next" : "LoopThroughMetadataList"
		14 |         },
		15 |         "LoopThroughMetadataList" : {
		16 |           "Type" : "Map",
		17 |           "ItemsPath" : "$.metadata_list.metadata_list",
		18 |           "MaxConcurrency" : 4,
		19 |           "Iterator" : {
		20 |             "StartAt" : "CreateAthenaTable",
		21 |             "States" : {
		22 |               "CreateAthenaTable" : {
		23 |                 "Type" : "Task",
		24 |                 "Resource" : "${module.create_athena_table.lambda_function_arn}",
		25 |                 "ResultPath" : "$.result",
		26 |                 "End" : true
		27 |               }
		28 |             }
		29 |           },
		30 |           "End" : true
		31 |         }
		32 |       }
		33 |     }
		34 |   )
		35 | 
		36 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: aws_sfn_state_machine.athena_layer
	File: /step_functions_main.tf:1-36
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		1  | resource "aws_sfn_state_machine" "athena_layer" {
		2  |   name     = "athena-layer"
		3  |   role_arn = aws_iam_role.step_functions_role.arn
		4  | 
		5  |   definition = jsonencode(
		6  |     {
		7  |       "StartAt" : "GetMetadataList",
		8  |       "States" : {
		9  |         "GetMetadataList" : {
		10 |           "Type" : "Task",
		11 |           "Resource" : "${module.get_metadata_from_rds_lambda.lambda_function_arn}",
		12 |           "ResultPath" : "$.metadata_list",
		13 |           "Next" : "LoopThroughMetadataList"
		14 |         },
		15 |         "LoopThroughMetadataList" : {
		16 |           "Type" : "Map",
		17 |           "ItemsPath" : "$.metadata_list.metadata_list",
		18 |           "MaxConcurrency" : 4,
		19 |           "Iterator" : {
		20 |             "StartAt" : "CreateAthenaTable",
		21 |             "States" : {
		22 |               "CreateAthenaTable" : {
		23 |                 "Type" : "Task",
		24 |                 "Resource" : "${module.create_athena_table.lambda_function_arn}",
		25 |                 "ResultPath" : "$.result",
		26 |                 "End" : true
		27 |               }
		28 |             }
		29 |           },
		30 |           "End" : true
		31 |         }
		32 |       }
		33 |     }
		34 |   )
		35 | 
		36 | }

Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: aws_sfn_state_machine.send_database_to_ap
	File: /step_functions_main.tf:85-171
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: aws_sfn_state_machine.send_database_to_ap
	File: /step_functions_main.tf:85-171
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.db_glue_connection
	File: /lambdas_secrets.tf:1-3
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		1 | resource "aws_secretsmanager_secret" "db_glue_connection" {
		2 |   name = "db_glue_connection"
		3 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.db_password
	File: /server_backups.tf:4-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		4 | resource "aws_secretsmanager_secret" "db_password" {
		5 |   name = "db_password"
		6 | }

Check: CKV2_AWS_62: "Ensure S3 buckets should have event notifications enabled"
	FAILED for resource: aws_s3_bucket.data_store
	File: /s3.tf:1042-1061
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-2-62

		1042 | resource "aws_s3_bucket" "data_store" {
		1043 |   #checkov:skip:CKV_AWS_145
		1044 |   #checkov:skip:CKV_AWS_144
		1045 |   #checkov:skip:CKV_AWS_21
		1046 |   #checkov:skip:CKV2_AWS_65
		1047 |   #checkov:skip:CKV2_AWS_62
		1048 |   #checkov:skip:CKV_AWS_18
		1049 |   #checkov:skip:CKV2_AWS_61
		1050 |   bucket_prefix = "em-data-store-"
		1051 |   force_destroy = false
		1052 |   tags = {
		1053 |     "application"            = "electronic-monitoring-data"
		1054 |     "business-unit"          = "HMPPS"
		1055 |     "environment-name"       = "electronic-monitoring-data-production"
		1056 |     "infrastructure-support" = "dataengineering@digital.justice.gov.uk"
		1057 |     "is-production"          = "true"
		1058 |     "owner"                  = "Data engineering: dataengineering@digital.justice.gov.uk"
		1059 |     "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
		1060 |   }
		1061 | }

Check: CKV_AWS_18: "Ensure the S3 bucket has access logging enabled"
	FAILED for resource: aws_s3_bucket.data_store
	File: /s3.tf:1042-1061
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-13-enable-logging

		1042 | resource "aws_s3_bucket" "data_store" {
		1043 |   #checkov:skip:CKV_AWS_145
		1044 |   #checkov:skip:CKV_AWS_144
		1045 |   #checkov:skip:CKV_AWS_21
		1046 |   #checkov:skip:CKV2_AWS_65
		1047 |   #checkov:skip:CKV2_AWS_62
		1048 |   #checkov:skip:CKV_AWS_18
		1049 |   #checkov:skip:CKV2_AWS_61
		1050 |   bucket_prefix = "em-data-store-"
		1051 |   force_destroy = false
		1052 |   tags = {
		1053 |     "application"            = "electronic-monitoring-data"
		1054 |     "business-unit"          = "HMPPS"
		1055 |     "environment-name"       = "electronic-monitoring-data-production"
		1056 |     "infrastructure-support" = "dataengineering@digital.justice.gov.uk"
		1057 |     "is-production"          = "true"
		1058 |     "owner"                  = "Data engineering: dataengineering@digital.justice.gov.uk"
		1059 |     "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
		1060 |   }
		1061 | }

Check: CKV2_AWS_60: "Ensure RDS instance with copy tags to snapshots is enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-60

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: aws_security_group.glue_rds_conn_security_group
	File: /dms_security_groups.tf:46-57
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		46 | resource "aws_security_group" "glue_rds_conn_security_group" {
		47 |   name        = "glue-rds-sqlserver-connection-tf"
		48 |   description = "Secuity Group for Glue-RDS-Connection"
		49 |   vpc_id      = data.aws_vpc.shared.id
		50 | 
		51 |   tags = merge(
		52 |     local.tags,
		53 |     {
		54 |       Resource_Type = "Secuity Group for Glue-RDS-Connection",
		55 |     }
		56 |   )
		57 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: module.buddi.module.landing_zone_security_groups.aws_security_group.this
	File: /modules/landing_zone/server_security_group/main.tf:7-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		7  | resource "aws_security_group" "this" {
		8  |   name        = "${var.supplier}-${var.user_name}-inbound-ips"
		9  |   description = "Allowed IP addresses for ${var.user_name} on ${var.supplier} server"
		10 |   vpc_id      = var.vpc_id
		11 | 
		12 |   lifecycle {
		13 |     create_before_destroy = true
		14 |   }
		15 | 
		16 |   tags = merge(
		17 |     var.local_tags,
		18 |     {
		19 |       supplier = var.user_name,
		20 |     },
		21 |   )
		22 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: module.g4s.module.landing_zone_security_groups.aws_security_group.this
	File: /modules/landing_zone/server_security_group/main.tf:7-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		7  | resource "aws_security_group" "this" {
		8  |   name        = "${var.supplier}-${var.user_name}-inbound-ips"
		9  |   description = "Allowed IP addresses for ${var.user_name} on ${var.supplier} server"
		10 |   vpc_id      = var.vpc_id
		11 | 
		12 |   lifecycle {
		13 |     create_before_destroy = true
		14 |   }
		15 | 
		16 |   tags = merge(
		17 |     var.local_tags,
		18 |     {
		19 |       supplier = var.user_name,
		20 |     },
		21 |   )
		22 | }

Check: CKV_AWS_144: "Ensure that S3 bucket has cross-region replication enabled"
	FAILED for resource: aws_s3_bucket.data_store
	File: /s3.tf:1042-1061
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-s3-bucket-has-cross-region-replication-enabled

		1042 | resource "aws_s3_bucket" "data_store" {
		1043 |   #checkov:skip:CKV_AWS_145
		1044 |   #checkov:skip:CKV_AWS_144
		1045 |   #checkov:skip:CKV_AWS_21
		1046 |   #checkov:skip:CKV2_AWS_65
		1047 |   #checkov:skip:CKV2_AWS_62
		1048 |   #checkov:skip:CKV_AWS_18
		1049 |   #checkov:skip:CKV2_AWS_61
		1050 |   bucket_prefix = "em-data-store-"
		1051 |   force_destroy = false
		1052 |   tags = {
		1053 |     "application"            = "electronic-monitoring-data"
		1054 |     "business-unit"          = "HMPPS"
		1055 |     "environment-name"       = "electronic-monitoring-data-production"
		1056 |     "infrastructure-support" = "dataengineering@digital.justice.gov.uk"
		1057 |     "is-production"          = "true"
		1058 |     "owner"                  = "Data engineering: dataengineering@digital.justice.gov.uk"
		1059 |     "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
		1060 |   }
		1061 | }

Check: CKV2_AWS_65: "Ensure access control lists for S3 buckets are disabled"
	FAILED for resource: aws_s3_bucket_ownership_controls.bucket
	File: /s3.tf:1071-1076
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-general-112

		1071 | resource "aws_s3_bucket_ownership_controls" "bucket" {
		1072 |   bucket = aws_s3_bucket.data_store.id
		1073 |   rule {
		1074 |     object_ownership = "ObjectWriter"
		1075 |   }
		1076 | }

Check: CKV_AWS_145: "Ensure that S3 buckets are encrypted with KMS by default"
	FAILED for resource: aws_s3_bucket.data_store
	File: /s3.tf:1042-1061
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-s3-buckets-are-encrypted-with-kms-by-default

		1042 | resource "aws_s3_bucket" "data_store" {
		1043 |   #checkov:skip:CKV_AWS_145
		1044 |   #checkov:skip:CKV_AWS_144
		1045 |   #checkov:skip:CKV_AWS_21
		1046 |   #checkov:skip:CKV2_AWS_65
		1047 |   #checkov:skip:CKV2_AWS_62
		1048 |   #checkov:skip:CKV_AWS_18
		1049 |   #checkov:skip:CKV2_AWS_61
		1050 |   bucket_prefix = "em-data-store-"
		1051 |   force_destroy = false
		1052 |   tags = {
		1053 |     "application"            = "electronic-monitoring-data"
		1054 |     "business-unit"          = "HMPPS"
		1055 |     "environment-name"       = "electronic-monitoring-data-production"
		1056 |     "infrastructure-support" = "dataengineering@digital.justice.gov.uk"
		1057 |     "is-production"          = "true"
		1058 |     "owner"                  = "Data engineering: dataengineering@digital.justice.gov.uk"
		1059 |     "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
		1060 |   }
		1061 | }

Check: CKV_AWS_21: "Ensure all data stored in the S3 bucket have versioning enabled"
	FAILED for resource: aws_s3_bucket.data_store
	File: /s3.tf:1042-1061
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-16-enable-versioning

		1042 | resource "aws_s3_bucket" "data_store" {
		1043 |   #checkov:skip:CKV_AWS_145
		1044 |   #checkov:skip:CKV_AWS_144
		1045 |   #checkov:skip:CKV_AWS_21
		1046 |   #checkov:skip:CKV2_AWS_65
		1047 |   #checkov:skip:CKV2_AWS_62
		1048 |   #checkov:skip:CKV_AWS_18
		1049 |   #checkov:skip:CKV2_AWS_61
		1050 |   bucket_prefix = "em-data-store-"
		1051 |   force_destroy = false
		1052 |   tags = {
		1053 |     "application"            = "electronic-monitoring-data"
		1054 |     "business-unit"          = "HMPPS"
		1055 |     "environment-name"       = "electronic-monitoring-data-production"
		1056 |     "infrastructure-support" = "dataengineering@digital.justice.gov.uk"
		1057 |     "is-production"          = "true"
		1058 |     "owner"                  = "Data engineering: dataengineering@digital.justice.gov.uk"
		1059 |     "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
		1060 |   }
		1061 | }

Check: CKV2_AWS_61: "Ensure that an S3 bucket has a lifecycle configuration"
	FAILED for resource: aws_s3_bucket.data_store
	File: /s3.tf:1042-1061
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-2-61

		1042 | resource "aws_s3_bucket" "data_store" {
		1043 |   #checkov:skip:CKV_AWS_145
		1044 |   #checkov:skip:CKV_AWS_144
		1045 |   #checkov:skip:CKV_AWS_21
		1046 |   #checkov:skip:CKV2_AWS_65
		1047 |   #checkov:skip:CKV2_AWS_62
		1048 |   #checkov:skip:CKV_AWS_18
		1049 |   #checkov:skip:CKV2_AWS_61
		1050 |   bucket_prefix = "em-data-store-"
		1051 |   force_destroy = false
		1052 |   tags = {
		1053 |     "application"            = "electronic-monitoring-data"
		1054 |     "business-unit"          = "HMPPS"
		1055 |     "environment-name"       = "electronic-monitoring-data-production"
		1056 |     "infrastructure-support" = "dataengineering@digital.justice.gov.uk"
		1057 |     "is-production"          = "true"
		1058 |     "owner"                  = "Data engineering: dataengineering@digital.justice.gov.uk"
		1059 |     "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
		1060 |   }
		1061 | }

dockerfile scan results:

Passed checks: 21, Failed checks: 2, Skipped checks: 0

Check: CKV_DOCKER_2: "Ensure that HEALTHCHECK instructions have been added to container images"
	FAILED for resource: /lambdas/update_log_table/Dockerfile.
	File: /lambdas/update_log_table/Dockerfile:1-9
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/docker-policies/docker-policy-index/ensure-that-healthcheck-instructions-have-been-added-to-container-images

		1 | FROM public.ecr.aws/lambda/python:3.11
		2 | 
		3 | COPY requirements.txt .
		4 | 
		5 | RUN pip install -r requirements.txt --target "${LAMBDA_TASK_ROOT}"
		6 | 
		7 | COPY update_log_table.py ${LAMBDA_TASK_ROOT}
		8 | 
		9 | CMD ["update_log_table.handler"]

Check: CKV_DOCKER_3: "Ensure that a user for the container has been created"
	FAILED for resource: /lambdas/update_log_table/Dockerfile.
	File: /lambdas/update_log_table/Dockerfile:1-9
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/docker-policies/docker-policy-index/ensure-that-a-user-for-the-container-has-been-created

		1 | FROM public.ecr.aws/lambda/python:3.11
		2 | 
		3 | COPY requirements.txt .
		4 | 
		5 | RUN pip install -r requirements.txt --target "${LAMBDA_TASK_ROOT}"
		6 | 
		7 | COPY update_log_table.py ${LAMBDA_TASK_ROOT}
		8 | 
		9 | CMD ["update_log_table.handler"]


checkov_exitcode=1

CTFLint Scan Failed

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
terraform/environments/electronic-monitoring-data

*****************************

Running tflint in terraform/environments/electronic-monitoring-data
Excluding the following checks: terraform_unused_declarations
11 issue(s) found:

Warning: Missing version constraint for provider "archive" in `required_providers` (terraform_required_providers)

  on terraform/environments/electronic-monitoring-data/data_store.tf line 151:
 151: data "archive_file" "summarise_zip_lambda" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

Warning: `s3_pylib_dir_path` variable has no type (terraform_typed_variables)

  on terraform/environments/electronic-monitoring-data/glue_variables.tf line 1:
   1: variable "s3_pylib_dir_path" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_typed_variables.md

Warning: Missing version constraint for provider "random" in `required_providers` (terraform_required_providers)

  on terraform/environments/electronic-monitoring-data/server_backups.tf line 13:
  13: resource "random_password" "random_password" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 11:
  11:           "Resource" : "${module.get_metadata_from_rds_lambda.lambda_function_arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 24:
  24:                 "Resource" : "${module.create_athena_table.lambda_function_arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 98:
  98:             "WorkGroup" : "${aws_athena_workgroup.default.name}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 114:
 114:           "Resource" : "${module.query_output_to_list.lambda_function_arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 127:
 127:                 "Resource" : "${module.get_file_keys_for_table.lambda_function_arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 141:
 141:                       "Resource" : "${module.send_table_to_ap.lambda_function_arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 152:
 152:                 "Resource" : "${module.update_log_table.lambda_function_arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 164:
 164:             "WorkGroup" : "${aws_athena_workgroup.default.name}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

tflint_exitcode=2

Trivy Scan Failed

Show Output

*****************************

Trivy will check the following folders:
terraform/environments/electronic-monitoring-data

*****************************

Running Trivy in terraform/environments/electronic-monitoring-data
2024-10-10T10:15:15Z	INFO	[vulndb] Need to update DB
2024-10-10T10:15:15Z	INFO	[vulndb] Downloading vulnerability DB...
2024-10-10T10:15:15Z	INFO	[vulndb] Downloading artifact...	repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-10T10:15:15Z	ERROR	[vulndb] Failed to download artifact	repo="ghcr.io/aquasecurity/trivy-db:2" err="oci download error: failed to fetch the layer: GET https://ghcr.io/v2/aquasecurity/trivy-db/blobs/sha256:57a9180d97a1dc07fad121ef6d3537359af362216eab6bbe79ed84a2b885ecdc: TOOMANYREQUESTS: retry-after: 850.945µs, allowed: 44000/minute"
2024-10-10T10:15:15Z	FATAL	Fatal error	init error: DB error: failed to download vulnerability DB: OCI artifact error: failed to download vulnerability DB: failed to download artifact from any source
trivy_exitcode=1

[github-actions]

Trivy Scan Failed

Show Output

```hcl

---

Trivy will check the following folders:
terraform/environments/electronic-monitoring-data

---

Running Trivy in terraform/environments/electronic-monitoring-data
2024-10-10T10:58:48Z INFO [vulndb] Need to update DB
2024-10-10T10:58:48Z INFO [vulndb] Downloading vulnerability DB...
2024-10-10T10:58:48Z INFO [vulndb] Downloading artifact... repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-10T10:58:51Z INFO [vulndb] Artifact successfully downloaded repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-10T10:58:51Z INFO [vuln] Vulnerability scanning is enabled
2024-10-10T10:58:51Z INFO [misconfig] Misconfiguration scanning is enabled
2024-10-10T10:58:51Z INFO [misconfig] Need to update the built-in checks
2024-10-10T10:58:51Z INFO [misconfig] Downloading the built-in checks...
156.02 KiB / 156.02 KiB [---------------------------------------------------------] 100.00% ? p/s 0s2024-10-10T10:58:51Z INFO [secret] Secret scanning is enabled
2024-10-10T10:58:51Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-10T10:58:51Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-10-10T10:58:51Z WARN [pip] Unable to find python site-packages directory. License detection is skipped. err="site-packages directory not found"
2024-10-10T10:58:53Z INFO [terraform scanner] Scanning root module file_path="."
2024-10-10T10:58:53Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="networking"
2024-10-10T10:58:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T10:58:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T10:58:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T10:58:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T10:58:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T10:58:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T10:58:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T10:58:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T10:58:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T10:58:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T10:58:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.aws_s3_object.user_public_keys" value="cty.NilVal"
2024-10-10T10:58:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.data.aws_subnet.local_account" value="cty.NilVal"
2024-10-10T10:58:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-10T10:58:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:59:03Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-10T10:59:03Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-10T10:59:03Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-bucket-encryption" range="s3.tf:1042-1061"
2024-10-10T10:59:03Z INFO [terraform executor] Ignore finding rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:281-286"
2024-10-10T10:59:03Z INFO [terraform executor] Ignore finding rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:407-411"
2024-10-10T10:59:03Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-10T10:59:03Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-10T10:59:03Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-10T10:59:03Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-10T10:59:03Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-10T10:59:03Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-10T10:59:03Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-10T10:59:03Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-10T10:59:03Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-10T10:59:03Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-10T10:59:03Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-10T10:59:03Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.2.1/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=568694e50e03630d99cb569eafa06a0b879a1239/main.tf:171-179"
2024-10-10T10:59:03Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="s3.tf:1042-1061"
2024-10-10T10:59:03Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-logging" range="s3.tf:1042-1061"
2024-10-10T10:59:03Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-versioning" range="s3.tf:1042-1061"
2024-10-10T10:59:03Z INFO Number of language-specific files num=1
2024-10-10T10:59:03Z INFO [pip] Detecting vulnerabilities...
2024-10-10T10:59:03Z INFO Detected config files num=17

data_store.tf (terraform)

Tests: 1 (SUCCESSES: 0, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Topic does not have encryption enabled.
════════════════════════════════════════
Topics should be encrypted to protect their contents.

See https://avd.aquasec.com/misconfig/avd-aws-0095
────────────────────────────────────────
data_store.tf:17-19
────────────────────────────────────────
17 ┌ resource "aws_sns_topic" "s3_events" {
18 │ name = "${module.s3-data-bucket.bucket.id}-object-created-topic"
19 └ }
────────────────────────────────────────

lambdas/update_log_table/Dockerfile (dockerfile)

Tests: 20 (SUCCESSES: 19, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Specify at least 1 USER command in Dockerfile with non-root user as argument
════════════════════════════════════════
Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

See https://avd.aquasec.com/misconfig/ds002
────────────────────────────────────────

trivy_exitcode=1

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/electronic-monitoring-data

*****************************

Running Checkov in terraform/environments/electronic-monitoring-data
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2024-10-10 10:59:06,203 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.2.1:None (for external modules, the --download-external-modules flag is required)
2024-10-10 10:59:06,203 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060:None (for external modules, the --download-external-modules flag is required)
2024-10-10 10:59:06,204 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/secrets-manager/aws:1.3.0 (for external modules, the --download-external-modules flag is required)
2024-10-10 10:59:06,204 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=52a40b0:None (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 2005, Failed checks: 76, Skipped checks: 25

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: rds_bastion
	File: /bastion_linux.tf:6-39
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		6  | module "rds_bastion" {
		7  |   source = "github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.2.1"
		8  | 
		9  |   providers = {
		10 |     aws.share-host   = aws.core-vpc # core-vpc-(environment) holds the networking for all accounts
		11 |     aws.share-tenant = aws          # The default provider (unaliased, `aws`) is the tenant
		12 |   }
		13 | 
		14 |   # s3 - used for logs and user ssh public keys
		15 |   bucket_name = "rds-bastion"
		16 | 
		17 |   # public keys
		18 |   public_key_data = local.public_key_data.keys[local.environment]
		19 | 
		20 |   # logs
		21 |   log_auto_clean       = "Enabled"
		22 |   log_standard_ia_days = 30  # days before moving to IA storage
		23 |   log_glacier_days     = 60  # days before moving to Glacier
		24 |   log_expiry_days      = 180 # days before log expiration
		25 | 
		26 |   # bastion
		27 |   # instance_name = "s3_rds_bastion_linux"
		28 | 
		29 |   allow_ssh_commands = true
		30 |   app_name           = var.networking[0].application
		31 |   business_unit      = local.vpc_name
		32 |   subnet_set         = local.subnet_set
		33 |   environment        = local.environment
		34 |   region             = "eu-west-2"
		35 |   volume_size        = 20
		36 |   # tags
		37 |   tags_common = local.tags
		38 |   tags_prefix = terraform.workspace
		39 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: zip_bastion
	File: /bastion_linux.tf:153-187
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		153 | module "zip_bastion" {
		154 |   source = "github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.2.1"
		155 | 
		156 |   providers = {
		157 |     aws.share-host   = aws.core-vpc # core-vpc-(environment) holds the networking for all accounts
		158 |     aws.share-tenant = aws          # The default provider (unaliased, `aws`) is the tenant
		159 |   }
		160 | 
		161 |   # s3 - used for logs and user ssh public keys
		162 |   bucket_name   = "zip-bastion"
		163 |   instance_name = "zip_bastion_linux"
		164 |   # public keys
		165 |   public_key_data = local.public_key_data.keys[local.environment]
		166 | 
		167 |   # logs
		168 |   log_auto_clean       = "Enabled"
		169 |   log_standard_ia_days = 30  # days before moving to IA storage
		170 |   log_glacier_days     = 60  # days before moving to Glacier
		171 |   log_expiry_days      = 180 # days before log expiration
		172 | 
		173 |   allow_ssh_commands = true
		174 |   # autoscaling_cron   = {
		175 |   #   "down": "0 20 * * *",
		176 |   #   "up": "*/30 * * * *"
		177 |   # }
		178 |   app_name      = var.networking[0].application
		179 |   business_unit = local.vpc_name
		180 |   subnet_set    = local.subnet_set
		181 |   environment   = local.environment
		182 |   region        = "eu-west-2"
		183 |   volume_size   = 96
		184 |   # tags
		185 |   tags_common = local.tags
		186 |   tags_prefix = terraform.workspace
		187 | }

Check: CKV_AWS_26: "Ensure all data stored in the SNS topic is encrypted"
	FAILED for resource: aws_sns_topic.s3_events
	File: /data_store.tf:17-19
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-15

		17 | resource "aws_sns_topic" "s3_events" {
		18 |   name = "${module.s3-data-bucket.bucket.id}-object-created-topic"
		19 | }

Check: CKV_AWS_115: "Ensure that AWS Lambda function is configured for function-level concurrent execution limit"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-function-level-concurrent-execution-limit

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_173: "Check encryption settings for Lambda environmental variable"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-5

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_116: "Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-a-dead-letter-queue-dlq

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_272: "Ensure AWS Lambda function is configured to validate code-signing"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-272

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_117: "Ensure that AWS Lambda function is configured inside a VPC"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-inside-a-vpc-1

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_115: "Ensure that AWS Lambda function is configured for function-level concurrent execution limit"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-function-level-concurrent-execution-limit

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_116: "Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-a-dead-letter-queue-dlq

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_272: "Ensure AWS Lambda function is configured to validate code-signing"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-272

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_117: "Ensure that AWS Lambda function is configured inside a VPC"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-inside-a-vpc-1

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group
	File: /dms_data_validation_glue_job.tf:65-68
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		65 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group" {
		66 |   name              = "dms-dv-glue-job"
		67 |   retention_in_days = 14
		68 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group
	File: /dms_data_validation_glue_job.tf:65-68
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		65 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group" {
		66 |   name              = "dms-dv-glue-job"
		67 |   retention_in_days = 14
		68 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group_v2
	File: /dms_data_validation_glue_job.tf:70-73
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		70 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group_v2" {
		71 |   name              = "dms-dv-glue-job-v2"
		72 |   retention_in_days = 14
		73 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group_v2
	File: /dms_data_validation_glue_job.tf:70-73
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		70 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group_v2" {
		71 |   name              = "dms-dv-glue-job-v2"
		72 |   retention_in_days = 14
		73 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.rds_to_s3_parquet_migration
	File: /dms_data_validation_glue_job.tf:75-78
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		75 | resource "aws_cloudwatch_log_group" "rds_to_s3_parquet_migration" {
		76 |   name              = "rds-to-s3-parquet-migration"
		77 |   retention_in_days = 14
		78 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.rds_to_s3_parquet_migration
	File: /dms_data_validation_glue_job.tf:75-78
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		75 | resource "aws_cloudwatch_log_group" "rds_to_s3_parquet_migration" {
		76 |   name              = "rds-to-s3-parquet-migration"
		77 |   retention_in_days = 14
		78 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.resizing_parquet_files
	File: /dms_data_validation_glue_job.tf:80-83
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		80 | resource "aws_cloudwatch_log_group" "resizing_parquet_files" {
		81 |   name              = "resizing-parquet-files"
		82 |   retention_in_days = 14
		83 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.resizing_parquet_files
	File: /dms_data_validation_glue_job.tf:80-83
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		80 | resource "aws_cloudwatch_log_group" "resizing_parquet_files" {
		81 |   name              = "resizing-parquet-files"
		82 |   retention_in_days = 14
		83 | }

Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.dms_dv_glue_job_v2
	File: /dms_data_validation_glue_job.tf:86-139
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.dms_dv_glue_job_v4d
	File: /dms_data_validation_glue_job.tf:147-200
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.rds_to_s3_parquet_migration
	File: /dms_data_validation_glue_job.tf:203-267
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.rds_to_s3_parquet_migration_monthly
	File: /dms_data_validation_glue_job.tf:271-325
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.resizing_parquet_files
	File: /dms_data_validation_glue_job.tf:328-380
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.catalog_dv_table_glue_job
	File: /dms_data_validation_glue_job.tf:383-411
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		383 | resource "aws_glue_job" "catalog_dv_table_glue_job" {
		384 |   name              = "catalog-dv-table-glue-job"
		385 |   description       = "Python script uses Boto3-Athena-Client to run sql-statements"
		386 |   role_arn          = aws_iam_role.dms_dv_glue_job_iam_role.arn
		387 |   glue_version      = "4.0"
		388 |   worker_type       = "G.1X"
		389 |   number_of_workers = 2
		390 |   default_arguments = {
		391 |     "--parquet_output_bucket_name"       = module.s3-dms-data-validation-bucket.bucket.id
		392 |     "--glue_catalog_db_name"             = aws_glue_catalog_database.dms_dv_glue_catalog_db.name
		393 |     "--glue_catalog_tbl_name"            = "glue_df_output"
		394 |     "--continuous-log-logGroup"          = aws_cloudwatch_log_group.dms_dv_cw_log_group.name
		395 |     "--enable-continuous-cloudwatch-log" = "true"
		396 |     "--enable-continuous-log-filter"     = "true"
		397 |     "--enable-metrics"                   = ""
		398 |   }
		399 |   command {
		400 |     python_version  = "3"
		401 |     script_location = "s3://${module.s3-glue-job-script-bucket.bucket.id}/create_or_replace_dv_table.py"
		402 |   }
		403 | 
		404 |   tags = merge(
		405 |     local.tags,
		406 |     {
		407 |       Resource_Type = "Py script as glue-job that creates dv table / refreshes its partitions",
		408 |     }
		409 |   )
		410 | 
		411 | }

Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_crawler.rds_sqlserver_db_glue_crawler
	File: /dms_glue_crawler.tf:35-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		35 | resource "aws_glue_crawler" "rds_sqlserver_db_glue_crawler" {
		36 |   name          = "rds-sqlserver-${aws_db_instance.database_2022.identifier}-tf"
		37 |   role          = aws_iam_role.dms_dv_glue_job_iam_role.arn
		38 |   database_name = aws_glue_catalog_database.rds_sqlserver_glue_catalog_db.name
		39 |   description   = "Crawler to fetch database names"
		40 |   #   table_prefix  = "your_table_prefix"
		41 | 
		42 |   jdbc_target {
		43 |     connection_name = aws_glue_connection.glue_rds_sqlserver_db_connection.name
		44 |     path            = "%"
		45 |   }
		46 |   tags = merge(
		47 |     local.tags,
		48 |     {
		49 |       Resource_Type = "RDS-SQLServer Glue-Crawler for DMS",
		50 |     }
		51 |   )
		52 | 
		53 |   # provisioner "local-exec" {
		54 |   #   command = "aws glue start-crawler --name ${self.name}"
		55 |   # }
		56 | }

Check: CKV_AWS_212: "Ensure DMS replication instance is encrypted by KMS using a customer managed Key (CMK)"
	FAILED for resource: aws_dms_replication_instance.dms_replication_instance
	File: /dms_replication_instance.tf:24-55
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-ebs-volume-is-encrypted-by-key-management-service-kms-using-a-customer-managed-key-cmk

		24 | resource "aws_dms_replication_instance" "dms_replication_instance" {
		25 |   allocated_storage          = var.dms_allocated_storage_gib
		26 |   apply_immediately          = true
		27 |   auto_minor_version_upgrade = true
		28 |   availability_zone          = var.dms_availability_zone
		29 |   engine_version             = var.dms_engine_version
		30 |   #   kms_key_arn                  = "arn:aws:kms:eu-west-2:800964199911:key/b7f54acb-16a3-4958-9340-3bdf5f5842d8"
		31 |   multi_az = false
		32 |   #   preferred_maintenance_window = "sun:10:30-sun:14:30"
		33 |   publicly_accessible         = false
		34 |   replication_instance_class  = var.dms_replication_instance_class
		35 |   replication_instance_id     = "dms-replication-instance-tf"
		36 |   replication_subnet_group_id = aws_dms_replication_subnet_group.dms_replication_subnet_group.id
		37 | 
		38 |   tags = merge(
		39 |     local.tags,
		40 |     {
		41 |       Resource_Type = "DMS Replication Instance",
		42 |     }
		43 |   )
		44 | 
		45 |   vpc_security_group_ids = [
		46 |     aws_security_group.dms_ri_security_group.id,
		47 |   ]
		48 | 
		49 |   depends_on = [
		50 |     aws_iam_role.dms_vpc_role,
		51 |     aws_iam_role.dms_cloudwatch_logs_role,
		52 |     aws_iam_role.dms_endpoint_role
		53 |   ]
		54 | 
		55 | }

Check: CKV_AWS_260: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 80"
	FAILED for resource: aws_vpc_security_group_ingress_rule.glue_rds_conn_inbound
	File: /dms_security_groups.tf:69-77
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-aws-security-groups-do-not-allow-ingress-from-00000-to-port-80

		69 | resource "aws_vpc_security_group_ingress_rule" "glue_rds_conn_inbound" {
		70 |   security_group_id = aws_security_group.glue_rds_conn_security_group.id
		71 | 
		72 |   referenced_security_group_id = aws_security_group.glue_rds_conn_security_group.id
		73 |   ip_protocol                  = "tcp"
		74 |   from_port                    = 0
		75 |   to_port                      = 65535
		76 |   description                  = "Required ports open for Glue-RDS-Connection"
		77 | }

Check: CKV_AWS_24: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 22"
	FAILED for resource: aws_vpc_security_group_ingress_rule.glue_rds_conn_inbound
	File: /dms_security_groups.tf:69-77
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-1-port-security

		69 | resource "aws_vpc_security_group_ingress_rule" "glue_rds_conn_inbound" {
		70 |   security_group_id = aws_security_group.glue_rds_conn_security_group.id
		71 | 
		72 |   referenced_security_group_id = aws_security_group.glue_rds_conn_security_group.id
		73 |   ip_protocol                  = "tcp"
		74 |   from_port                    = 0
		75 |   to_port                      = 65535
		76 |   description                  = "Required ports open for Glue-RDS-Connection"
		77 | }

Check: CKV_AWS_25: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389"
	FAILED for resource: aws_vpc_security_group_ingress_rule.glue_rds_conn_inbound
	File: /dms_security_groups.tf:69-77
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-2

		69 | resource "aws_vpc_security_group_ingress_rule" "glue_rds_conn_inbound" {
		70 |   security_group_id = aws_security_group.glue_rds_conn_security_group.id
		71 | 
		72 |   referenced_security_group_id = aws_security_group.glue_rds_conn_security_group.id
		73 |   ip_protocol                  = "tcp"
		74 |   from_port                    = 0
		75 |   to_port                      = 65535
		76 |   description                  = "Required ports open for Glue-RDS-Connection"
		77 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.glue_notebook_ec2_iam_policy_document
	File: /glue_data.tf:103-118
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		103 | data "aws_iam_policy_document" "glue_notebook_ec2_iam_policy_document" {
		104 |   statement {
		105 |     effect = "Allow"
		106 |     actions = [
		107 |       "ec2:CreateNetworkInterface",
		108 |       "ec2:DescribeNetworkInterfaces",
		109 |       "ec2:DeleteNetworkInterface",
		110 |       "ec2:DescribeVpcEndpoints",
		111 |       "ec2:DescribeSubnets",
		112 |       "ec2:DescribeVpcAttribute",
		113 |       "ec2:DescribeRouteTables",
		114 |       "ec2:DescribeSecurityGroups"
		115 |     ]
		116 |     resources = ["*"]
		117 |   }
		118 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.glue_notebook_ec2_iam_policy_document
	File: /glue_data.tf:103-118
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		103 | data "aws_iam_policy_document" "glue_notebook_ec2_iam_policy_document" {
		104 |   statement {
		105 |     effect = "Allow"
		106 |     actions = [
		107 |       "ec2:CreateNetworkInterface",
		108 |       "ec2:DescribeNetworkInterfaces",
		109 |       "ec2:DeleteNetworkInterface",
		110 |       "ec2:DescribeVpcEndpoints",
		111 |       "ec2:DescribeSubnets",
		112 |       "ec2:DescribeVpcAttribute",
		113 |       "ec2:DescribeRouteTables",
		114 |       "ec2:DescribeSecurityGroups"
		115 |     ]
		116 |     resources = ["*"]
		117 |   }
		118 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.load_json_table_s3_policy_document
	File: /lambdas_iam.tf:430-487
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.load_json_table_s3_policy_document
	File: /lambdas_iam.tf:430-487
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.db_glue_connection
	File: /lambdas_secrets.tf:1-3
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		1 | resource "aws_secretsmanager_secret" "db_glue_connection" {
		2 |   name = "db_glue_connection"
		3 | }

Check: CKV_AWS_296: "Ensure DMS endpoint uses Customer Managed Key (CMK)"
	FAILED for resource: module.dms_task.aws_dms_endpoint.dms_rds_source
	File: /modules/dms/endpoints_rds_s3.tf:2-23
	Calling File: /dms_main.tf:1-39
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-296

		2  | resource "aws_dms_endpoint" "dms_rds_source" {
		3  | 
		4  |   #   certificate_arn             = ""
		5  |   database_name = var.database_name
		6  |   endpoint_id   = "rds-mssql-${replace(var.database_name, "_", "-")}-tf"
		7  |   endpoint_type = "source"
		8  |   engine_name   = "sqlserver"
		9  |   #   extra_connection_attributes = ""
		10 |   #   kms_key_arn                 = aws_db_instance.database_2022.kms_key_id
		11 |   password    = var.rds_db_instance_pasword
		12 |   port        = var.rds_db_instance_port
		13 |   server_name = var.rds_db_server_name
		14 |   ssl_mode    = "require"
		15 |   username    = var.rds_db_username
		16 | 
		17 |   tags = merge(
		18 |     var.local_tags,
		19 |     {
		20 |       Resource_Type = "DMS Source Endpoint - RDS MSSQL",
		21 |     },
		22 |   )
		23 | }

Check: CKV_AWS_298: "Ensure DMS S3 uses Customer Managed Key (CMK)"
	FAILED for resource: module.dms_task.aws_dms_s3_endpoint.dms_s3_parquet_target
	File: /modules/dms/endpoints_rds_s3.tf:28-84
	Calling File: /dms_main.tf:1-39
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-298

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: module.get_zipped_file.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:3-7
	Calling File: /step_functions_main.tf:233-243
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		3 | resource "aws_sfn_state_machine" "this" {
		4 |   name       = var.name
		5 |   role_arn   = aws_iam_role.step_function_role.arn
		6 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		7 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: module.get_zipped_file.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:3-7
	Calling File: /step_functions_main.tf:233-243
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		3 | resource "aws_sfn_state_machine" "this" {
		4 |   name       = var.name
		5 |   role_arn   = aws_iam_role.step_function_role.arn
		6 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		7 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:38-47
	Calling File: /step_functions_main.tf:233-243
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		38 | data "aws_iam_policy_document" "step_function_base_permissions" {
		39 |   statement {
		40 |     effect = "Allow"
		41 |     actions = [
		42 |       "sns:Publish",
		43 |       "sqs:SendMessage"
		44 |     ]
		45 |     resources = ["*"]
		46 |   }
		47 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:38-47
	Calling File: /step_functions_main.tf:233-243
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		38 | data "aws_iam_policy_document" "step_function_base_permissions" {
		39 |   statement {
		40 |     effect = "Allow"
		41 |     actions = [
		42 |       "sns:Publish",
		43 |       "sqs:SendMessage"
		44 |     ]
		45 |     resources = ["*"]
		46 |   }
		47 | }

Check: CKV_AWS_109: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:54-82
	Calling File: /step_functions_main.tf:233-243
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-permissions-management-resource-exposure-without-constraint

		54 | data "aws_iam_policy_document" "this_log_key_document" {
		55 |   statement {
		56 |     sid    = "EnableIAMUserPermissions"
		57 |     effect = "Allow"
		58 |     principals {
		59 |       type        = "AWS"
		60 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		61 |     }
		62 |     actions   = ["kms:*"]
		63 |     resources = ["*"]
		64 |   }
		65 | 
		66 |   statement {
		67 |     sid    = "EnableLogServicePermissions"
		68 |     effect = "Allow"
		69 |     principals {
		70 |       type        = "Service"
		71 |       identifiers = ["logs.eu-west-2.amazonaws.com"]
		72 |     }
		73 |     actions = [
		74 |       "kms:Encrypt*",
		75 |       "kms:Decrypt*",
		76 |       "kms:ReEncrypt*",
		77 |       "kms:GenerateDataKey*",
		78 |       "kms:Describe*",
		79 |     ]
		80 |     resources = ["*"]
		81 |   }
		82 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:54-82
	Calling File: /step_functions_main.tf:233-243
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		54 | data "aws_iam_policy_document" "this_log_key_document" {
		55 |   statement {
		56 |     sid    = "EnableIAMUserPermissions"
		57 |     effect = "Allow"
		58 |     principals {
		59 |       type        = "AWS"
		60 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		61 |     }
		62 |     actions   = ["kms:*"]
		63 |     resources = ["*"]
		64 |   }
		65 | 
		66 |   statement {
		67 |     sid    = "EnableLogServicePermissions"
		68 |     effect = "Allow"
		69 |     principals {
		70 |       type        = "Service"
		71 |       identifiers = ["logs.eu-west-2.amazonaws.com"]
		72 |     }
		73 |     actions = [
		74 |       "kms:Encrypt*",
		75 |       "kms:Decrypt*",
		76 |       "kms:ReEncrypt*",
		77 |       "kms:GenerateDataKey*",
		78 |       "kms:Describe*",
		79 |     ]
		80 |     resources = ["*"]
		81 |   }
		82 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:54-82
	Calling File: /step_functions_main.tf:233-243
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		54 | data "aws_iam_policy_document" "this_log_key_document" {
		55 |   statement {
		56 |     sid    = "EnableIAMUserPermissions"
		57 |     effect = "Allow"
		58 |     principals {
		59 |       type        = "AWS"
		60 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		61 |     }
		62 |     actions   = ["kms:*"]
		63 |     resources = ["*"]
		64 |   }
		65 | 
		66 |   statement {
		67 |     sid    = "EnableLogServicePermissions"
		68 |     effect = "Allow"
		69 |     principals {
		70 |       type        = "Service"
		71 |       identifiers = ["logs.eu-west-2.amazonaws.com"]
		72 |     }
		73 |     actions = [
		74 |       "kms:Encrypt*",
		75 |       "kms:Decrypt*",
		76 |       "kms:ReEncrypt*",
		77 |       "kms:GenerateDataKey*",
		78 |       "kms:Describe*",
		79 |     ]
		80 |     resources = ["*"]
		81 |   }
		82 | }

Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.db_password
	File: /server_backups.tf:4-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		4 | resource "aws_secretsmanager_secret" "db_password" {
		5 |   name = "db_password"
		6 | }

Check: CKV_AWS_354: "Ensure RDS Performance Insights are encrypted using KMS CMKs"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-354

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_157: "Ensure that RDS instances have Multi-AZ enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-73

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_118: "Ensure that enhanced monitoring is enabled for Amazon RDS instances"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/ensure-that-enhanced-monitoring-is-enabled-for-amazon-rds-instances

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_353: "Ensure that RDS instances have performance insights enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-353

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_293: "Ensure that AWS database instances have deletion protection enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-293

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_129: "Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-that-respective-logs-of-amazon-relational-database-service-amazon-rds-are-enabled

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_260: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 80"
	FAILED for resource: aws_vpc_security_group_ingress_rule.db_glue_access
	File: /server_backups.tf:123-131
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-aws-security-groups-do-not-allow-ingress-from-00000-to-port-80

		123 | resource "aws_vpc_security_group_ingress_rule" "db_glue_access" {
		124 | 
		125 |   security_group_id            = aws_security_group.db.id
		126 |   description                  = "glue"
		127 |   ip_protocol                  = "tcp"
		128 |   from_port                    = 0
		129 |   to_port                      = 65535
		130 |   referenced_security_group_id = aws_security_group.db.id
		131 | }

Check: CKV_AWS_24: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 22"
	FAILED for resource: aws_vpc_security_group_ingress_rule.db_glue_access
	File: /server_backups.tf:123-131
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-1-port-security

		123 | resource "aws_vpc_security_group_ingress_rule" "db_glue_access" {
		124 | 
		125 |   security_group_id            = aws_security_group.db.id
		126 |   description                  = "glue"
		127 |   ip_protocol                  = "tcp"
		128 |   from_port                    = 0
		129 |   to_port                      = 65535
		130 |   referenced_security_group_id = aws_security_group.db.id
		131 | }

Check: CKV_AWS_25: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389"
	FAILED for resource: aws_vpc_security_group_ingress_rule.db_glue_access
	File: /server_backups.tf:123-131
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-2

		123 | resource "aws_vpc_security_group_ingress_rule" "db_glue_access" {
		124 | 
		125 |   security_group_id            = aws_security_group.db.id
		126 |   description                  = "glue"
		127 |   ip_protocol                  = "tcp"
		128 |   from_port                    = 0
		129 |   to_port                      = 65535
		130 |   referenced_security_group_id = aws_security_group.db.id
		131 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.send_database_to_ap_athena_queries
	File: /step_functions_iam.tf:151-196
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		151 | data "aws_iam_policy_document" "send_database_to_ap_athena_queries" {
		152 |   statement {
		153 |     effect = "Allow"
		154 | 
		155 |     actions = [
		156 |       "athena:startQueryExecution",
		157 |       "athena:getQueryExecution",
		158 |       "athena:getQueryResults"
		159 |     ]
		160 | 
		161 |     resources = [
		162 |       "*"
		163 |     ]
		164 |   }
		165 |   statement {
		166 |     effect = "Allow"
		167 | 
		168 |     actions = [
		169 |       "s3:PutObject",
		170 |       "s3:GetObject",
		171 |       "s3:ListBucket",
		172 |       "s3:GetBucketLocation"
		173 |     ]
		174 | 
		175 |     resources = [
		176 |       module.s3-athena-bucket.bucket.arn,
		177 |       "${module.s3-athena-bucket.bucket.arn}/*",
		178 |       "${module.s3-dms-data-validation-bucket.bucket.arn}/*",
		179 |       module.s3-dms-data-validation-bucket.bucket.arn
		180 |     ]
		181 |   }
		182 |   statement {
		183 |     effect = "Allow"
		184 | 
		185 |     actions = [
		186 |       "glue:GetDatabase",
		187 |       "glue:GetTable",
		188 |       "glue:GetPartitions",
		189 |       "glue:GetTables"
		190 |     ]
		191 | 
		192 |     resources = [
		193 |       "*"
		194 |     ]
		195 |   }
		196 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.send_database_to_ap_athena_queries
	File: /step_functions_iam.tf:151-196
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		151 | data "aws_iam_policy_document" "send_database_to_ap_athena_queries" {
		152 |   statement {
		153 |     effect = "Allow"
		154 | 
		155 |     actions = [
		156 |       "athena:startQueryExecution",
		157 |       "athena:getQueryExecution",
		158 |       "athena:getQueryResults"
		159 |     ]
		160 | 
		161 |     resources = [
		162 |       "*"
		163 |     ]
		164 |   }
		165 |   statement {
		166 |     effect = "Allow"
		167 | 
		168 |     actions = [
		169 |       "s3:PutObject",
		170 |       "s3:GetObject",
		171 |       "s3:ListBucket",
		172 |       "s3:GetBucketLocation"
		173 |     ]
		174 | 
		175 |     resources = [
		176 |       module.s3-athena-bucket.bucket.arn,
		177 |       "${module.s3-athena-bucket.bucket.arn}/*",
		178 |       "${module.s3-dms-data-validation-bucket.bucket.arn}/*",
		179 |       module.s3-dms-data-validation-bucket.bucket.arn
		180 |     ]
		181 |   }
		182 |   statement {
		183 |     effect = "Allow"
		184 | 
		185 |     actions = [
		186 |       "glue:GetDatabase",
		187 |       "glue:GetTable",
		188 |       "glue:GetPartitions",
		189 |       "glue:GetTables"
		190 |     ]
		191 | 
		192 |     resources = [
		193 |       "*"
		194 |     ]
		195 |   }
		196 | }

Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: aws_sfn_state_machine.athena_layer
	File: /step_functions_main.tf:1-36
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		1  | resource "aws_sfn_state_machine" "athena_layer" {
		2  |   name     = "athena-layer"
		3  |   role_arn = aws_iam_role.step_functions_role.arn
		4  | 
		5  |   definition = jsonencode(
		6  |     {
		7  |       "StartAt" : "GetMetadataList",
		8  |       "States" : {
		9  |         "GetMetadataList" : {
		10 |           "Type" : "Task",
		11 |           "Resource" : "${module.get_metadata_from_rds_lambda.lambda_function_arn}",
		12 |           "ResultPath" : "$.metadata_list",
		13 |           "Next" : "LoopThroughMetadataList"
		14 |         },
		15 |         "LoopThroughMetadataList" : {
		16 |           "Type" : "Map",
		17 |           "ItemsPath" : "$.metadata_list.metadata_list",
		18 |           "MaxConcurrency" : 4,
		19 |           "Iterator" : {
		20 |             "StartAt" : "CreateAthenaTable",
		21 |             "States" : {
		22 |               "CreateAthenaTable" : {
		23 |                 "Type" : "Task",
		24 |                 "Resource" : "${module.create_athena_table.lambda_function_arn}",
		25 |                 "ResultPath" : "$.result",
		26 |                 "End" : true
		27 |               }
		28 |             }
		29 |           },
		30 |           "End" : true
		31 |         }
		32 |       }
		33 |     }
		34 |   )
		35 | 
		36 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: aws_sfn_state_machine.athena_layer
	File: /step_functions_main.tf:1-36
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		1  | resource "aws_sfn_state_machine" "athena_layer" {
		2  |   name     = "athena-layer"
		3  |   role_arn = aws_iam_role.step_functions_role.arn
		4  | 
		5  |   definition = jsonencode(
		6  |     {
		7  |       "StartAt" : "GetMetadataList",
		8  |       "States" : {
		9  |         "GetMetadataList" : {
		10 |           "Type" : "Task",
		11 |           "Resource" : "${module.get_metadata_from_rds_lambda.lambda_function_arn}",
		12 |           "ResultPath" : "$.metadata_list",
		13 |           "Next" : "LoopThroughMetadataList"
		14 |         },
		15 |         "LoopThroughMetadataList" : {
		16 |           "Type" : "Map",
		17 |           "ItemsPath" : "$.metadata_list.metadata_list",
		18 |           "MaxConcurrency" : 4,
		19 |           "Iterator" : {
		20 |             "StartAt" : "CreateAthenaTable",
		21 |             "States" : {
		22 |               "CreateAthenaTable" : {
		23 |                 "Type" : "Task",
		24 |                 "Resource" : "${module.create_athena_table.lambda_function_arn}",
		25 |                 "ResultPath" : "$.result",
		26 |                 "End" : true
		27 |               }
		28 |             }
		29 |           },
		30 |           "End" : true
		31 |         }
		32 |       }
		33 |     }
		34 |   )
		35 | 
		36 | }

Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: aws_sfn_state_machine.send_database_to_ap
	File: /step_functions_main.tf:85-171
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: aws_sfn_state_machine.send_database_to_ap
	File: /step_functions_main.tf:85-171
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.db_glue_connection
	File: /lambdas_secrets.tf:1-3
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		1 | resource "aws_secretsmanager_secret" "db_glue_connection" {
		2 |   name = "db_glue_connection"
		3 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.db_password
	File: /server_backups.tf:4-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		4 | resource "aws_secretsmanager_secret" "db_password" {
		5 |   name = "db_password"
		6 | }

Check: CKV2_AWS_62: "Ensure S3 buckets should have event notifications enabled"
	FAILED for resource: aws_s3_bucket.data_store
	File: /s3.tf:1042-1061
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-2-62

		1042 | resource "aws_s3_bucket" "data_store" {
		1043 |   #checkov:skip:CKV_AWS_145
		1044 |   #checkov:skip:CKV_AWS_144
		1045 |   #checkov:skip:CKV_AWS_21
		1046 |   #checkov:skip:CKV2_AWS_65
		1047 |   #checkov:skip:CKV2_AWS_62
		1048 |   #checkov:skip:CKV_AWS_18
		1049 |   #checkov:skip:CKV2_AWS_61
		1050 |   bucket_prefix = "em-data-store-"
		1051 |   force_destroy = false
		1052 |   tags = {
		1053 |     "application"            = "electronic-monitoring-data"
		1054 |     "business-unit"          = "HMPPS"
		1055 |     "environment-name"       = "electronic-monitoring-data-production"
		1056 |     "infrastructure-support" = "dataengineering@digital.justice.gov.uk"
		1057 |     "is-production"          = "true"
		1058 |     "owner"                  = "Data engineering: dataengineering@digital.justice.gov.uk"
		1059 |     "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
		1060 |   }
		1061 | }

Check: CKV2_AWS_60: "Ensure RDS instance with copy tags to snapshots is enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-60

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: aws_security_group.glue_rds_conn_security_group
	File: /dms_security_groups.tf:46-57
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		46 | resource "aws_security_group" "glue_rds_conn_security_group" {
		47 |   name        = "glue-rds-sqlserver-connection-tf"
		48 |   description = "Secuity Group for Glue-RDS-Connection"
		49 |   vpc_id      = data.aws_vpc.shared.id
		50 | 
		51 |   tags = merge(
		52 |     local.tags,
		53 |     {
		54 |       Resource_Type = "Secuity Group for Glue-RDS-Connection",
		55 |     }
		56 |   )
		57 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: module.buddi.module.landing_zone_security_groups.aws_security_group.this
	File: /modules/landing_zone/server_security_group/main.tf:7-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		7  | resource "aws_security_group" "this" {
		8  |   name        = "${var.supplier}-${var.user_name}-inbound-ips"
		9  |   description = "Allowed IP addresses for ${var.user_name} on ${var.supplier} server"
		10 |   vpc_id      = var.vpc_id
		11 | 
		12 |   lifecycle {
		13 |     create_before_destroy = true
		14 |   }
		15 | 
		16 |   tags = merge(
		17 |     var.local_tags,
		18 |     {
		19 |       supplier = var.user_name,
		20 |     },
		21 |   )
		22 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: module.g4s.module.landing_zone_security_groups.aws_security_group.this
	File: /modules/landing_zone/server_security_group/main.tf:7-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		7  | resource "aws_security_group" "this" {
		8  |   name        = "${var.supplier}-${var.user_name}-inbound-ips"
		9  |   description = "Allowed IP addresses for ${var.user_name} on ${var.supplier} server"
		10 |   vpc_id      = var.vpc_id
		11 | 
		12 |   lifecycle {
		13 |     create_before_destroy = true
		14 |   }
		15 | 
		16 |   tags = merge(
		17 |     var.local_tags,
		18 |     {
		19 |       supplier = var.user_name,
		20 |     },
		21 |   )
		22 | }

Check: CKV_AWS_18: "Ensure the S3 bucket has access logging enabled"
	FAILED for resource: aws_s3_bucket.data_store
	File: /s3.tf:1042-1061
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-13-enable-logging

		1042 | resource "aws_s3_bucket" "data_store" {
		1043 |   #checkov:skip:CKV_AWS_145
		1044 |   #checkov:skip:CKV_AWS_144
		1045 |   #checkov:skip:CKV_AWS_21
		1046 |   #checkov:skip:CKV2_AWS_65
		1047 |   #checkov:skip:CKV2_AWS_62
		1048 |   #checkov:skip:CKV_AWS_18
		1049 |   #checkov:skip:CKV2_AWS_61
		1050 |   bucket_prefix = "em-data-store-"
		1051 |   force_destroy = false
		1052 |   tags = {
		1053 |     "application"            = "electronic-monitoring-data"
		1054 |     "business-unit"          = "HMPPS"
		1055 |     "environment-name"       = "electronic-monitoring-data-production"
		1056 |     "infrastructure-support" = "dataengineering@digital.justice.gov.uk"
		1057 |     "is-production"          = "true"
		1058 |     "owner"                  = "Data engineering: dataengineering@digital.justice.gov.uk"
		1059 |     "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
		1060 |   }
		1061 | }

Check: CKV_AWS_144: "Ensure that S3 bucket has cross-region replication enabled"
	FAILED for resource: aws_s3_bucket.data_store
	File: /s3.tf:1042-1061
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-s3-bucket-has-cross-region-replication-enabled

		1042 | resource "aws_s3_bucket" "data_store" {
		1043 |   #checkov:skip:CKV_AWS_145
		1044 |   #checkov:skip:CKV_AWS_144
		1045 |   #checkov:skip:CKV_AWS_21
		1046 |   #checkov:skip:CKV2_AWS_65
		1047 |   #checkov:skip:CKV2_AWS_62
		1048 |   #checkov:skip:CKV_AWS_18
		1049 |   #checkov:skip:CKV2_AWS_61
		1050 |   bucket_prefix = "em-data-store-"
		1051 |   force_destroy = false
		1052 |   tags = {
		1053 |     "application"            = "electronic-monitoring-data"
		1054 |     "business-unit"          = "HMPPS"
		1055 |     "environment-name"       = "electronic-monitoring-data-production"
		1056 |     "infrastructure-support" = "dataengineering@digital.justice.gov.uk"
		1057 |     "is-production"          = "true"
		1058 |     "owner"                  = "Data engineering: dataengineering@digital.justice.gov.uk"
		1059 |     "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
		1060 |   }
		1061 | }

Check: CKV2_AWS_65: "Ensure access control lists for S3 buckets are disabled"
	FAILED for resource: aws_s3_bucket_ownership_controls.bucket
	File: /s3.tf:1071-1076
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-general-112

		1071 | resource "aws_s3_bucket_ownership_controls" "bucket" {
		1072 |   bucket = aws_s3_bucket.data_store.id
		1073 |   rule {
		1074 |     object_ownership = "ObjectWriter"
		1075 |   }
		1076 | }

Check: CKV_AWS_145: "Ensure that S3 buckets are encrypted with KMS by default"
	FAILED for resource: aws_s3_bucket.data_store
	File: /s3.tf:1042-1061
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-s3-buckets-are-encrypted-with-kms-by-default

		1042 | resource "aws_s3_bucket" "data_store" {
		1043 |   #checkov:skip:CKV_AWS_145
		1044 |   #checkov:skip:CKV_AWS_144
		1045 |   #checkov:skip:CKV_AWS_21
		1046 |   #checkov:skip:CKV2_AWS_65
		1047 |   #checkov:skip:CKV2_AWS_62
		1048 |   #checkov:skip:CKV_AWS_18
		1049 |   #checkov:skip:CKV2_AWS_61
		1050 |   bucket_prefix = "em-data-store-"
		1051 |   force_destroy = false
		1052 |   tags = {
		1053 |     "application"            = "electronic-monitoring-data"
		1054 |     "business-unit"          = "HMPPS"
		1055 |     "environment-name"       = "electronic-monitoring-data-production"
		1056 |     "infrastructure-support" = "dataengineering@digital.justice.gov.uk"
		1057 |     "is-production"          = "true"
		1058 |     "owner"                  = "Data engineering: dataengineering@digital.justice.gov.uk"
		1059 |     "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
		1060 |   }
		1061 | }

Check: CKV_AWS_21: "Ensure all data stored in the S3 bucket have versioning enabled"
	FAILED for resource: aws_s3_bucket.data_store
	File: /s3.tf:1042-1061
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-16-enable-versioning

		1042 | resource "aws_s3_bucket" "data_store" {
		1043 |   #checkov:skip:CKV_AWS_145
		1044 |   #checkov:skip:CKV_AWS_144
		1045 |   #checkov:skip:CKV_AWS_21
		1046 |   #checkov:skip:CKV2_AWS_65
		1047 |   #checkov:skip:CKV2_AWS_62
		1048 |   #checkov:skip:CKV_AWS_18
		1049 |   #checkov:skip:CKV2_AWS_61
		1050 |   bucket_prefix = "em-data-store-"
		1051 |   force_destroy = false
		1052 |   tags = {
		1053 |     "application"            = "electronic-monitoring-data"
		1054 |     "business-unit"          = "HMPPS"
		1055 |     "environment-name"       = "electronic-monitoring-data-production"
		1056 |     "infrastructure-support" = "dataengineering@digital.justice.gov.uk"
		1057 |     "is-production"          = "true"
		1058 |     "owner"                  = "Data engineering: dataengineering@digital.justice.gov.uk"
		1059 |     "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
		1060 |   }
		1061 | }

Check: CKV2_AWS_61: "Ensure that an S3 bucket has a lifecycle configuration"
	FAILED for resource: aws_s3_bucket.data_store
	File: /s3.tf:1042-1061
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-2-61

		1042 | resource "aws_s3_bucket" "data_store" {
		1043 |   #checkov:skip:CKV_AWS_145
		1044 |   #checkov:skip:CKV_AWS_144
		1045 |   #checkov:skip:CKV_AWS_21
		1046 |   #checkov:skip:CKV2_AWS_65
		1047 |   #checkov:skip:CKV2_AWS_62
		1048 |   #checkov:skip:CKV_AWS_18
		1049 |   #checkov:skip:CKV2_AWS_61
		1050 |   bucket_prefix = "em-data-store-"
		1051 |   force_destroy = false
		1052 |   tags = {
		1053 |     "application"            = "electronic-monitoring-data"
		1054 |     "business-unit"          = "HMPPS"
		1055 |     "environment-name"       = "electronic-monitoring-data-production"
		1056 |     "infrastructure-support" = "dataengineering@digital.justice.gov.uk"
		1057 |     "is-production"          = "true"
		1058 |     "owner"                  = "Data engineering: dataengineering@digital.justice.gov.uk"
		1059 |     "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
		1060 |   }
		1061 | }

dockerfile scan results:

Passed checks: 21, Failed checks: 2, Skipped checks: 0

Check: CKV_DOCKER_2: "Ensure that HEALTHCHECK instructions have been added to container images"
	FAILED for resource: /lambdas/update_log_table/Dockerfile.
	File: /lambdas/update_log_table/Dockerfile:1-9
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/docker-policies/docker-policy-index/ensure-that-healthcheck-instructions-have-been-added-to-container-images

		1 | FROM public.ecr.aws/lambda/python:3.11
		2 | 
		3 | COPY requirements.txt .
		4 | 
		5 | RUN pip install -r requirements.txt --target "${LAMBDA_TASK_ROOT}"
		6 | 
		7 | COPY update_log_table.py ${LAMBDA_TASK_ROOT}
		8 | 
		9 | CMD ["update_log_table.handler"]

Check: CKV_DOCKER_3: "Ensure that a user for the container has been created"
	FAILED for resource: /lambdas/update_log_table/Dockerfile.
	File: /lambdas/update_log_table/Dockerfile:1-9
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/docker-policies/docker-policy-index/ensure-that-a-user-for-the-container-has-been-created

		1 | FROM public.ecr.aws/lambda/python:3.11
		2 | 
		3 | COPY requirements.txt .
		4 | 
		5 | RUN pip install -r requirements.txt --target "${LAMBDA_TASK_ROOT}"
		6 | 
		7 | COPY update_log_table.py ${LAMBDA_TASK_ROOT}
		8 | 
		9 | CMD ["update_log_table.handler"]


checkov_exitcode=1

CTFLint Scan Failed

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
terraform/environments/electronic-monitoring-data

*****************************

Running tflint in terraform/environments/electronic-monitoring-data
Excluding the following checks: terraform_unused_declarations
11 issue(s) found:

Warning: Missing version constraint for provider "archive" in `required_providers` (terraform_required_providers)

  on terraform/environments/electronic-monitoring-data/glue_data.tf line 1:
   1: data "archive_file" "archive_file_zip_py_files" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

Warning: `s3_pylib_dir_path` variable has no type (terraform_typed_variables)

  on terraform/environments/electronic-monitoring-data/glue_variables.tf line 1:
   1: variable "s3_pylib_dir_path" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_typed_variables.md

Warning: Missing version constraint for provider "random" in `required_providers` (terraform_required_providers)

  on terraform/environments/electronic-monitoring-data/server_backups.tf line 13:
  13: resource "random_password" "random_password" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 11:
  11:           "Resource" : "${module.get_metadata_from_rds_lambda.lambda_function_arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 24:
  24:                 "Resource" : "${module.create_athena_table.lambda_function_arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 98:
  98:             "WorkGroup" : "${aws_athena_workgroup.default.name}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 114:
 114:           "Resource" : "${module.query_output_to_list.lambda_function_arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 127:
 127:                 "Resource" : "${module.get_file_keys_for_table.lambda_function_arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 141:
 141:                       "Resource" : "${module.send_table_to_ap.lambda_function_arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 152:
 152:                 "Resource" : "${module.update_log_table.lambda_function_arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 164:
 164:             "WorkGroup" : "${aws_athena_workgroup.default.name}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

tflint_exitcode=2

Trivy Scan Failed

Show Output

*****************************

Trivy will check the following folders:
terraform/environments/electronic-monitoring-data

*****************************

Running Trivy in terraform/environments/electronic-monitoring-data
2024-10-10T10:58:48Z	INFO	[vulndb] Need to update DB
2024-10-10T10:58:48Z	INFO	[vulndb] Downloading vulnerability DB...
2024-10-10T10:58:48Z	INFO	[vulndb] Downloading artifact...	repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-10T10:58:51Z	INFO	[vulndb] Artifact successfully downloaded	repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-10T10:58:51Z	INFO	[vuln] Vulnerability scanning is enabled
2024-10-10T10:58:51Z	INFO	[misconfig] Misconfiguration scanning is enabled
2024-10-10T10:58:51Z	INFO	[misconfig] Need to update the built-in checks
2024-10-10T10:58:51Z	INFO	[misconfig] Downloading the built-in checks...
156.02 KiB / 156.02 KiB [---------------------------------------------------------] 100.00% ? p/s 0s2024-10-10T10:58:51Z	INFO	[secret] Secret scanning is enabled
2024-10-10T10:58:51Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-10T10:58:51Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-10-10T10:58:51Z	WARN	[pip] Unable to find python `site-packages` directory. License detection is skipped.	err="site-packages directory not found"
2024-10-10T10:58:53Z	INFO	[terraform scanner] Scanning root module	file_path="."
2024-10-10T10:58:53Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="networking"
2024-10-10T10:58:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T10:58:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T10:58:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T10:58:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T10:58:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T10:58:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T10:58:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T10:58:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T10:58:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T10:58:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T10:58:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.aws_s3_object.user_public_keys" value="cty.NilVal"
2024-10-10T10:58:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.data.aws_subnet.local_account" value="cty.NilVal"
2024-10-10T10:58:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-10T10:58:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-10T10:58:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-10T10:59:03Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-10T10:59:03Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-10T10:59:03Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-bucket-encryption" range="s3.tf:1042-1061"
2024-10-10T10:59:03Z	INFO	[terraform executor] Ignore finding	rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:281-286"
2024-10-10T10:59:03Z	INFO	[terraform executor] Ignore finding	rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:407-411"
2024-10-10T10:59:03Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-10T10:59:03Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-10T10:59:03Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-10T10:59:03Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-10T10:59:03Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-10T10:59:03Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-10T10:59:03Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-10T10:59:03Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-10T10:59:03Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-10T10:59:03Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-10T10:59:03Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-10T10:59:03Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=v4.2.1/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=568694e50e03630d99cb569eafa06a0b879a1239/main.tf:171-179"
2024-10-10T10:59:03Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="s3.tf:1042-1061"
2024-10-10T10:59:03Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-logging" range="s3.tf:1042-1061"
2024-10-10T10:59:03Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-versioning" range="s3.tf:1042-1061"
2024-10-10T10:59:03Z	INFO	Number of language-specific files	num=1
2024-10-10T10:59:03Z	INFO	[pip] Detecting vulnerabilities...
2024-10-10T10:59:03Z	INFO	Detected config files	num=17

data_store.tf (terraform)
=========================
Tests: 1 (SUCCESSES: 0, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Topic does not have encryption enabled.
════════════════════════════════════════
Topics should be encrypted to protect their contents.


See https://avd.aquasec.com/misconfig/avd-aws-0095
────────────────────────────────────────
 data_store.tf:17-19
────────────────────────────────────────
  17 ┌ resource "aws_sns_topic" "s3_events" {
  18 │   name = "${module.s3-data-bucket.bucket.id}-object-created-topic"
  19 └ }
────────────────────────────────────────



lambdas/update_log_table/Dockerfile (dockerfile)
================================================
Tests: 20 (SUCCESSES: 19, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Specify at least 1 USER command in Dockerfile with non-root user as argument
════════════════════════════════════════
Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

See https://avd.aquasec.com/misconfig/ds002
────────────────────────────────────────


trivy_exitcode=1

[github-actions]

Trivy Scan Failed

Show Output

```hcl

---

Trivy will check the following folders:
terraform/environments/electronic-monitoring-data

---

Running Trivy in terraform/environments/electronic-monitoring-data
2024-10-14T17:38:54Z INFO [vulndb] Need to update DB
2024-10-14T17:38:54Z INFO [vulndb] Downloading vulnerability DB...
2024-10-14T17:38:54Z INFO [vulndb] Downloading artifact... repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-14T17:38:56Z INFO [vulndb] Artifact successfully downloaded repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-14T17:38:56Z INFO [vuln] Vulnerability scanning is enabled
2024-10-14T17:38:56Z INFO [misconfig] Misconfiguration scanning is enabled
2024-10-14T17:38:56Z INFO [misconfig] Need to update the built-in checks
2024-10-14T17:38:56Z INFO [misconfig] Downloading the built-in checks...
156.02 KiB / 156.02 KiB [---------------------------------------------------------] 100.00% ? p/s 0s2024-10-14T17:38:57Z INFO [secret] Secret scanning is enabled
2024-10-14T17:38:57Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-14T17:38:57Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-10-14T17:38:57Z WARN [pip] Unable to find python site-packages directory. License detection is skipped. err="site-packages directory not found"
2024-10-14T17:38:59Z INFO [terraform scanner] Scanning root module file_path="."
2024-10-14T17:38:59Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="networking"
2024-10-14T17:39:00Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T17:39:00Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T17:39:00Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T17:39:00Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T17:39:00Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T17:39:00Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T17:39:00Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T17:39:00Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T17:39:00Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T17:39:00Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T17:39:00Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.aws_s3_object.user_public_keys" value="cty.NilVal"
2024-10-14T17:39:00Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.data.aws_subnet.local_account" value="cty.NilVal"
2024-10-14T17:39:00Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-14T17:39:00Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:03Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:08Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T17:39:08Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T17:39:08Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T17:39:08Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T17:39:08Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T17:39:08Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T17:39:08Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T17:39:08Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T17:39:08Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T17:39:08Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T17:39:08Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T17:39:08Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=95ed3c3/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=568694e50e03630d99cb569eafa06a0b879a1239/main.tf:171-179"
2024-10-14T17:39:08Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="s3.tf:1061-1080"
2024-10-14T17:39:08Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-14T17:39:08Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-14T17:39:08Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-bucket-encryption" range="s3.tf:1061-1080"
2024-10-14T17:39:08Z INFO [terraform executor] Ignore finding rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:281-286"
2024-10-14T17:39:08Z INFO [terraform executor] Ignore finding rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:407-411"
2024-10-14T17:39:08Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-logging" range="s3.tf:1061-1080"
2024-10-14T17:39:08Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-versioning" range="s3.tf:1061-1080"
2024-10-14T17:39:08Z INFO Number of language-specific files num=1
2024-10-14T17:39:08Z INFO [pip] Detecting vulnerabilities...
2024-10-14T17:39:08Z INFO Detected config files num=17

data_store.tf (terraform)

Tests: 1 (SUCCESSES: 0, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Topic does not have encryption enabled.
════════════════════════════════════════
Topics should be encrypted to protect their contents.

See https://avd.aquasec.com/misconfig/avd-aws-0095
────────────────────────────────────────
data_store.tf:17-19
────────────────────────────────────────
17 ┌ resource "aws_sns_topic" "s3_events" {
18 │ name = "${module.s3-data-bucket.bucket.id}-object-created-topic"
19 └ }
────────────────────────────────────────

lambdas/update_log_table/Dockerfile (dockerfile)

Tests: 20 (SUCCESSES: 19, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Specify at least 1 USER command in Dockerfile with non-root user as argument
════════════════════════════════════════
Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

See https://avd.aquasec.com/misconfig/ds002
────────────────────────────────────────

trivy_exitcode=1

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/electronic-monitoring-data

*****************************

Running Checkov in terraform/environments/electronic-monitoring-data
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2024-10-14 17:39:11,352 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060:None (for external modules, the --download-external-modules flag is required)
2024-10-14 17:39:11,352 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=95ed3c3:None (for external modules, the --download-external-modules flag is required)
2024-10-14 17:39:11,352 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/secrets-manager/aws:1.3.0 (for external modules, the --download-external-modules flag is required)
2024-10-14 17:39:11,352 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=52a40b0:None (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 2286, Failed checks: 75, Skipped checks: 27

Check: CKV_AWS_26: "Ensure all data stored in the SNS topic is encrypted"
	FAILED for resource: aws_sns_topic.s3_events
	File: /data_store.tf:17-19
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-15

		17 | resource "aws_sns_topic" "s3_events" {
		18 |   name = "${module.s3-data-bucket.bucket.id}-object-created-topic"
		19 | }

Check: CKV_AWS_115: "Ensure that AWS Lambda function is configured for function-level concurrent execution limit"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-function-level-concurrent-execution-limit

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_272: "Ensure AWS Lambda function is configured to validate code-signing"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-272

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_173: "Check encryption settings for Lambda environmental variable"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-5

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_117: "Ensure that AWS Lambda function is configured inside a VPC"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-inside-a-vpc-1

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_116: "Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-a-dead-letter-queue-dlq

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_115: "Ensure that AWS Lambda function is configured for function-level concurrent execution limit"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-function-level-concurrent-execution-limit

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_272: "Ensure AWS Lambda function is configured to validate code-signing"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-272

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_117: "Ensure that AWS Lambda function is configured inside a VPC"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-inside-a-vpc-1

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_116: "Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-a-dead-letter-queue-dlq

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group
	File: /dms_data_validation_glue_job.tf:65-68
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		65 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group" {
		66 |   name              = "dms-dv-glue-job"
		67 |   retention_in_days = 14
		68 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group
	File: /dms_data_validation_glue_job.tf:65-68
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		65 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group" {
		66 |   name              = "dms-dv-glue-job"
		67 |   retention_in_days = 14
		68 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group_v2
	File: /dms_data_validation_glue_job.tf:70-73
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		70 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group_v2" {
		71 |   name              = "dms-dv-glue-job-v2"
		72 |   retention_in_days = 14
		73 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group_v2
	File: /dms_data_validation_glue_job.tf:70-73
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		70 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group_v2" {
		71 |   name              = "dms-dv-glue-job-v2"
		72 |   retention_in_days = 14
		73 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.rds_to_s3_parquet_migration
	File: /dms_data_validation_glue_job.tf:75-78
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		75 | resource "aws_cloudwatch_log_group" "rds_to_s3_parquet_migration" {
		76 |   name              = "rds-to-s3-parquet-migration"
		77 |   retention_in_days = 14
		78 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.rds_to_s3_parquet_migration
	File: /dms_data_validation_glue_job.tf:75-78
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		75 | resource "aws_cloudwatch_log_group" "rds_to_s3_parquet_migration" {
		76 |   name              = "rds-to-s3-parquet-migration"
		77 |   retention_in_days = 14
		78 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.resizing_parquet_files
	File: /dms_data_validation_glue_job.tf:80-83
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		80 | resource "aws_cloudwatch_log_group" "resizing_parquet_files" {
		81 |   name              = "resizing-parquet-files"
		82 |   retention_in_days = 14
		83 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.resizing_parquet_files
	File: /dms_data_validation_glue_job.tf:80-83
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		80 | resource "aws_cloudwatch_log_group" "resizing_parquet_files" {
		81 |   name              = "resizing-parquet-files"
		82 |   retention_in_days = 14
		83 | }

Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.dms_dv_glue_job_v2
	File: /dms_data_validation_glue_job.tf:86-139
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.dms_dv_glue_job_v4d
	File: /dms_data_validation_glue_job.tf:147-200
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.rds_to_s3_parquet_migration
	File: /dms_data_validation_glue_job.tf:203-267
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.rds_to_s3_parquet_migration_monthly
	File: /dms_data_validation_glue_job.tf:271-325
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.resizing_parquet_files
	File: /dms_data_validation_glue_job.tf:328-380
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.catalog_dv_table_glue_job
	File: /dms_data_validation_glue_job.tf:383-411
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		383 | resource "aws_glue_job" "catalog_dv_table_glue_job" {
		384 |   name              = "catalog-dv-table-glue-job"
		385 |   description       = "Python script uses Boto3-Athena-Client to run sql-statements"
		386 |   role_arn          = aws_iam_role.dms_dv_glue_job_iam_role.arn
		387 |   glue_version      = "4.0"
		388 |   worker_type       = "G.1X"
		389 |   number_of_workers = 2
		390 |   default_arguments = {
		391 |     "--parquet_output_bucket_name"       = module.s3-dms-data-validation-bucket.bucket.id
		392 |     "--glue_catalog_db_name"             = aws_glue_catalog_database.dms_dv_glue_catalog_db.name
		393 |     "--glue_catalog_tbl_name"            = "glue_df_output"
		394 |     "--continuous-log-logGroup"          = aws_cloudwatch_log_group.dms_dv_cw_log_group.name
		395 |     "--enable-continuous-cloudwatch-log" = "true"
		396 |     "--enable-continuous-log-filter"     = "true"
		397 |     "--enable-metrics"                   = ""
		398 |   }
		399 |   command {
		400 |     python_version  = "3"
		401 |     script_location = "s3://${module.s3-glue-job-script-bucket.bucket.id}/create_or_replace_dv_table.py"
		402 |   }
		403 | 
		404 |   tags = merge(
		405 |     local.tags,
		406 |     {
		407 |       Resource_Type = "Py script as glue-job that creates dv table / refreshes its partitions",
		408 |     }
		409 |   )
		410 | 
		411 | }

Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_crawler.rds_sqlserver_db_glue_crawler
	File: /dms_glue_crawler.tf:35-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		35 | resource "aws_glue_crawler" "rds_sqlserver_db_glue_crawler" {
		36 |   name          = "rds-sqlserver-${aws_db_instance.database_2022.identifier}-tf"
		37 |   role          = aws_iam_role.dms_dv_glue_job_iam_role.arn
		38 |   database_name = aws_glue_catalog_database.rds_sqlserver_glue_catalog_db.name
		39 |   description   = "Crawler to fetch database names"
		40 |   #   table_prefix  = "your_table_prefix"
		41 | 
		42 |   jdbc_target {
		43 |     connection_name = aws_glue_connection.glue_rds_sqlserver_db_connection.name
		44 |     path            = "%"
		45 |   }
		46 |   tags = merge(
		47 |     local.tags,
		48 |     {
		49 |       Resource_Type = "RDS-SQLServer Glue-Crawler for DMS",
		50 |     }
		51 |   )
		52 | 
		53 |   # provisioner "local-exec" {
		54 |   #   command = "aws glue start-crawler --name ${self.name}"
		55 |   # }
		56 | }

Check: CKV_AWS_212: "Ensure DMS replication instance is encrypted by KMS using a customer managed Key (CMK)"
	FAILED for resource: aws_dms_replication_instance.dms_replication_instance
	File: /dms_replication_instance.tf:24-55
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-ebs-volume-is-encrypted-by-key-management-service-kms-using-a-customer-managed-key-cmk

		24 | resource "aws_dms_replication_instance" "dms_replication_instance" {
		25 |   allocated_storage          = var.dms_allocated_storage_gib
		26 |   apply_immediately          = true
		27 |   auto_minor_version_upgrade = true
		28 |   availability_zone          = var.dms_availability_zone
		29 |   engine_version             = var.dms_engine_version
		30 |   #   kms_key_arn                  = "arn:aws:kms:eu-west-2:800964199911:key/b7f54acb-16a3-4958-9340-3bdf5f5842d8"
		31 |   multi_az = false
		32 |   #   preferred_maintenance_window = "sun:10:30-sun:14:30"
		33 |   publicly_accessible         = false
		34 |   replication_instance_class  = var.dms_replication_instance_class
		35 |   replication_instance_id     = "dms-replication-instance-tf"
		36 |   replication_subnet_group_id = aws_dms_replication_subnet_group.dms_replication_subnet_group.id
		37 | 
		38 |   tags = merge(
		39 |     local.tags,
		40 |     {
		41 |       Resource_Type = "DMS Replication Instance",
		42 |     }
		43 |   )
		44 | 
		45 |   vpc_security_group_ids = [
		46 |     aws_security_group.dms_ri_security_group.id,
		47 |   ]
		48 | 
		49 |   depends_on = [
		50 |     aws_iam_role.dms_vpc_role,
		51 |     aws_iam_role.dms_cloudwatch_logs_role,
		52 |     aws_iam_role.dms_endpoint_role
		53 |   ]
		54 | 
		55 | }

Check: CKV_AWS_25: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389"
	FAILED for resource: aws_vpc_security_group_ingress_rule.glue_rds_conn_inbound
	File: /dms_security_groups.tf:69-77
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-2

		69 | resource "aws_vpc_security_group_ingress_rule" "glue_rds_conn_inbound" {
		70 |   security_group_id = aws_security_group.glue_rds_conn_security_group.id
		71 | 
		72 |   referenced_security_group_id = aws_security_group.glue_rds_conn_security_group.id
		73 |   ip_protocol                  = "tcp"
		74 |   from_port                    = 0
		75 |   to_port                      = 65535
		76 |   description                  = "Required ports open for Glue-RDS-Connection"
		77 | }

Check: CKV_AWS_24: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 22"
	FAILED for resource: aws_vpc_security_group_ingress_rule.glue_rds_conn_inbound
	File: /dms_security_groups.tf:69-77
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-1-port-security

		69 | resource "aws_vpc_security_group_ingress_rule" "glue_rds_conn_inbound" {
		70 |   security_group_id = aws_security_group.glue_rds_conn_security_group.id
		71 | 
		72 |   referenced_security_group_id = aws_security_group.glue_rds_conn_security_group.id
		73 |   ip_protocol                  = "tcp"
		74 |   from_port                    = 0
		75 |   to_port                      = 65535
		76 |   description                  = "Required ports open for Glue-RDS-Connection"
		77 | }

Check: CKV_AWS_260: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 80"
	FAILED for resource: aws_vpc_security_group_ingress_rule.glue_rds_conn_inbound
	File: /dms_security_groups.tf:69-77
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-aws-security-groups-do-not-allow-ingress-from-00000-to-port-80

		69 | resource "aws_vpc_security_group_ingress_rule" "glue_rds_conn_inbound" {
		70 |   security_group_id = aws_security_group.glue_rds_conn_security_group.id
		71 | 
		72 |   referenced_security_group_id = aws_security_group.glue_rds_conn_security_group.id
		73 |   ip_protocol                  = "tcp"
		74 |   from_port                    = 0
		75 |   to_port                      = 65535
		76 |   description                  = "Required ports open for Glue-RDS-Connection"
		77 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.glue_notebook_ec2_iam_policy_document
	File: /glue_data.tf:103-118
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		103 | data "aws_iam_policy_document" "glue_notebook_ec2_iam_policy_document" {
		104 |   statement {
		105 |     effect = "Allow"
		106 |     actions = [
		107 |       "ec2:CreateNetworkInterface",
		108 |       "ec2:DescribeNetworkInterfaces",
		109 |       "ec2:DeleteNetworkInterface",
		110 |       "ec2:DescribeVpcEndpoints",
		111 |       "ec2:DescribeSubnets",
		112 |       "ec2:DescribeVpcAttribute",
		113 |       "ec2:DescribeRouteTables",
		114 |       "ec2:DescribeSecurityGroups"
		115 |     ]
		116 |     resources = ["*"]
		117 |   }
		118 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.glue_notebook_ec2_iam_policy_document
	File: /glue_data.tf:103-118
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		103 | data "aws_iam_policy_document" "glue_notebook_ec2_iam_policy_document" {
		104 |   statement {
		105 |     effect = "Allow"
		106 |     actions = [
		107 |       "ec2:CreateNetworkInterface",
		108 |       "ec2:DescribeNetworkInterfaces",
		109 |       "ec2:DeleteNetworkInterface",
		110 |       "ec2:DescribeVpcEndpoints",
		111 |       "ec2:DescribeSubnets",
		112 |       "ec2:DescribeVpcAttribute",
		113 |       "ec2:DescribeRouteTables",
		114 |       "ec2:DescribeSecurityGroups"
		115 |     ]
		116 |     resources = ["*"]
		117 |   }
		118 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.load_json_table_s3_policy_document
	File: /lambdas_iam.tf:430-487
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.load_json_table_s3_policy_document
	File: /lambdas_iam.tf:430-487
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.db_glue_connection
	File: /lambdas_secrets.tf:1-3
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		1 | resource "aws_secretsmanager_secret" "db_glue_connection" {
		2 |   name = "db_glue_connection"
		3 | }

Check: CKV_AWS_296: "Ensure DMS endpoint uses Customer Managed Key (CMK)"
	FAILED for resource: module.dms_task.aws_dms_endpoint.dms_rds_source
	File: /modules/dms/endpoints_rds_s3.tf:2-23
	Calling File: /dms_main.tf:1-39
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-296

		2  | resource "aws_dms_endpoint" "dms_rds_source" {
		3  | 
		4  |   #   certificate_arn             = ""
		5  |   database_name = var.database_name
		6  |   endpoint_id   = "rds-mssql-${replace(var.database_name, "_", "-")}-tf"
		7  |   endpoint_type = "source"
		8  |   engine_name   = "sqlserver"
		9  |   #   extra_connection_attributes = ""
		10 |   #   kms_key_arn                 = aws_db_instance.database_2022.kms_key_id
		11 |   password    = var.rds_db_instance_pasword
		12 |   port        = var.rds_db_instance_port
		13 |   server_name = var.rds_db_server_name
		14 |   ssl_mode    = "require"
		15 |   username    = var.rds_db_username
		16 | 
		17 |   tags = merge(
		18 |     var.local_tags,
		19 |     {
		20 |       Resource_Type = "DMS Source Endpoint - RDS MSSQL",
		21 |     },
		22 |   )
		23 | }

Check: CKV_AWS_298: "Ensure DMS S3 uses Customer Managed Key (CMK)"
	FAILED for resource: module.dms_task.aws_dms_s3_endpoint.dms_s3_parquet_target
	File: /modules/dms/endpoints_rds_s3.tf:28-84
	Calling File: /dms_main.tf:1-39
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-298

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:38-47
	Calling File: /step_functions_main.tf:233-243
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		38 | data "aws_iam_policy_document" "step_function_base_permissions" {
		39 |   statement {
		40 |     effect = "Allow"
		41 |     actions = [
		42 |       "sns:Publish",
		43 |       "sqs:SendMessage"
		44 |     ]
		45 |     resources = ["*"]
		46 |   }
		47 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:38-47
	Calling File: /step_functions_main.tf:233-243
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		38 | data "aws_iam_policy_document" "step_function_base_permissions" {
		39 |   statement {
		40 |     effect = "Allow"
		41 |     actions = [
		42 |       "sns:Publish",
		43 |       "sqs:SendMessage"
		44 |     ]
		45 |     resources = ["*"]
		46 |   }
		47 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:54-82
	Calling File: /step_functions_main.tf:233-243
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		54 | data "aws_iam_policy_document" "this_log_key_document" {
		55 |   statement {
		56 |     sid    = "EnableIAMUserPermissions"
		57 |     effect = "Allow"
		58 |     principals {
		59 |       type        = "AWS"
		60 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		61 |     }
		62 |     actions   = ["kms:*"]
		63 |     resources = ["*"]
		64 |   }
		65 | 
		66 |   statement {
		67 |     sid    = "EnableLogServicePermissions"
		68 |     effect = "Allow"
		69 |     principals {
		70 |       type        = "Service"
		71 |       identifiers = ["logs.eu-west-2.amazonaws.com"]
		72 |     }
		73 |     actions = [
		74 |       "kms:Encrypt*",
		75 |       "kms:Decrypt*",
		76 |       "kms:ReEncrypt*",
		77 |       "kms:GenerateDataKey*",
		78 |       "kms:Describe*",
		79 |     ]
		80 |     resources = ["*"]
		81 |   }
		82 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:54-82
	Calling File: /step_functions_main.tf:233-243
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		54 | data "aws_iam_policy_document" "this_log_key_document" {
		55 |   statement {
		56 |     sid    = "EnableIAMUserPermissions"
		57 |     effect = "Allow"
		58 |     principals {
		59 |       type        = "AWS"
		60 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		61 |     }
		62 |     actions   = ["kms:*"]
		63 |     resources = ["*"]
		64 |   }
		65 | 
		66 |   statement {
		67 |     sid    = "EnableLogServicePermissions"
		68 |     effect = "Allow"
		69 |     principals {
		70 |       type        = "Service"
		71 |       identifiers = ["logs.eu-west-2.amazonaws.com"]
		72 |     }
		73 |     actions = [
		74 |       "kms:Encrypt*",
		75 |       "kms:Decrypt*",
		76 |       "kms:ReEncrypt*",
		77 |       "kms:GenerateDataKey*",
		78 |       "kms:Describe*",
		79 |     ]
		80 |     resources = ["*"]
		81 |   }
		82 | }

Check: CKV_AWS_109: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:54-82
	Calling File: /step_functions_main.tf:233-243
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-permissions-management-resource-exposure-without-constraint

		54 | data "aws_iam_policy_document" "this_log_key_document" {
		55 |   statement {
		56 |     sid    = "EnableIAMUserPermissions"
		57 |     effect = "Allow"
		58 |     principals {
		59 |       type        = "AWS"
		60 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		61 |     }
		62 |     actions   = ["kms:*"]
		63 |     resources = ["*"]
		64 |   }
		65 | 
		66 |   statement {
		67 |     sid    = "EnableLogServicePermissions"
		68 |     effect = "Allow"
		69 |     principals {
		70 |       type        = "Service"
		71 |       identifiers = ["logs.eu-west-2.amazonaws.com"]
		72 |     }
		73 |     actions = [
		74 |       "kms:Encrypt*",
		75 |       "kms:Decrypt*",
		76 |       "kms:ReEncrypt*",
		77 |       "kms:GenerateDataKey*",
		78 |       "kms:Describe*",
		79 |     ]
		80 |     resources = ["*"]
		81 |   }
		82 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: module.get_zipped_file.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:3-7
	Calling File: /step_functions_main.tf:233-243
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		3 | resource "aws_sfn_state_machine" "this" {
		4 |   name       = var.name
		5 |   role_arn   = aws_iam_role.step_function_role.arn
		6 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		7 | }

Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: module.get_zipped_file.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:3-7
	Calling File: /step_functions_main.tf:233-243
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		3 | resource "aws_sfn_state_machine" "this" {
		4 |   name       = var.name
		5 |   role_arn   = aws_iam_role.step_function_role.arn
		6 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		7 | }

Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.db_password
	File: /server_backups.tf:4-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		4 | resource "aws_secretsmanager_secret" "db_password" {
		5 |   name = "db_password"
		6 | }

Check: CKV_AWS_157: "Ensure that RDS instances have Multi-AZ enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-73

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_118: "Ensure that enhanced monitoring is enabled for Amazon RDS instances"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/ensure-that-enhanced-monitoring-is-enabled-for-amazon-rds-instances

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_129: "Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-that-respective-logs-of-amazon-relational-database-service-amazon-rds-are-enabled

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_354: "Ensure RDS Performance Insights are encrypted using KMS CMKs"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-354

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_353: "Ensure that RDS instances have performance insights enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-353

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_293: "Ensure that AWS database instances have deletion protection enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-293

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_25: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389"
	FAILED for resource: aws_vpc_security_group_ingress_rule.db_glue_access
	File: /server_backups.tf:123-131
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-2

		123 | resource "aws_vpc_security_group_ingress_rule" "db_glue_access" {
		124 | 
		125 |   security_group_id            = aws_security_group.db.id
		126 |   description                  = "glue"
		127 |   ip_protocol                  = "tcp"
		128 |   from_port                    = 0
		129 |   to_port                      = 65535
		130 |   referenced_security_group_id = aws_security_group.db.id
		131 | }

Check: CKV_AWS_24: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 22"
	FAILED for resource: aws_vpc_security_group_ingress_rule.db_glue_access
	File: /server_backups.tf:123-131
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-1-port-security

		123 | resource "aws_vpc_security_group_ingress_rule" "db_glue_access" {
		124 | 
		125 |   security_group_id            = aws_security_group.db.id
		126 |   description                  = "glue"
		127 |   ip_protocol                  = "tcp"
		128 |   from_port                    = 0
		129 |   to_port                      = 65535
		130 |   referenced_security_group_id = aws_security_group.db.id
		131 | }

Check: CKV_AWS_260: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 80"
	FAILED for resource: aws_vpc_security_group_ingress_rule.db_glue_access
	File: /server_backups.tf:123-131
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-aws-security-groups-do-not-allow-ingress-from-00000-to-port-80

		123 | resource "aws_vpc_security_group_ingress_rule" "db_glue_access" {
		124 | 
		125 |   security_group_id            = aws_security_group.db.id
		126 |   description                  = "glue"
		127 |   ip_protocol                  = "tcp"
		128 |   from_port                    = 0
		129 |   to_port                      = 65535
		130 |   referenced_security_group_id = aws_security_group.db.id
		131 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.send_database_to_ap_athena_queries
	File: /step_functions_iam.tf:151-196
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		151 | data "aws_iam_policy_document" "send_database_to_ap_athena_queries" {
		152 |   statement {
		153 |     effect = "Allow"
		154 | 
		155 |     actions = [
		156 |       "athena:startQueryExecution",
		157 |       "athena:getQueryExecution",
		158 |       "athena:getQueryResults"
		159 |     ]
		160 | 
		161 |     resources = [
		162 |       "*"
		163 |     ]
		164 |   }
		165 |   statement {
		166 |     effect = "Allow"
		167 | 
		168 |     actions = [
		169 |       "s3:PutObject",
		170 |       "s3:GetObject",
		171 |       "s3:ListBucket",
		172 |       "s3:GetBucketLocation"
		173 |     ]
		174 | 
		175 |     resources = [
		176 |       module.s3-athena-bucket.bucket.arn,
		177 |       "${module.s3-athena-bucket.bucket.arn}/*",
		178 |       "${module.s3-dms-data-validation-bucket.bucket.arn}/*",
		179 |       module.s3-dms-data-validation-bucket.bucket.arn
		180 |     ]
		181 |   }
		182 |   statement {
		183 |     effect = "Allow"
		184 | 
		185 |     actions = [
		186 |       "glue:GetDatabase",
		187 |       "glue:GetTable",
		188 |       "glue:GetPartitions",
		189 |       "glue:GetTables"
		190 |     ]
		191 | 
		192 |     resources = [
		193 |       "*"
		194 |     ]
		195 |   }
		196 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.send_database_to_ap_athena_queries
	File: /step_functions_iam.tf:151-196
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		151 | data "aws_iam_policy_document" "send_database_to_ap_athena_queries" {
		152 |   statement {
		153 |     effect = "Allow"
		154 | 
		155 |     actions = [
		156 |       "athena:startQueryExecution",
		157 |       "athena:getQueryExecution",
		158 |       "athena:getQueryResults"
		159 |     ]
		160 | 
		161 |     resources = [
		162 |       "*"
		163 |     ]
		164 |   }
		165 |   statement {
		166 |     effect = "Allow"
		167 | 
		168 |     actions = [
		169 |       "s3:PutObject",
		170 |       "s3:GetObject",
		171 |       "s3:ListBucket",
		172 |       "s3:GetBucketLocation"
		173 |     ]
		174 | 
		175 |     resources = [
		176 |       module.s3-athena-bucket.bucket.arn,
		177 |       "${module.s3-athena-bucket.bucket.arn}/*",
		178 |       "${module.s3-dms-data-validation-bucket.bucket.arn}/*",
		179 |       module.s3-dms-data-validation-bucket.bucket.arn
		180 |     ]
		181 |   }
		182 |   statement {
		183 |     effect = "Allow"
		184 | 
		185 |     actions = [
		186 |       "glue:GetDatabase",
		187 |       "glue:GetTable",
		188 |       "glue:GetPartitions",
		189 |       "glue:GetTables"
		190 |     ]
		191 | 
		192 |     resources = [
		193 |       "*"
		194 |     ]
		195 |   }
		196 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: aws_sfn_state_machine.athena_layer
	File: /step_functions_main.tf:1-36
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		1  | resource "aws_sfn_state_machine" "athena_layer" {
		2  |   name     = "athena-layer"
		3  |   role_arn = aws_iam_role.step_functions_role.arn
		4  | 
		5  |   definition = jsonencode(
		6  |     {
		7  |       "StartAt" : "GetMetadataList",
		8  |       "States" : {
		9  |         "GetMetadataList" : {
		10 |           "Type" : "Task",
		11 |           "Resource" : "${module.get_metadata_from_rds_lambda.lambda_function_arn}",
		12 |           "ResultPath" : "$.metadata_list",
		13 |           "Next" : "LoopThroughMetadataList"
		14 |         },
		15 |         "LoopThroughMetadataList" : {
		16 |           "Type" : "Map",
		17 |           "ItemsPath" : "$.metadata_list.metadata_list",
		18 |           "MaxConcurrency" : 4,
		19 |           "Iterator" : {
		20 |             "StartAt" : "CreateAthenaTable",
		21 |             "States" : {
		22 |               "CreateAthenaTable" : {
		23 |                 "Type" : "Task",
		24 |                 "Resource" : "${module.create_athena_table.lambda_function_arn}",
		25 |                 "ResultPath" : "$.result",
		26 |                 "End" : true
		27 |               }
		28 |             }
		29 |           },
		30 |           "End" : true
		31 |         }
		32 |       }
		33 |     }
		34 |   )
		35 | 
		36 | }

Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: aws_sfn_state_machine.athena_layer
	File: /step_functions_main.tf:1-36
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		1  | resource "aws_sfn_state_machine" "athena_layer" {
		2  |   name     = "athena-layer"
		3  |   role_arn = aws_iam_role.step_functions_role.arn
		4  | 
		5  |   definition = jsonencode(
		6  |     {
		7  |       "StartAt" : "GetMetadataList",
		8  |       "States" : {
		9  |         "GetMetadataList" : {
		10 |           "Type" : "Task",
		11 |           "Resource" : "${module.get_metadata_from_rds_lambda.lambda_function_arn}",
		12 |           "ResultPath" : "$.metadata_list",
		13 |           "Next" : "LoopThroughMetadataList"
		14 |         },
		15 |         "LoopThroughMetadataList" : {
		16 |           "Type" : "Map",
		17 |           "ItemsPath" : "$.metadata_list.metadata_list",
		18 |           "MaxConcurrency" : 4,
		19 |           "Iterator" : {
		20 |             "StartAt" : "CreateAthenaTable",
		21 |             "States" : {
		22 |               "CreateAthenaTable" : {
		23 |                 "Type" : "Task",
		24 |                 "Resource" : "${module.create_athena_table.lambda_function_arn}",
		25 |                 "ResultPath" : "$.result",
		26 |                 "End" : true
		27 |               }
		28 |             }
		29 |           },
		30 |           "End" : true
		31 |         }
		32 |       }
		33 |     }
		34 |   )
		35 | 
		36 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: aws_sfn_state_machine.send_database_to_ap
	File: /step_functions_main.tf:85-171
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: aws_sfn_state_machine.send_database_to_ap
	File: /step_functions_main.tf:85-171
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_18: "Ensure the S3 bucket has access logging enabled"
	FAILED for resource: aws_s3_bucket.data_store
	File: /s3.tf:1061-1080
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-13-enable-logging

		1061 | resource "aws_s3_bucket" "data_store" {
		1062 |   #checkov:skip:CKV_AWS_145
		1063 |   #checkov:skip:CKV_AWS_144
		1064 |   #checkov:skip:CKV_AWS_21
		1065 |   #checkov:skip:CKV2_AWS_65
		1066 |   #checkov:skip:CKV2_AWS_62
		1067 |   #checkov:skip:CKV_AWS_18
		1068 |   #checkov:skip:CKV2_AWS_61
		1069 |   bucket_prefix = "em-data-store-"
		1070 |   force_destroy = false
		1071 |   tags = {
		1072 |     "application"            = "electronic-monitoring-data"
		1073 |     "business-unit"          = "HMPPS"
		1074 |     "environment-name"       = "electronic-monitoring-data-production"
		1075 |     "infrastructure-support" = "dataengineering@digital.justice.gov.uk"
		1076 |     "is-production"          = "true"
		1077 |     "owner"                  = "Data engineering: dataengineering@digital.justice.gov.uk"
		1078 |     "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
		1079 |   }
		1080 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: aws_security_group.glue_rds_conn_security_group
	File: /dms_security_groups.tf:46-57
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		46 | resource "aws_security_group" "glue_rds_conn_security_group" {
		47 |   name        = "glue-rds-sqlserver-connection-tf"
		48 |   description = "Secuity Group for Glue-RDS-Connection"
		49 |   vpc_id      = data.aws_vpc.shared.id
		50 | 
		51 |   tags = merge(
		52 |     local.tags,
		53 |     {
		54 |       Resource_Type = "Secuity Group for Glue-RDS-Connection",
		55 |     }
		56 |   )
		57 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: module.buddi.module.landing_zone_security_groups.aws_security_group.this
	File: /modules/landing_zone/server_security_group/main.tf:7-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		7  | resource "aws_security_group" "this" {
		8  |   name        = "${var.supplier}-${var.user_name}-inbound-ips"
		9  |   description = "Allowed IP addresses for ${var.user_name} on ${var.supplier} server"
		10 |   vpc_id      = var.vpc_id
		11 | 
		12 |   lifecycle {
		13 |     create_before_destroy = true
		14 |   }
		15 | 
		16 |   tags = merge(
		17 |     var.local_tags,
		18 |     {
		19 |       supplier = var.user_name,
		20 |     },
		21 |   )
		22 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: module.capita.module.landing_zone_security_groups.aws_security_group.this
	File: /modules/landing_zone/server_security_group/main.tf:7-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		7  | resource "aws_security_group" "this" {
		8  |   name        = "${var.supplier}-${var.user_name}-inbound-ips"
		9  |   description = "Allowed IP addresses for ${var.user_name} on ${var.supplier} server"
		10 |   vpc_id      = var.vpc_id
		11 | 
		12 |   lifecycle {
		13 |     create_before_destroy = true
		14 |   }
		15 | 
		16 |   tags = merge(
		17 |     var.local_tags,
		18 |     {
		19 |       supplier = var.user_name,
		20 |     },
		21 |   )
		22 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: module.g4s.module.landing_zone_security_groups.aws_security_group.this
	File: /modules/landing_zone/server_security_group/main.tf:7-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		7  | resource "aws_security_group" "this" {
		8  |   name        = "${var.supplier}-${var.user_name}-inbound-ips"
		9  |   description = "Allowed IP addresses for ${var.user_name} on ${var.supplier} server"
		10 |   vpc_id      = var.vpc_id
		11 | 
		12 |   lifecycle {
		13 |     create_before_destroy = true
		14 |   }
		15 | 
		16 |   tags = merge(
		17 |     var.local_tags,
		18 |     {
		19 |       supplier = var.user_name,
		20 |     },
		21 |   )
		22 | }

Check: CKV2_AWS_61: "Ensure that an S3 bucket has a lifecycle configuration"
	FAILED for resource: aws_s3_bucket.data_store
	File: /s3.tf:1061-1080
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-2-61

		1061 | resource "aws_s3_bucket" "data_store" {
		1062 |   #checkov:skip:CKV_AWS_145
		1063 |   #checkov:skip:CKV_AWS_144
		1064 |   #checkov:skip:CKV_AWS_21
		1065 |   #checkov:skip:CKV2_AWS_65
		1066 |   #checkov:skip:CKV2_AWS_62
		1067 |   #checkov:skip:CKV_AWS_18
		1068 |   #checkov:skip:CKV2_AWS_61
		1069 |   bucket_prefix = "em-data-store-"
		1070 |   force_destroy = false
		1071 |   tags = {
		1072 |     "application"            = "electronic-monitoring-data"
		1073 |     "business-unit"          = "HMPPS"
		1074 |     "environment-name"       = "electronic-monitoring-data-production"
		1075 |     "infrastructure-support" = "dataengineering@digital.justice.gov.uk"
		1076 |     "is-production"          = "true"
		1077 |     "owner"                  = "Data engineering: dataengineering@digital.justice.gov.uk"
		1078 |     "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
		1079 |   }
		1080 | }

Check: CKV2_AWS_65: "Ensure access control lists for S3 buckets are disabled"
	FAILED for resource: aws_s3_bucket_ownership_controls.bucket
	File: /s3.tf:1090-1095
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-general-112

		1090 | resource "aws_s3_bucket_ownership_controls" "bucket" {
		1091 |   bucket = aws_s3_bucket.data_store.id
		1092 |   rule {
		1093 |     object_ownership = "ObjectWriter"
		1094 |   }
		1095 | }

Check: CKV_AWS_144: "Ensure that S3 bucket has cross-region replication enabled"
	FAILED for resource: aws_s3_bucket.data_store
	File: /s3.tf:1061-1080
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-s3-bucket-has-cross-region-replication-enabled

		1061 | resource "aws_s3_bucket" "data_store" {
		1062 |   #checkov:skip:CKV_AWS_145
		1063 |   #checkov:skip:CKV_AWS_144
		1064 |   #checkov:skip:CKV_AWS_21
		1065 |   #checkov:skip:CKV2_AWS_65
		1066 |   #checkov:skip:CKV2_AWS_62
		1067 |   #checkov:skip:CKV_AWS_18
		1068 |   #checkov:skip:CKV2_AWS_61
		1069 |   bucket_prefix = "em-data-store-"
		1070 |   force_destroy = false
		1071 |   tags = {
		1072 |     "application"            = "electronic-monitoring-data"
		1073 |     "business-unit"          = "HMPPS"
		1074 |     "environment-name"       = "electronic-monitoring-data-production"
		1075 |     "infrastructure-support" = "dataengineering@digital.justice.gov.uk"
		1076 |     "is-production"          = "true"
		1077 |     "owner"                  = "Data engineering: dataengineering@digital.justice.gov.uk"
		1078 |     "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
		1079 |   }
		1080 | }

Check: CKV_AWS_145: "Ensure that S3 buckets are encrypted with KMS by default"
	FAILED for resource: aws_s3_bucket.data_store
	File: /s3.tf:1061-1080
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-s3-buckets-are-encrypted-with-kms-by-default

		1061 | resource "aws_s3_bucket" "data_store" {
		1062 |   #checkov:skip:CKV_AWS_145
		1063 |   #checkov:skip:CKV_AWS_144
		1064 |   #checkov:skip:CKV_AWS_21
		1065 |   #checkov:skip:CKV2_AWS_65
		1066 |   #checkov:skip:CKV2_AWS_62
		1067 |   #checkov:skip:CKV_AWS_18
		1068 |   #checkov:skip:CKV2_AWS_61
		1069 |   bucket_prefix = "em-data-store-"
		1070 |   force_destroy = false
		1071 |   tags = {
		1072 |     "application"            = "electronic-monitoring-data"
		1073 |     "business-unit"          = "HMPPS"
		1074 |     "environment-name"       = "electronic-monitoring-data-production"
		1075 |     "infrastructure-support" = "dataengineering@digital.justice.gov.uk"
		1076 |     "is-production"          = "true"
		1077 |     "owner"                  = "Data engineering: dataengineering@digital.justice.gov.uk"
		1078 |     "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
		1079 |   }
		1080 | }

Check: CKV2_AWS_60: "Ensure RDS instance with copy tags to snapshots is enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-60

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV2_AWS_62: "Ensure S3 buckets should have event notifications enabled"
	FAILED for resource: aws_s3_bucket.data_store
	File: /s3.tf:1061-1080
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-2-62

		1061 | resource "aws_s3_bucket" "data_store" {
		1062 |   #checkov:skip:CKV_AWS_145
		1063 |   #checkov:skip:CKV_AWS_144
		1064 |   #checkov:skip:CKV_AWS_21
		1065 |   #checkov:skip:CKV2_AWS_65
		1066 |   #checkov:skip:CKV2_AWS_62
		1067 |   #checkov:skip:CKV_AWS_18
		1068 |   #checkov:skip:CKV2_AWS_61
		1069 |   bucket_prefix = "em-data-store-"
		1070 |   force_destroy = false
		1071 |   tags = {
		1072 |     "application"            = "electronic-monitoring-data"
		1073 |     "business-unit"          = "HMPPS"
		1074 |     "environment-name"       = "electronic-monitoring-data-production"
		1075 |     "infrastructure-support" = "dataengineering@digital.justice.gov.uk"
		1076 |     "is-production"          = "true"
		1077 |     "owner"                  = "Data engineering: dataengineering@digital.justice.gov.uk"
		1078 |     "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
		1079 |   }
		1080 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.db_glue_connection
	File: /lambdas_secrets.tf:1-3
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		1 | resource "aws_secretsmanager_secret" "db_glue_connection" {
		2 |   name = "db_glue_connection"
		3 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.db_password
	File: /server_backups.tf:4-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		4 | resource "aws_secretsmanager_secret" "db_password" {
		5 |   name = "db_password"
		6 | }

Check: CKV_AWS_21: "Ensure all data stored in the S3 bucket have versioning enabled"
	FAILED for resource: aws_s3_bucket.data_store
	File: /s3.tf:1061-1080
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-16-enable-versioning

		1061 | resource "aws_s3_bucket" "data_store" {
		1062 |   #checkov:skip:CKV_AWS_145
		1063 |   #checkov:skip:CKV_AWS_144
		1064 |   #checkov:skip:CKV_AWS_21
		1065 |   #checkov:skip:CKV2_AWS_65
		1066 |   #checkov:skip:CKV2_AWS_62
		1067 |   #checkov:skip:CKV_AWS_18
		1068 |   #checkov:skip:CKV2_AWS_61
		1069 |   bucket_prefix = "em-data-store-"
		1070 |   force_destroy = false
		1071 |   tags = {
		1072 |     "application"            = "electronic-monitoring-data"
		1073 |     "business-unit"          = "HMPPS"
		1074 |     "environment-name"       = "electronic-monitoring-data-production"
		1075 |     "infrastructure-support" = "dataengineering@digital.justice.gov.uk"
		1076 |     "is-production"          = "true"
		1077 |     "owner"                  = "Data engineering: dataengineering@digital.justice.gov.uk"
		1078 |     "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
		1079 |   }
		1080 | }

dockerfile scan results:

Passed checks: 21, Failed checks: 2, Skipped checks: 0

Check: CKV_DOCKER_2: "Ensure that HEALTHCHECK instructions have been added to container images"
	FAILED for resource: /lambdas/update_log_table/Dockerfile.
	File: /lambdas/update_log_table/Dockerfile:1-9
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/docker-policies/docker-policy-index/ensure-that-healthcheck-instructions-have-been-added-to-container-images

		1 | FROM public.ecr.aws/lambda/python:3.11
		2 | 
		3 | COPY requirements.txt .
		4 | 
		5 | RUN pip install -r requirements.txt --target "${LAMBDA_TASK_ROOT}"
		6 | 
		7 | COPY update_log_table.py ${LAMBDA_TASK_ROOT}
		8 | 
		9 | CMD ["update_log_table.handler"]

Check: CKV_DOCKER_3: "Ensure that a user for the container has been created"
	FAILED for resource: /lambdas/update_log_table/Dockerfile.
	File: /lambdas/update_log_table/Dockerfile:1-9
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/docker-policies/docker-policy-index/ensure-that-a-user-for-the-container-has-been-created

		1 | FROM public.ecr.aws/lambda/python:3.11
		2 | 
		3 | COPY requirements.txt .
		4 | 
		5 | RUN pip install -r requirements.txt --target "${LAMBDA_TASK_ROOT}"
		6 | 
		7 | COPY update_log_table.py ${LAMBDA_TASK_ROOT}
		8 | 
		9 | CMD ["update_log_table.handler"]


checkov_exitcode=1

CTFLint Scan Failed

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
terraform/environments/electronic-monitoring-data

*****************************

Running tflint in terraform/environments/electronic-monitoring-data
Excluding the following checks: terraform_unused_declarations
11 issue(s) found:

Warning: Missing version constraint for provider "archive" in `required_providers` (terraform_required_providers)

  on terraform/environments/electronic-monitoring-data/data_store.tf line 151:
 151: data "archive_file" "summarise_zip_lambda" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

Warning: `s3_pylib_dir_path` variable has no type (terraform_typed_variables)

  on terraform/environments/electronic-monitoring-data/glue_variables.tf line 1:
   1: variable "s3_pylib_dir_path" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_typed_variables.md

Warning: Missing version constraint for provider "random" in `required_providers` (terraform_required_providers)

  on terraform/environments/electronic-monitoring-data/server_backups.tf line 13:
  13: resource "random_password" "random_password" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 11:
  11:           "Resource" : "${module.get_metadata_from_rds_lambda.lambda_function_arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 24:
  24:                 "Resource" : "${module.create_athena_table.lambda_function_arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 98:
  98:             "WorkGroup" : "${aws_athena_workgroup.default.name}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 114:
 114:           "Resource" : "${module.query_output_to_list.lambda_function_arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 127:
 127:                 "Resource" : "${module.get_file_keys_for_table.lambda_function_arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 141:
 141:                       "Resource" : "${module.send_table_to_ap.lambda_function_arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 152:
 152:                 "Resource" : "${module.update_log_table.lambda_function_arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 164:
 164:             "WorkGroup" : "${aws_athena_workgroup.default.name}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

tflint_exitcode=2

Trivy Scan Failed

Show Output

*****************************

Trivy will check the following folders:
terraform/environments/electronic-monitoring-data

*****************************

Running Trivy in terraform/environments/electronic-monitoring-data
2024-10-14T17:38:54Z	INFO	[vulndb] Need to update DB
2024-10-14T17:38:54Z	INFO	[vulndb] Downloading vulnerability DB...
2024-10-14T17:38:54Z	INFO	[vulndb] Downloading artifact...	repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-14T17:38:56Z	INFO	[vulndb] Artifact successfully downloaded	repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-14T17:38:56Z	INFO	[vuln] Vulnerability scanning is enabled
2024-10-14T17:38:56Z	INFO	[misconfig] Misconfiguration scanning is enabled
2024-10-14T17:38:56Z	INFO	[misconfig] Need to update the built-in checks
2024-10-14T17:38:56Z	INFO	[misconfig] Downloading the built-in checks...
156.02 KiB / 156.02 KiB [---------------------------------------------------------] 100.00% ? p/s 0s2024-10-14T17:38:57Z	INFO	[secret] Secret scanning is enabled
2024-10-14T17:38:57Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-14T17:38:57Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-10-14T17:38:57Z	WARN	[pip] Unable to find python `site-packages` directory. License detection is skipped.	err="site-packages directory not found"
2024-10-14T17:38:59Z	INFO	[terraform scanner] Scanning root module	file_path="."
2024-10-14T17:38:59Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="networking"
2024-10-14T17:39:00Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T17:39:00Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T17:39:00Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T17:39:00Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T17:39:00Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T17:39:00Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T17:39:00Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T17:39:00Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T17:39:00Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T17:39:00Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T17:39:00Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.aws_s3_object.user_public_keys" value="cty.NilVal"
2024-10-14T17:39:00Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.data.aws_subnet.local_account" value="cty.NilVal"
2024-10-14T17:39:00Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-14T17:39:00Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T17:39:03Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T17:39:08Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T17:39:08Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T17:39:08Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T17:39:08Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T17:39:08Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T17:39:08Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T17:39:08Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T17:39:08Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T17:39:08Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T17:39:08Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T17:39:08Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T17:39:08Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=95ed3c3/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=568694e50e03630d99cb569eafa06a0b879a1239/main.tf:171-179"
2024-10-14T17:39:08Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="s3.tf:1061-1080"
2024-10-14T17:39:08Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-14T17:39:08Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-14T17:39:08Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-bucket-encryption" range="s3.tf:1061-1080"
2024-10-14T17:39:08Z	INFO	[terraform executor] Ignore finding	rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:281-286"
2024-10-14T17:39:08Z	INFO	[terraform executor] Ignore finding	rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:407-411"
2024-10-14T17:39:08Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-logging" range="s3.tf:1061-1080"
2024-10-14T17:39:08Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-versioning" range="s3.tf:1061-1080"
2024-10-14T17:39:08Z	INFO	Number of language-specific files	num=1
2024-10-14T17:39:08Z	INFO	[pip] Detecting vulnerabilities...
2024-10-14T17:39:08Z	INFO	Detected config files	num=17

data_store.tf (terraform)
=========================
Tests: 1 (SUCCESSES: 0, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Topic does not have encryption enabled.
════════════════════════════════════════
Topics should be encrypted to protect their contents.


See https://avd.aquasec.com/misconfig/avd-aws-0095
────────────────────────────────────────
 data_store.tf:17-19
────────────────────────────────────────
  17 ┌ resource "aws_sns_topic" "s3_events" {
  18 │   name = "${module.s3-data-bucket.bucket.id}-object-created-topic"
  19 └ }
────────────────────────────────────────



lambdas/update_log_table/Dockerfile (dockerfile)
================================================
Tests: 20 (SUCCESSES: 19, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Specify at least 1 USER command in Dockerfile with non-root user as argument
════════════════════════════════════════
Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

See https://avd.aquasec.com/misconfig/ds002
────────────────────────────────────────


trivy_exitcode=1

[github-actions]

Trivy Scan Failed

Show Output

```hcl

---

Trivy will check the following folders:
terraform/environments/electronic-monitoring-data

---

Running Trivy in terraform/environments/electronic-monitoring-data
2024-10-14T18:23:13Z INFO [vulndb] Need to update DB
2024-10-14T18:23:13Z INFO [vulndb] Downloading vulnerability DB...
2024-10-14T18:23:13Z INFO [vulndb] Downloading artifact... repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-14T18:23:15Z INFO [vulndb] Artifact successfully downloaded repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-14T18:23:15Z INFO [vuln] Vulnerability scanning is enabled
2024-10-14T18:23:15Z INFO [misconfig] Misconfiguration scanning is enabled
2024-10-14T18:23:15Z INFO [misconfig] Need to update the built-in checks
2024-10-14T18:23:15Z INFO [misconfig] Downloading the built-in checks...
156.02 KiB / 156.02 KiB [---------------------------------------------------------] 100.00% ? p/s 0s2024-10-14T18:23:16Z INFO [secret] Secret scanning is enabled
2024-10-14T18:23:16Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-14T18:23:16Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-10-14T18:23:16Z WARN [pip] Unable to find python site-packages directory. License detection is skipped. err="site-packages directory not found"
2024-10-14T18:23:17Z INFO [terraform scanner] Scanning root module file_path="."
2024-10-14T18:23:17Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="networking"
2024-10-14T18:23:18Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:23:18Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:23:18Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:23:18Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:23:18Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:23:18Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.aws_s3_object.user_public_keys" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.data.aws_subnet.local_account" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:23:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:23:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:23:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:23:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:23:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:23:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:21Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:26Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-14T18:23:26Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-14T18:23:26Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T18:23:26Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T18:23:26Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T18:23:26Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T18:23:26Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T18:23:26Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T18:23:26Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T18:23:26Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T18:23:26Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T18:23:26Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T18:23:26Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T18:23:26Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=95ed3c3/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=568694e50e03630d99cb569eafa06a0b879a1239/main.tf:171-179"
2024-10-14T18:23:26Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="s3.tf:1061-1080"
2024-10-14T18:23:26Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-versioning" range="s3.tf:1061-1080"
2024-10-14T18:23:26Z INFO [terraform executor] Ignore finding rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:281-286"
2024-10-14T18:23:26Z INFO [terraform executor] Ignore finding rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:407-411"
2024-10-14T18:23:26Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-bucket-encryption" range="s3.tf:1061-1080"
2024-10-14T18:23:26Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-logging" range="s3.tf:1061-1080"
2024-10-14T18:23:27Z INFO Number of language-specific files num=1
2024-10-14T18:23:27Z INFO [pip] Detecting vulnerabilities...
2024-10-14T18:23:27Z INFO Detected config files num=17

data_store.tf (terraform)

Tests: 1 (SUCCESSES: 0, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Topic does not have encryption enabled.
════════════════════════════════════════
Topics should be encrypted to protect their contents.

See https://avd.aquasec.com/misconfig/avd-aws-0095
────────────────────────────────────────
data_store.tf:17-19
────────────────────────────────────────
17 ┌ resource "aws_sns_topic" "s3_events" {
18 │ name = "${module.s3-data-bucket.bucket.id}-object-created-topic"
19 └ }
────────────────────────────────────────

lambdas/update_log_table/Dockerfile (dockerfile)

Tests: 20 (SUCCESSES: 19, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Specify at least 1 USER command in Dockerfile with non-root user as argument
════════════════════════════════════════
Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

See https://avd.aquasec.com/misconfig/ds002
────────────────────────────────────────

trivy_exitcode=1

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/electronic-monitoring-data

*****************************

Running Checkov in terraform/environments/electronic-monitoring-data
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2024-10-14 18:23:30,207 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060:None (for external modules, the --download-external-modules flag is required)
2024-10-14 18:23:30,209 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=95ed3c3:None (for external modules, the --download-external-modules flag is required)
2024-10-14 18:23:30,212 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/secrets-manager/aws:1.3.0 (for external modules, the --download-external-modules flag is required)
2024-10-14 18:23:30,213 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=52a40b0:None (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 2286, Failed checks: 75, Skipped checks: 27

Check: CKV_AWS_26: "Ensure all data stored in the SNS topic is encrypted"
	FAILED for resource: aws_sns_topic.s3_events
	File: /data_store.tf:17-19
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-15

		17 | resource "aws_sns_topic" "s3_events" {
		18 |   name = "${module.s3-data-bucket.bucket.id}-object-created-topic"
		19 | }

Check: CKV_AWS_115: "Ensure that AWS Lambda function is configured for function-level concurrent execution limit"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-function-level-concurrent-execution-limit

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_272: "Ensure AWS Lambda function is configured to validate code-signing"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-272

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_173: "Check encryption settings for Lambda environmental variable"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-5

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_117: "Ensure that AWS Lambda function is configured inside a VPC"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-inside-a-vpc-1

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_116: "Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-a-dead-letter-queue-dlq

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_115: "Ensure that AWS Lambda function is configured for function-level concurrent execution limit"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-function-level-concurrent-execution-limit

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_272: "Ensure AWS Lambda function is configured to validate code-signing"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-272

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_117: "Ensure that AWS Lambda function is configured inside a VPC"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-inside-a-vpc-1

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_116: "Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-a-dead-letter-queue-dlq

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group
	File: /dms_data_validation_glue_job.tf:65-68
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		65 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group" {
		66 |   name              = "dms-dv-glue-job"
		67 |   retention_in_days = 14
		68 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group
	File: /dms_data_validation_glue_job.tf:65-68
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		65 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group" {
		66 |   name              = "dms-dv-glue-job"
		67 |   retention_in_days = 14
		68 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group_v2
	File: /dms_data_validation_glue_job.tf:70-73
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		70 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group_v2" {
		71 |   name              = "dms-dv-glue-job-v2"
		72 |   retention_in_days = 14
		73 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group_v2
	File: /dms_data_validation_glue_job.tf:70-73
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		70 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group_v2" {
		71 |   name              = "dms-dv-glue-job-v2"
		72 |   retention_in_days = 14
		73 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.rds_to_s3_parquet_migration
	File: /dms_data_validation_glue_job.tf:75-78
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		75 | resource "aws_cloudwatch_log_group" "rds_to_s3_parquet_migration" {
		76 |   name              = "rds-to-s3-parquet-migration"
		77 |   retention_in_days = 14
		78 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.rds_to_s3_parquet_migration
	File: /dms_data_validation_glue_job.tf:75-78
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		75 | resource "aws_cloudwatch_log_group" "rds_to_s3_parquet_migration" {
		76 |   name              = "rds-to-s3-parquet-migration"
		77 |   retention_in_days = 14
		78 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.resizing_parquet_files
	File: /dms_data_validation_glue_job.tf:80-83
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		80 | resource "aws_cloudwatch_log_group" "resizing_parquet_files" {
		81 |   name              = "resizing-parquet-files"
		82 |   retention_in_days = 14
		83 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.resizing_parquet_files
	File: /dms_data_validation_glue_job.tf:80-83
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		80 | resource "aws_cloudwatch_log_group" "resizing_parquet_files" {
		81 |   name              = "resizing-parquet-files"
		82 |   retention_in_days = 14
		83 | }

Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.dms_dv_glue_job_v2
	File: /dms_data_validation_glue_job.tf:86-140
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.dms_dv_glue_job_v4d
	File: /dms_data_validation_glue_job.tf:148-201
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.rds_to_s3_parquet_migration
	File: /dms_data_validation_glue_job.tf:204-268
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.rds_to_s3_parquet_migration_monthly
	File: /dms_data_validation_glue_job.tf:272-326
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.resizing_parquet_files
	File: /dms_data_validation_glue_job.tf:329-381
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.catalog_dv_table_glue_job
	File: /dms_data_validation_glue_job.tf:384-412
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		384 | resource "aws_glue_job" "catalog_dv_table_glue_job" {
		385 |   name              = "catalog-dv-table-glue-job"
		386 |   description       = "Python script uses Boto3-Athena-Client to run sql-statements"
		387 |   role_arn          = aws_iam_role.dms_dv_glue_job_iam_role.arn
		388 |   glue_version      = "4.0"
		389 |   worker_type       = "G.1X"
		390 |   number_of_workers = 2
		391 |   default_arguments = {
		392 |     "--parquet_output_bucket_name"       = module.s3-dms-data-validation-bucket.bucket.id
		393 |     "--glue_catalog_db_name"             = aws_glue_catalog_database.dms_dv_glue_catalog_db.name
		394 |     "--glue_catalog_tbl_name"            = "glue_df_output"
		395 |     "--continuous-log-logGroup"          = aws_cloudwatch_log_group.dms_dv_cw_log_group.name
		396 |     "--enable-continuous-cloudwatch-log" = "true"
		397 |     "--enable-continuous-log-filter"     = "true"
		398 |     "--enable-metrics"                   = ""
		399 |   }
		400 |   command {
		401 |     python_version  = "3"
		402 |     script_location = "s3://${module.s3-glue-job-script-bucket.bucket.id}/create_or_replace_dv_table.py"
		403 |   }
		404 | 
		405 |   tags = merge(
		406 |     local.tags,
		407 |     {
		408 |       Resource_Type = "Py script as glue-job that creates dv table / refreshes its partitions",
		409 |     }
		410 |   )
		411 | 
		412 | }

Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_crawler.rds_sqlserver_db_glue_crawler
	File: /dms_glue_crawler.tf:35-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		35 | resource "aws_glue_crawler" "rds_sqlserver_db_glue_crawler" {
		36 |   name          = "rds-sqlserver-${aws_db_instance.database_2022.identifier}-tf"
		37 |   role          = aws_iam_role.dms_dv_glue_job_iam_role.arn
		38 |   database_name = aws_glue_catalog_database.rds_sqlserver_glue_catalog_db.name
		39 |   description   = "Crawler to fetch database names"
		40 |   #   table_prefix  = "your_table_prefix"
		41 | 
		42 |   jdbc_target {
		43 |     connection_name = aws_glue_connection.glue_rds_sqlserver_db_connection.name
		44 |     path            = "%"
		45 |   }
		46 |   tags = merge(
		47 |     local.tags,
		48 |     {
		49 |       Resource_Type = "RDS-SQLServer Glue-Crawler for DMS",
		50 |     }
		51 |   )
		52 | 
		53 |   # provisioner "local-exec" {
		54 |   #   command = "aws glue start-crawler --name ${self.name}"
		55 |   # }
		56 | }

Check: CKV_AWS_212: "Ensure DMS replication instance is encrypted by KMS using a customer managed Key (CMK)"
	FAILED for resource: aws_dms_replication_instance.dms_replication_instance
	File: /dms_replication_instance.tf:24-55
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-ebs-volume-is-encrypted-by-key-management-service-kms-using-a-customer-managed-key-cmk

		24 | resource "aws_dms_replication_instance" "dms_replication_instance" {
		25 |   allocated_storage          = var.dms_allocated_storage_gib
		26 |   apply_immediately          = true
		27 |   auto_minor_version_upgrade = true
		28 |   availability_zone          = var.dms_availability_zone
		29 |   engine_version             = var.dms_engine_version
		30 |   #   kms_key_arn                  = "arn:aws:kms:eu-west-2:800964199911:key/b7f54acb-16a3-4958-9340-3bdf5f5842d8"
		31 |   multi_az = false
		32 |   #   preferred_maintenance_window = "sun:10:30-sun:14:30"
		33 |   publicly_accessible         = false
		34 |   replication_instance_class  = var.dms_replication_instance_class
		35 |   replication_instance_id     = "dms-replication-instance-tf"
		36 |   replication_subnet_group_id = aws_dms_replication_subnet_group.dms_replication_subnet_group.id
		37 | 
		38 |   tags = merge(
		39 |     local.tags,
		40 |     {
		41 |       Resource_Type = "DMS Replication Instance",
		42 |     }
		43 |   )
		44 | 
		45 |   vpc_security_group_ids = [
		46 |     aws_security_group.dms_ri_security_group.id,
		47 |   ]
		48 | 
		49 |   depends_on = [
		50 |     aws_iam_role.dms_vpc_role,
		51 |     aws_iam_role.dms_cloudwatch_logs_role,
		52 |     aws_iam_role.dms_endpoint_role
		53 |   ]
		54 | 
		55 | }

Check: CKV_AWS_25: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389"
	FAILED for resource: aws_vpc_security_group_ingress_rule.glue_rds_conn_inbound
	File: /dms_security_groups.tf:69-77
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-2

		69 | resource "aws_vpc_security_group_ingress_rule" "glue_rds_conn_inbound" {
		70 |   security_group_id = aws_security_group.glue_rds_conn_security_group.id
		71 | 
		72 |   referenced_security_group_id = aws_security_group.glue_rds_conn_security_group.id
		73 |   ip_protocol                  = "tcp"
		74 |   from_port                    = 0
		75 |   to_port                      = 65535
		76 |   description                  = "Required ports open for Glue-RDS-Connection"
		77 | }

Check: CKV_AWS_24: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 22"
	FAILED for resource: aws_vpc_security_group_ingress_rule.glue_rds_conn_inbound
	File: /dms_security_groups.tf:69-77
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-1-port-security

		69 | resource "aws_vpc_security_group_ingress_rule" "glue_rds_conn_inbound" {
		70 |   security_group_id = aws_security_group.glue_rds_conn_security_group.id
		71 | 
		72 |   referenced_security_group_id = aws_security_group.glue_rds_conn_security_group.id
		73 |   ip_protocol                  = "tcp"
		74 |   from_port                    = 0
		75 |   to_port                      = 65535
		76 |   description                  = "Required ports open for Glue-RDS-Connection"
		77 | }

Check: CKV_AWS_260: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 80"
	FAILED for resource: aws_vpc_security_group_ingress_rule.glue_rds_conn_inbound
	File: /dms_security_groups.tf:69-77
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-aws-security-groups-do-not-allow-ingress-from-00000-to-port-80

		69 | resource "aws_vpc_security_group_ingress_rule" "glue_rds_conn_inbound" {
		70 |   security_group_id = aws_security_group.glue_rds_conn_security_group.id
		71 | 
		72 |   referenced_security_group_id = aws_security_group.glue_rds_conn_security_group.id
		73 |   ip_protocol                  = "tcp"
		74 |   from_port                    = 0
		75 |   to_port                      = 65535
		76 |   description                  = "Required ports open for Glue-RDS-Connection"
		77 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.glue_notebook_ec2_iam_policy_document
	File: /glue_data.tf:103-118
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		103 | data "aws_iam_policy_document" "glue_notebook_ec2_iam_policy_document" {
		104 |   statement {
		105 |     effect = "Allow"
		106 |     actions = [
		107 |       "ec2:CreateNetworkInterface",
		108 |       "ec2:DescribeNetworkInterfaces",
		109 |       "ec2:DeleteNetworkInterface",
		110 |       "ec2:DescribeVpcEndpoints",
		111 |       "ec2:DescribeSubnets",
		112 |       "ec2:DescribeVpcAttribute",
		113 |       "ec2:DescribeRouteTables",
		114 |       "ec2:DescribeSecurityGroups"
		115 |     ]
		116 |     resources = ["*"]
		117 |   }
		118 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.glue_notebook_ec2_iam_policy_document
	File: /glue_data.tf:103-118
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		103 | data "aws_iam_policy_document" "glue_notebook_ec2_iam_policy_document" {
		104 |   statement {
		105 |     effect = "Allow"
		106 |     actions = [
		107 |       "ec2:CreateNetworkInterface",
		108 |       "ec2:DescribeNetworkInterfaces",
		109 |       "ec2:DeleteNetworkInterface",
		110 |       "ec2:DescribeVpcEndpoints",
		111 |       "ec2:DescribeSubnets",
		112 |       "ec2:DescribeVpcAttribute",
		113 |       "ec2:DescribeRouteTables",
		114 |       "ec2:DescribeSecurityGroups"
		115 |     ]
		116 |     resources = ["*"]
		117 |   }
		118 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.load_json_table_s3_policy_document
	File: /lambdas_iam.tf:430-487
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.load_json_table_s3_policy_document
	File: /lambdas_iam.tf:430-487
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.db_glue_connection
	File: /lambdas_secrets.tf:1-3
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		1 | resource "aws_secretsmanager_secret" "db_glue_connection" {
		2 |   name = "db_glue_connection"
		3 | }

Check: CKV_AWS_296: "Ensure DMS endpoint uses Customer Managed Key (CMK)"
	FAILED for resource: module.dms_task.aws_dms_endpoint.dms_rds_source
	File: /modules/dms/endpoints_rds_s3.tf:2-23
	Calling File: /dms_main.tf:1-39
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-296

		2  | resource "aws_dms_endpoint" "dms_rds_source" {
		3  | 
		4  |   #   certificate_arn             = ""
		5  |   database_name = var.database_name
		6  |   endpoint_id   = "rds-mssql-${replace(var.database_name, "_", "-")}-tf"
		7  |   endpoint_type = "source"
		8  |   engine_name   = "sqlserver"
		9  |   #   extra_connection_attributes = ""
		10 |   #   kms_key_arn                 = aws_db_instance.database_2022.kms_key_id
		11 |   password    = var.rds_db_instance_pasword
		12 |   port        = var.rds_db_instance_port
		13 |   server_name = var.rds_db_server_name
		14 |   ssl_mode    = "require"
		15 |   username    = var.rds_db_username
		16 | 
		17 |   tags = merge(
		18 |     var.local_tags,
		19 |     {
		20 |       Resource_Type = "DMS Source Endpoint - RDS MSSQL",
		21 |     },
		22 |   )
		23 | }

Check: CKV_AWS_298: "Ensure DMS S3 uses Customer Managed Key (CMK)"
	FAILED for resource: module.dms_task.aws_dms_s3_endpoint.dms_s3_parquet_target
	File: /modules/dms/endpoints_rds_s3.tf:28-84
	Calling File: /dms_main.tf:1-39
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-298

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: module.get_zipped_file.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:3-7
	Calling File: /step_functions_main.tf:233-243
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		3 | resource "aws_sfn_state_machine" "this" {
		4 |   name       = var.name
		5 |   role_arn   = aws_iam_role.step_function_role.arn
		6 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		7 | }

Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: module.get_zipped_file.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:3-7
	Calling File: /step_functions_main.tf:233-243
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		3 | resource "aws_sfn_state_machine" "this" {
		4 |   name       = var.name
		5 |   role_arn   = aws_iam_role.step_function_role.arn
		6 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		7 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:38-47
	Calling File: /step_functions_main.tf:233-243
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		38 | data "aws_iam_policy_document" "step_function_base_permissions" {
		39 |   statement {
		40 |     effect = "Allow"
		41 |     actions = [
		42 |       "sns:Publish",
		43 |       "sqs:SendMessage"
		44 |     ]
		45 |     resources = ["*"]
		46 |   }
		47 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:38-47
	Calling File: /step_functions_main.tf:233-243
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		38 | data "aws_iam_policy_document" "step_function_base_permissions" {
		39 |   statement {
		40 |     effect = "Allow"
		41 |     actions = [
		42 |       "sns:Publish",
		43 |       "sqs:SendMessage"
		44 |     ]
		45 |     resources = ["*"]
		46 |   }
		47 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:54-82
	Calling File: /step_functions_main.tf:233-243
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		54 | data "aws_iam_policy_document" "this_log_key_document" {
		55 |   statement {
		56 |     sid    = "EnableIAMUserPermissions"
		57 |     effect = "Allow"
		58 |     principals {
		59 |       type        = "AWS"
		60 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		61 |     }
		62 |     actions   = ["kms:*"]
		63 |     resources = ["*"]
		64 |   }
		65 | 
		66 |   statement {
		67 |     sid    = "EnableLogServicePermissions"
		68 |     effect = "Allow"
		69 |     principals {
		70 |       type        = "Service"
		71 |       identifiers = ["logs.eu-west-2.amazonaws.com"]
		72 |     }
		73 |     actions = [
		74 |       "kms:Encrypt*",
		75 |       "kms:Decrypt*",
		76 |       "kms:ReEncrypt*",
		77 |       "kms:GenerateDataKey*",
		78 |       "kms:Describe*",
		79 |     ]
		80 |     resources = ["*"]
		81 |   }
		82 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:54-82
	Calling File: /step_functions_main.tf:233-243
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		54 | data "aws_iam_policy_document" "this_log_key_document" {
		55 |   statement {
		56 |     sid    = "EnableIAMUserPermissions"
		57 |     effect = "Allow"
		58 |     principals {
		59 |       type        = "AWS"
		60 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		61 |     }
		62 |     actions   = ["kms:*"]
		63 |     resources = ["*"]
		64 |   }
		65 | 
		66 |   statement {
		67 |     sid    = "EnableLogServicePermissions"
		68 |     effect = "Allow"
		69 |     principals {
		70 |       type        = "Service"
		71 |       identifiers = ["logs.eu-west-2.amazonaws.com"]
		72 |     }
		73 |     actions = [
		74 |       "kms:Encrypt*",
		75 |       "kms:Decrypt*",
		76 |       "kms:ReEncrypt*",
		77 |       "kms:GenerateDataKey*",
		78 |       "kms:Describe*",
		79 |     ]
		80 |     resources = ["*"]
		81 |   }
		82 | }

Check: CKV_AWS_109: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:54-82
	Calling File: /step_functions_main.tf:233-243
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-permissions-management-resource-exposure-without-constraint

		54 | data "aws_iam_policy_document" "this_log_key_document" {
		55 |   statement {
		56 |     sid    = "EnableIAMUserPermissions"
		57 |     effect = "Allow"
		58 |     principals {
		59 |       type        = "AWS"
		60 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		61 |     }
		62 |     actions   = ["kms:*"]
		63 |     resources = ["*"]
		64 |   }
		65 | 
		66 |   statement {
		67 |     sid    = "EnableLogServicePermissions"
		68 |     effect = "Allow"
		69 |     principals {
		70 |       type        = "Service"
		71 |       identifiers = ["logs.eu-west-2.amazonaws.com"]
		72 |     }
		73 |     actions = [
		74 |       "kms:Encrypt*",
		75 |       "kms:Decrypt*",
		76 |       "kms:ReEncrypt*",
		77 |       "kms:GenerateDataKey*",
		78 |       "kms:Describe*",
		79 |     ]
		80 |     resources = ["*"]
		81 |   }
		82 | }

Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.db_password
	File: /server_backups.tf:4-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		4 | resource "aws_secretsmanager_secret" "db_password" {
		5 |   name = "db_password"
		6 | }

Check: CKV_AWS_157: "Ensure that RDS instances have Multi-AZ enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-73

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_118: "Ensure that enhanced monitoring is enabled for Amazon RDS instances"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/ensure-that-enhanced-monitoring-is-enabled-for-amazon-rds-instances

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_129: "Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-that-respective-logs-of-amazon-relational-database-service-amazon-rds-are-enabled

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_354: "Ensure RDS Performance Insights are encrypted using KMS CMKs"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-354

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_353: "Ensure that RDS instances have performance insights enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-353

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_293: "Ensure that AWS database instances have deletion protection enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-293

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_25: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389"
	FAILED for resource: aws_vpc_security_group_ingress_rule.db_glue_access
	File: /server_backups.tf:123-131
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-2

		123 | resource "aws_vpc_security_group_ingress_rule" "db_glue_access" {
		124 | 
		125 |   security_group_id            = aws_security_group.db.id
		126 |   description                  = "glue"
		127 |   ip_protocol                  = "tcp"
		128 |   from_port                    = 0
		129 |   to_port                      = 65535
		130 |   referenced_security_group_id = aws_security_group.db.id
		131 | }

Check: CKV_AWS_24: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 22"
	FAILED for resource: aws_vpc_security_group_ingress_rule.db_glue_access
	File: /server_backups.tf:123-131
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-1-port-security

		123 | resource "aws_vpc_security_group_ingress_rule" "db_glue_access" {
		124 | 
		125 |   security_group_id            = aws_security_group.db.id
		126 |   description                  = "glue"
		127 |   ip_protocol                  = "tcp"
		128 |   from_port                    = 0
		129 |   to_port                      = 65535
		130 |   referenced_security_group_id = aws_security_group.db.id
		131 | }

Check: CKV_AWS_260: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 80"
	FAILED for resource: aws_vpc_security_group_ingress_rule.db_glue_access
	File: /server_backups.tf:123-131
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-aws-security-groups-do-not-allow-ingress-from-00000-to-port-80

		123 | resource "aws_vpc_security_group_ingress_rule" "db_glue_access" {
		124 | 
		125 |   security_group_id            = aws_security_group.db.id
		126 |   description                  = "glue"
		127 |   ip_protocol                  = "tcp"
		128 |   from_port                    = 0
		129 |   to_port                      = 65535
		130 |   referenced_security_group_id = aws_security_group.db.id
		131 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.send_database_to_ap_athena_queries
	File: /step_functions_iam.tf:151-196
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		151 | data "aws_iam_policy_document" "send_database_to_ap_athena_queries" {
		152 |   statement {
		153 |     effect = "Allow"
		154 | 
		155 |     actions = [
		156 |       "athena:startQueryExecution",
		157 |       "athena:getQueryExecution",
		158 |       "athena:getQueryResults"
		159 |     ]
		160 | 
		161 |     resources = [
		162 |       "*"
		163 |     ]
		164 |   }
		165 |   statement {
		166 |     effect = "Allow"
		167 | 
		168 |     actions = [
		169 |       "s3:PutObject",
		170 |       "s3:GetObject",
		171 |       "s3:ListBucket",
		172 |       "s3:GetBucketLocation"
		173 |     ]
		174 | 
		175 |     resources = [
		176 |       module.s3-athena-bucket.bucket.arn,
		177 |       "${module.s3-athena-bucket.bucket.arn}/*",
		178 |       "${module.s3-dms-data-validation-bucket.bucket.arn}/*",
		179 |       module.s3-dms-data-validation-bucket.bucket.arn
		180 |     ]
		181 |   }
		182 |   statement {
		183 |     effect = "Allow"
		184 | 
		185 |     actions = [
		186 |       "glue:GetDatabase",
		187 |       "glue:GetTable",
		188 |       "glue:GetPartitions",
		189 |       "glue:GetTables"
		190 |     ]
		191 | 
		192 |     resources = [
		193 |       "*"
		194 |     ]
		195 |   }
		196 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.send_database_to_ap_athena_queries
	File: /step_functions_iam.tf:151-196
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		151 | data "aws_iam_policy_document" "send_database_to_ap_athena_queries" {
		152 |   statement {
		153 |     effect = "Allow"
		154 | 
		155 |     actions = [
		156 |       "athena:startQueryExecution",
		157 |       "athena:getQueryExecution",
		158 |       "athena:getQueryResults"
		159 |     ]
		160 | 
		161 |     resources = [
		162 |       "*"
		163 |     ]
		164 |   }
		165 |   statement {
		166 |     effect = "Allow"
		167 | 
		168 |     actions = [
		169 |       "s3:PutObject",
		170 |       "s3:GetObject",
		171 |       "s3:ListBucket",
		172 |       "s3:GetBucketLocation"
		173 |     ]
		174 | 
		175 |     resources = [
		176 |       module.s3-athena-bucket.bucket.arn,
		177 |       "${module.s3-athena-bucket.bucket.arn}/*",
		178 |       "${module.s3-dms-data-validation-bucket.bucket.arn}/*",
		179 |       module.s3-dms-data-validation-bucket.bucket.arn
		180 |     ]
		181 |   }
		182 |   statement {
		183 |     effect = "Allow"
		184 | 
		185 |     actions = [
		186 |       "glue:GetDatabase",
		187 |       "glue:GetTable",
		188 |       "glue:GetPartitions",
		189 |       "glue:GetTables"
		190 |     ]
		191 | 
		192 |     resources = [
		193 |       "*"
		194 |     ]
		195 |   }
		196 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: aws_sfn_state_machine.athena_layer
	File: /step_functions_main.tf:1-36
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		1  | resource "aws_sfn_state_machine" "athena_layer" {
		2  |   name     = "athena-layer"
		3  |   role_arn = aws_iam_role.step_functions_role.arn
		4  | 
		5  |   definition = jsonencode(
		6  |     {
		7  |       "StartAt" : "GetMetadataList",
		8  |       "States" : {
		9  |         "GetMetadataList" : {
		10 |           "Type" : "Task",
		11 |           "Resource" : "${module.get_metadata_from_rds_lambda.lambda_function_arn}",
		12 |           "ResultPath" : "$.metadata_list",
		13 |           "Next" : "LoopThroughMetadataList"
		14 |         },
		15 |         "LoopThroughMetadataList" : {
		16 |           "Type" : "Map",
		17 |           "ItemsPath" : "$.metadata_list.metadata_list",
		18 |           "MaxConcurrency" : 4,
		19 |           "Iterator" : {
		20 |             "StartAt" : "CreateAthenaTable",
		21 |             "States" : {
		22 |               "CreateAthenaTable" : {
		23 |                 "Type" : "Task",
		24 |                 "Resource" : "${module.create_athena_table.lambda_function_arn}",
		25 |                 "ResultPath" : "$.result",
		26 |                 "End" : true
		27 |               }
		28 |             }
		29 |           },
		30 |           "End" : true
		31 |         }
		32 |       }
		33 |     }
		34 |   )
		35 | 
		36 | }

Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: aws_sfn_state_machine.athena_layer
	File: /step_functions_main.tf:1-36
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		1  | resource "aws_sfn_state_machine" "athena_layer" {
		2  |   name     = "athena-layer"
		3  |   role_arn = aws_iam_role.step_functions_role.arn
		4  | 
		5  |   definition = jsonencode(
		6  |     {
		7  |       "StartAt" : "GetMetadataList",
		8  |       "States" : {
		9  |         "GetMetadataList" : {
		10 |           "Type" : "Task",
		11 |           "Resource" : "${module.get_metadata_from_rds_lambda.lambda_function_arn}",
		12 |           "ResultPath" : "$.metadata_list",
		13 |           "Next" : "LoopThroughMetadataList"
		14 |         },
		15 |         "LoopThroughMetadataList" : {
		16 |           "Type" : "Map",
		17 |           "ItemsPath" : "$.metadata_list.metadata_list",
		18 |           "MaxConcurrency" : 4,
		19 |           "Iterator" : {
		20 |             "StartAt" : "CreateAthenaTable",
		21 |             "States" : {
		22 |               "CreateAthenaTable" : {
		23 |                 "Type" : "Task",
		24 |                 "Resource" : "${module.create_athena_table.lambda_function_arn}",
		25 |                 "ResultPath" : "$.result",
		26 |                 "End" : true
		27 |               }
		28 |             }
		29 |           },
		30 |           "End" : true
		31 |         }
		32 |       }
		33 |     }
		34 |   )
		35 | 
		36 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: aws_sfn_state_machine.send_database_to_ap
	File: /step_functions_main.tf:85-171
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: aws_sfn_state_machine.send_database_to_ap
	File: /step_functions_main.tf:85-171
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_18: "Ensure the S3 bucket has access logging enabled"
	FAILED for resource: aws_s3_bucket.data_store
	File: /s3.tf:1061-1080
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-13-enable-logging

		1061 | resource "aws_s3_bucket" "data_store" {
		1062 |   #checkov:skip:CKV_AWS_145
		1063 |   #checkov:skip:CKV_AWS_144
		1064 |   #checkov:skip:CKV_AWS_21
		1065 |   #checkov:skip:CKV2_AWS_65
		1066 |   #checkov:skip:CKV2_AWS_62
		1067 |   #checkov:skip:CKV_AWS_18
		1068 |   #checkov:skip:CKV2_AWS_61
		1069 |   bucket_prefix = "em-data-store-"
		1070 |   force_destroy = false
		1071 |   tags = {
		1072 |     "application"            = "electronic-monitoring-data"
		1073 |     "business-unit"          = "HMPPS"
		1074 |     "environment-name"       = "electronic-monitoring-data-production"
		1075 |     "infrastructure-support" = "dataengineering@digital.justice.gov.uk"
		1076 |     "is-production"          = "true"
		1077 |     "owner"                  = "Data engineering: dataengineering@digital.justice.gov.uk"
		1078 |     "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
		1079 |   }
		1080 | }

Check: CKV2_AWS_61: "Ensure that an S3 bucket has a lifecycle configuration"
	FAILED for resource: aws_s3_bucket.data_store
	File: /s3.tf:1061-1080
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-2-61

		1061 | resource "aws_s3_bucket" "data_store" {
		1062 |   #checkov:skip:CKV_AWS_145
		1063 |   #checkov:skip:CKV_AWS_144
		1064 |   #checkov:skip:CKV_AWS_21
		1065 |   #checkov:skip:CKV2_AWS_65
		1066 |   #checkov:skip:CKV2_AWS_62
		1067 |   #checkov:skip:CKV_AWS_18
		1068 |   #checkov:skip:CKV2_AWS_61
		1069 |   bucket_prefix = "em-data-store-"
		1070 |   force_destroy = false
		1071 |   tags = {
		1072 |     "application"            = "electronic-monitoring-data"
		1073 |     "business-unit"          = "HMPPS"
		1074 |     "environment-name"       = "electronic-monitoring-data-production"
		1075 |     "infrastructure-support" = "dataengineering@digital.justice.gov.uk"
		1076 |     "is-production"          = "true"
		1077 |     "owner"                  = "Data engineering: dataengineering@digital.justice.gov.uk"
		1078 |     "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
		1079 |   }
		1080 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: aws_security_group.glue_rds_conn_security_group
	File: /dms_security_groups.tf:46-57
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		46 | resource "aws_security_group" "glue_rds_conn_security_group" {
		47 |   name        = "glue-rds-sqlserver-connection-tf"
		48 |   description = "Secuity Group for Glue-RDS-Connection"
		49 |   vpc_id      = data.aws_vpc.shared.id
		50 | 
		51 |   tags = merge(
		52 |     local.tags,
		53 |     {
		54 |       Resource_Type = "Secuity Group for Glue-RDS-Connection",
		55 |     }
		56 |   )
		57 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: module.buddi.module.landing_zone_security_groups.aws_security_group.this
	File: /modules/landing_zone/server_security_group/main.tf:7-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		7  | resource "aws_security_group" "this" {
		8  |   name        = "${var.supplier}-${var.user_name}-inbound-ips"
		9  |   description = "Allowed IP addresses for ${var.user_name} on ${var.supplier} server"
		10 |   vpc_id      = var.vpc_id
		11 | 
		12 |   lifecycle {
		13 |     create_before_destroy = true
		14 |   }
		15 | 
		16 |   tags = merge(
		17 |     var.local_tags,
		18 |     {
		19 |       supplier = var.user_name,
		20 |     },
		21 |   )
		22 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: module.capita.module.landing_zone_security_groups.aws_security_group.this
	File: /modules/landing_zone/server_security_group/main.tf:7-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		7  | resource "aws_security_group" "this" {
		8  |   name        = "${var.supplier}-${var.user_name}-inbound-ips"
		9  |   description = "Allowed IP addresses for ${var.user_name} on ${var.supplier} server"
		10 |   vpc_id      = var.vpc_id
		11 | 
		12 |   lifecycle {
		13 |     create_before_destroy = true
		14 |   }
		15 | 
		16 |   tags = merge(
		17 |     var.local_tags,
		18 |     {
		19 |       supplier = var.user_name,
		20 |     },
		21 |   )
		22 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: module.g4s.module.landing_zone_security_groups.aws_security_group.this
	File: /modules/landing_zone/server_security_group/main.tf:7-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		7  | resource "aws_security_group" "this" {
		8  |   name        = "${var.supplier}-${var.user_name}-inbound-ips"
		9  |   description = "Allowed IP addresses for ${var.user_name} on ${var.supplier} server"
		10 |   vpc_id      = var.vpc_id
		11 | 
		12 |   lifecycle {
		13 |     create_before_destroy = true
		14 |   }
		15 | 
		16 |   tags = merge(
		17 |     var.local_tags,
		18 |     {
		19 |       supplier = var.user_name,
		20 |     },
		21 |   )
		22 | }

Check: CKV_AWS_144: "Ensure that S3 bucket has cross-region replication enabled"
	FAILED for resource: aws_s3_bucket.data_store
	File: /s3.tf:1061-1080
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-s3-bucket-has-cross-region-replication-enabled

		1061 | resource "aws_s3_bucket" "data_store" {
		1062 |   #checkov:skip:CKV_AWS_145
		1063 |   #checkov:skip:CKV_AWS_144
		1064 |   #checkov:skip:CKV_AWS_21
		1065 |   #checkov:skip:CKV2_AWS_65
		1066 |   #checkov:skip:CKV2_AWS_62
		1067 |   #checkov:skip:CKV_AWS_18
		1068 |   #checkov:skip:CKV2_AWS_61
		1069 |   bucket_prefix = "em-data-store-"
		1070 |   force_destroy = false
		1071 |   tags = {
		1072 |     "application"            = "electronic-monitoring-data"
		1073 |     "business-unit"          = "HMPPS"
		1074 |     "environment-name"       = "electronic-monitoring-data-production"
		1075 |     "infrastructure-support" = "dataengineering@digital.justice.gov.uk"
		1076 |     "is-production"          = "true"
		1077 |     "owner"                  = "Data engineering: dataengineering@digital.justice.gov.uk"
		1078 |     "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
		1079 |   }
		1080 | }

Check: CKV2_AWS_65: "Ensure access control lists for S3 buckets are disabled"
	FAILED for resource: aws_s3_bucket_ownership_controls.bucket
	File: /s3.tf:1090-1095
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-general-112

		1090 | resource "aws_s3_bucket_ownership_controls" "bucket" {
		1091 |   bucket = aws_s3_bucket.data_store.id
		1092 |   rule {
		1093 |     object_ownership = "ObjectWriter"
		1094 |   }
		1095 | }

Check: CKV_AWS_145: "Ensure that S3 buckets are encrypted with KMS by default"
	FAILED for resource: aws_s3_bucket.data_store
	File: /s3.tf:1061-1080
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-s3-buckets-are-encrypted-with-kms-by-default

		1061 | resource "aws_s3_bucket" "data_store" {
		1062 |   #checkov:skip:CKV_AWS_145
		1063 |   #checkov:skip:CKV_AWS_144
		1064 |   #checkov:skip:CKV_AWS_21
		1065 |   #checkov:skip:CKV2_AWS_65
		1066 |   #checkov:skip:CKV2_AWS_62
		1067 |   #checkov:skip:CKV_AWS_18
		1068 |   #checkov:skip:CKV2_AWS_61
		1069 |   bucket_prefix = "em-data-store-"
		1070 |   force_destroy = false
		1071 |   tags = {
		1072 |     "application"            = "electronic-monitoring-data"
		1073 |     "business-unit"          = "HMPPS"
		1074 |     "environment-name"       = "electronic-monitoring-data-production"
		1075 |     "infrastructure-support" = "dataengineering@digital.justice.gov.uk"
		1076 |     "is-production"          = "true"
		1077 |     "owner"                  = "Data engineering: dataengineering@digital.justice.gov.uk"
		1078 |     "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
		1079 |   }
		1080 | }

Check: CKV2_AWS_60: "Ensure RDS instance with copy tags to snapshots is enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-60

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV2_AWS_62: "Ensure S3 buckets should have event notifications enabled"
	FAILED for resource: aws_s3_bucket.data_store
	File: /s3.tf:1061-1080
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-2-62

		1061 | resource "aws_s3_bucket" "data_store" {
		1062 |   #checkov:skip:CKV_AWS_145
		1063 |   #checkov:skip:CKV_AWS_144
		1064 |   #checkov:skip:CKV_AWS_21
		1065 |   #checkov:skip:CKV2_AWS_65
		1066 |   #checkov:skip:CKV2_AWS_62
		1067 |   #checkov:skip:CKV_AWS_18
		1068 |   #checkov:skip:CKV2_AWS_61
		1069 |   bucket_prefix = "em-data-store-"
		1070 |   force_destroy = false
		1071 |   tags = {
		1072 |     "application"            = "electronic-monitoring-data"
		1073 |     "business-unit"          = "HMPPS"
		1074 |     "environment-name"       = "electronic-monitoring-data-production"
		1075 |     "infrastructure-support" = "dataengineering@digital.justice.gov.uk"
		1076 |     "is-production"          = "true"
		1077 |     "owner"                  = "Data engineering: dataengineering@digital.justice.gov.uk"
		1078 |     "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
		1079 |   }
		1080 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.db_glue_connection
	File: /lambdas_secrets.tf:1-3
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		1 | resource "aws_secretsmanager_secret" "db_glue_connection" {
		2 |   name = "db_glue_connection"
		3 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.db_password
	File: /server_backups.tf:4-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		4 | resource "aws_secretsmanager_secret" "db_password" {
		5 |   name = "db_password"
		6 | }

Check: CKV_AWS_21: "Ensure all data stored in the S3 bucket have versioning enabled"
	FAILED for resource: aws_s3_bucket.data_store
	File: /s3.tf:1061-1080
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-16-enable-versioning

		1061 | resource "aws_s3_bucket" "data_store" {
		1062 |   #checkov:skip:CKV_AWS_145
		1063 |   #checkov:skip:CKV_AWS_144
		1064 |   #checkov:skip:CKV_AWS_21
		1065 |   #checkov:skip:CKV2_AWS_65
		1066 |   #checkov:skip:CKV2_AWS_62
		1067 |   #checkov:skip:CKV_AWS_18
		1068 |   #checkov:skip:CKV2_AWS_61
		1069 |   bucket_prefix = "em-data-store-"
		1070 |   force_destroy = false
		1071 |   tags = {
		1072 |     "application"            = "electronic-monitoring-data"
		1073 |     "business-unit"          = "HMPPS"
		1074 |     "environment-name"       = "electronic-monitoring-data-production"
		1075 |     "infrastructure-support" = "dataengineering@digital.justice.gov.uk"
		1076 |     "is-production"          = "true"
		1077 |     "owner"                  = "Data engineering: dataengineering@digital.justice.gov.uk"
		1078 |     "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
		1079 |   }
		1080 | }

dockerfile scan results:

Passed checks: 21, Failed checks: 2, Skipped checks: 0

Check: CKV_DOCKER_2: "Ensure that HEALTHCHECK instructions have been added to container images"
	FAILED for resource: /lambdas/update_log_table/Dockerfile.
	File: /lambdas/update_log_table/Dockerfile:1-9
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/docker-policies/docker-policy-index/ensure-that-healthcheck-instructions-have-been-added-to-container-images

		1 | FROM public.ecr.aws/lambda/python:3.11
		2 | 
		3 | COPY requirements.txt .
		4 | 
		5 | RUN pip install -r requirements.txt --target "${LAMBDA_TASK_ROOT}"
		6 | 
		7 | COPY update_log_table.py ${LAMBDA_TASK_ROOT}
		8 | 
		9 | CMD ["update_log_table.handler"]

Check: CKV_DOCKER_3: "Ensure that a user for the container has been created"
	FAILED for resource: /lambdas/update_log_table/Dockerfile.
	File: /lambdas/update_log_table/Dockerfile:1-9
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/docker-policies/docker-policy-index/ensure-that-a-user-for-the-container-has-been-created

		1 | FROM public.ecr.aws/lambda/python:3.11
		2 | 
		3 | COPY requirements.txt .
		4 | 
		5 | RUN pip install -r requirements.txt --target "${LAMBDA_TASK_ROOT}"
		6 | 
		7 | COPY update_log_table.py ${LAMBDA_TASK_ROOT}
		8 | 
		9 | CMD ["update_log_table.handler"]


checkov_exitcode=1

CTFLint Scan Failed

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
terraform/environments/electronic-monitoring-data

*****************************

Running tflint in terraform/environments/electronic-monitoring-data
Excluding the following checks: terraform_unused_declarations
11 issue(s) found:

Warning: Missing version constraint for provider "archive" in `required_providers` (terraform_required_providers)

  on terraform/environments/electronic-monitoring-data/glue_data.tf line 1:
   1: data "archive_file" "archive_file_zip_py_files" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

Warning: `s3_pylib_dir_path` variable has no type (terraform_typed_variables)

  on terraform/environments/electronic-monitoring-data/glue_variables.tf line 1:
   1: variable "s3_pylib_dir_path" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_typed_variables.md

Warning: Missing version constraint for provider "random" in `required_providers` (terraform_required_providers)

  on terraform/environments/electronic-monitoring-data/server_backups.tf line 13:
  13: resource "random_password" "random_password" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 11:
  11:           "Resource" : "${module.get_metadata_from_rds_lambda.lambda_function_arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 24:
  24:                 "Resource" : "${module.create_athena_table.lambda_function_arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 98:
  98:             "WorkGroup" : "${aws_athena_workgroup.default.name}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 114:
 114:           "Resource" : "${module.query_output_to_list.lambda_function_arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 127:
 127:                 "Resource" : "${module.get_file_keys_for_table.lambda_function_arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 141:
 141:                       "Resource" : "${module.send_table_to_ap.lambda_function_arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 152:
 152:                 "Resource" : "${module.update_log_table.lambda_function_arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 164:
 164:             "WorkGroup" : "${aws_athena_workgroup.default.name}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

tflint_exitcode=2

Trivy Scan Failed

Show Output

*****************************

Trivy will check the following folders:
terraform/environments/electronic-monitoring-data

*****************************

Running Trivy in terraform/environments/electronic-monitoring-data
2024-10-14T18:23:13Z	INFO	[vulndb] Need to update DB
2024-10-14T18:23:13Z	INFO	[vulndb] Downloading vulnerability DB...
2024-10-14T18:23:13Z	INFO	[vulndb] Downloading artifact...	repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-14T18:23:15Z	INFO	[vulndb] Artifact successfully downloaded	repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-14T18:23:15Z	INFO	[vuln] Vulnerability scanning is enabled
2024-10-14T18:23:15Z	INFO	[misconfig] Misconfiguration scanning is enabled
2024-10-14T18:23:15Z	INFO	[misconfig] Need to update the built-in checks
2024-10-14T18:23:15Z	INFO	[misconfig] Downloading the built-in checks...
156.02 KiB / 156.02 KiB [---------------------------------------------------------] 100.00% ? p/s 0s2024-10-14T18:23:16Z	INFO	[secret] Secret scanning is enabled
2024-10-14T18:23:16Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-14T18:23:16Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-10-14T18:23:16Z	WARN	[pip] Unable to find python `site-packages` directory. License detection is skipped.	err="site-packages directory not found"
2024-10-14T18:23:17Z	INFO	[terraform scanner] Scanning root module	file_path="."
2024-10-14T18:23:17Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="networking"
2024-10-14T18:23:18Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:23:18Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:23:18Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:23:18Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:23:18Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:23:18Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.aws_s3_object.user_public_keys" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.data.aws_subnet.local_account" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:23:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:23:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:23:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:23:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:23:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:23:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:23:21Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:23:26Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-14T18:23:26Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-14T18:23:26Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T18:23:26Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T18:23:26Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T18:23:26Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T18:23:26Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T18:23:26Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T18:23:26Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T18:23:26Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T18:23:26Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T18:23:26Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T18:23:26Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T18:23:26Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=95ed3c3/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=568694e50e03630d99cb569eafa06a0b879a1239/main.tf:171-179"
2024-10-14T18:23:26Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="s3.tf:1061-1080"
2024-10-14T18:23:26Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-versioning" range="s3.tf:1061-1080"
2024-10-14T18:23:26Z	INFO	[terraform executor] Ignore finding	rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:281-286"
2024-10-14T18:23:26Z	INFO	[terraform executor] Ignore finding	rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:407-411"
2024-10-14T18:23:26Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-bucket-encryption" range="s3.tf:1061-1080"
2024-10-14T18:23:26Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-logging" range="s3.tf:1061-1080"
2024-10-14T18:23:27Z	INFO	Number of language-specific files	num=1
2024-10-14T18:23:27Z	INFO	[pip] Detecting vulnerabilities...
2024-10-14T18:23:27Z	INFO	Detected config files	num=17

data_store.tf (terraform)
=========================
Tests: 1 (SUCCESSES: 0, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Topic does not have encryption enabled.
════════════════════════════════════════
Topics should be encrypted to protect their contents.


See https://avd.aquasec.com/misconfig/avd-aws-0095
────────────────────────────────────────
 data_store.tf:17-19
────────────────────────────────────────
  17 ┌ resource "aws_sns_topic" "s3_events" {
  18 │   name = "${module.s3-data-bucket.bucket.id}-object-created-topic"
  19 └ }
────────────────────────────────────────



lambdas/update_log_table/Dockerfile (dockerfile)
================================================
Tests: 20 (SUCCESSES: 19, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Specify at least 1 USER command in Dockerfile with non-root user as argument
════════════════════════════════════════
Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

See https://avd.aquasec.com/misconfig/ds002
────────────────────────────────────────


trivy_exitcode=1

[github-actions]

Trivy Scan Failed

Show Output

```hcl

---

Trivy will check the following folders:
terraform/environments/electronic-monitoring-data

---

Running Trivy in terraform/environments/electronic-monitoring-data
2024-10-14T18:49:18Z INFO [vulndb] Need to update DB
2024-10-14T18:49:18Z INFO [vulndb] Downloading vulnerability DB...
2024-10-14T18:49:18Z INFO [vulndb] Downloading artifact... repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-14T18:49:20Z INFO [vulndb] Artifact successfully downloaded repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-14T18:49:20Z INFO [vuln] Vulnerability scanning is enabled
2024-10-14T18:49:20Z INFO [misconfig] Misconfiguration scanning is enabled
2024-10-14T18:49:20Z INFO [misconfig] Need to update the built-in checks
2024-10-14T18:49:20Z INFO [misconfig] Downloading the built-in checks...
156.02 KiB / 156.02 KiB [---------------------------------------------------------] 100.00% ? p/s 0s2024-10-14T18:49:20Z INFO [secret] Secret scanning is enabled
2024-10-14T18:49:20Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-14T18:49:20Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-10-14T18:49:21Z INFO [terraform scanner] Scanning root module file_path="."
2024-10-14T18:49:22Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="networking"
2024-10-14T18:49:23Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:49:23Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:49:23Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:49:23Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:49:23Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:49:23Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:49:23Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:49:23Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:49:23Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:49:23Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:49:23Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.aws_s3_object.user_public_keys" value="cty.NilVal"
2024-10-14T18:49:23Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.data.aws_subnet.local_account" value="cty.NilVal"
2024-10-14T18:49:23Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-14T18:49:23Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:31Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-bucket-encryption" range="s3.tf:1061-1080"
2024-10-14T18:49:31Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-logging" range="s3.tf:1061-1080"
2024-10-14T18:49:31Z INFO [terraform executor] Ignore finding rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:281-286"
2024-10-14T18:49:31Z INFO [terraform executor] Ignore finding rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:407-411"
2024-10-14T18:49:31Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T18:49:31Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T18:49:31Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T18:49:31Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T18:49:31Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T18:49:31Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T18:49:31Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T18:49:31Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T18:49:31Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T18:49:31Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T18:49:31Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T18:49:31Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=95ed3c3/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=568694e50e03630d99cb569eafa06a0b879a1239/main.tf:171-179"
2024-10-14T18:49:31Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="s3.tf:1061-1080"
2024-10-14T18:49:31Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-versioning" range="s3.tf:1061-1080"
2024-10-14T18:49:31Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-14T18:49:31Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-14T18:49:31Z WARN [pip] Unable to find python site-packages directory. License detection is skipped. err="site-packages directory not found"
2024-10-14T18:49:32Z INFO Number of language-specific files num=1
2024-10-14T18:49:32Z INFO [pip] Detecting vulnerabilities...
2024-10-14T18:49:32Z INFO Detected config files num=17

data_store.tf (terraform)

Tests: 1 (SUCCESSES: 0, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Topic does not have encryption enabled.
════════════════════════════════════════
Topics should be encrypted to protect their contents.

See https://avd.aquasec.com/misconfig/avd-aws-0095
────────────────────────────────────────
data_store.tf:17-19
────────────────────────────────────────
17 ┌ resource "aws_sns_topic" "s3_events" {
18 │ name = "${module.s3-data-bucket.bucket.id}-object-created-topic"
19 └ }
────────────────────────────────────────

lambdas/update_log_table/Dockerfile (dockerfile)

Tests: 20 (SUCCESSES: 19, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Specify at least 1 USER command in Dockerfile with non-root user as argument
════════════════════════════════════════
Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

See https://avd.aquasec.com/misconfig/ds002
────────────────────────────────────────

trivy_exitcode=1

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/electronic-monitoring-data

*****************************

Running Checkov in terraform/environments/electronic-monitoring-data
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2024-10-14 18:49:34,983 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060:None (for external modules, the --download-external-modules flag is required)
2024-10-14 18:49:34,983 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=95ed3c3:None (for external modules, the --download-external-modules flag is required)
2024-10-14 18:49:34,983 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/secrets-manager/aws:1.3.0 (for external modules, the --download-external-modules flag is required)
2024-10-14 18:49:34,983 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=52a40b0:None (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 2286, Failed checks: 75, Skipped checks: 27

Check: CKV_AWS_26: "Ensure all data stored in the SNS topic is encrypted"
	FAILED for resource: aws_sns_topic.s3_events
	File: /data_store.tf:17-19
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-15

		17 | resource "aws_sns_topic" "s3_events" {
		18 |   name = "${module.s3-data-bucket.bucket.id}-object-created-topic"
		19 | }

Check: CKV_AWS_115: "Ensure that AWS Lambda function is configured for function-level concurrent execution limit"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-function-level-concurrent-execution-limit

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_272: "Ensure AWS Lambda function is configured to validate code-signing"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-272

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_173: "Check encryption settings for Lambda environmental variable"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-5

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_117: "Ensure that AWS Lambda function is configured inside a VPC"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-inside-a-vpc-1

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_116: "Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-a-dead-letter-queue-dlq

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_115: "Ensure that AWS Lambda function is configured for function-level concurrent execution limit"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-function-level-concurrent-execution-limit

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_272: "Ensure AWS Lambda function is configured to validate code-signing"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-272

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_117: "Ensure that AWS Lambda function is configured inside a VPC"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-inside-a-vpc-1

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_116: "Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-a-dead-letter-queue-dlq

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group
	File: /dms_data_validation_glue_job.tf:65-68
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		65 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group" {
		66 |   name              = "dms-dv-glue-job"
		67 |   retention_in_days = 14
		68 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group
	File: /dms_data_validation_glue_job.tf:65-68
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		65 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group" {
		66 |   name              = "dms-dv-glue-job"
		67 |   retention_in_days = 14
		68 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group_v2
	File: /dms_data_validation_glue_job.tf:70-73
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		70 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group_v2" {
		71 |   name              = "dms-dv-glue-job-v2"
		72 |   retention_in_days = 14
		73 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group_v2
	File: /dms_data_validation_glue_job.tf:70-73
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		70 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group_v2" {
		71 |   name              = "dms-dv-glue-job-v2"
		72 |   retention_in_days = 14
		73 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.rds_to_s3_parquet_migration
	File: /dms_data_validation_glue_job.tf:75-78
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		75 | resource "aws_cloudwatch_log_group" "rds_to_s3_parquet_migration" {
		76 |   name              = "rds-to-s3-parquet-migration"
		77 |   retention_in_days = 14
		78 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.rds_to_s3_parquet_migration
	File: /dms_data_validation_glue_job.tf:75-78
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		75 | resource "aws_cloudwatch_log_group" "rds_to_s3_parquet_migration" {
		76 |   name              = "rds-to-s3-parquet-migration"
		77 |   retention_in_days = 14
		78 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.resizing_parquet_files
	File: /dms_data_validation_glue_job.tf:80-83
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		80 | resource "aws_cloudwatch_log_group" "resizing_parquet_files" {
		81 |   name              = "resizing-parquet-files"
		82 |   retention_in_days = 14
		83 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.resizing_parquet_files
	File: /dms_data_validation_glue_job.tf:80-83
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		80 | resource "aws_cloudwatch_log_group" "resizing_parquet_files" {
		81 |   name              = "resizing-parquet-files"
		82 |   retention_in_days = 14
		83 | }

Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.dms_dv_glue_job_v2
	File: /dms_data_validation_glue_job.tf:86-140
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.dms_dv_glue_job_v4d
	File: /dms_data_validation_glue_job.tf:148-201
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.rds_to_s3_parquet_migration
	File: /dms_data_validation_glue_job.tf:204-268
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.rds_to_s3_parquet_migration_monthly
	File: /dms_data_validation_glue_job.tf:272-326
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.resizing_parquet_files
	File: /dms_data_validation_glue_job.tf:329-381
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.catalog_dv_table_glue_job
	File: /dms_data_validation_glue_job.tf:384-412
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		384 | resource "aws_glue_job" "catalog_dv_table_glue_job" {
		385 |   name              = "catalog-dv-table-glue-job"
		386 |   description       = "Python script uses Boto3-Athena-Client to run sql-statements"
		387 |   role_arn          = aws_iam_role.dms_dv_glue_job_iam_role.arn
		388 |   glue_version      = "4.0"
		389 |   worker_type       = "G.1X"
		390 |   number_of_workers = 2
		391 |   default_arguments = {
		392 |     "--parquet_output_bucket_name"       = module.s3-dms-data-validation-bucket.bucket.id
		393 |     "--glue_catalog_db_name"             = aws_glue_catalog_database.dms_dv_glue_catalog_db.name
		394 |     "--glue_catalog_tbl_name"            = "glue_df_output"
		395 |     "--continuous-log-logGroup"          = aws_cloudwatch_log_group.dms_dv_cw_log_group.name
		396 |     "--enable-continuous-cloudwatch-log" = "true"
		397 |     "--enable-continuous-log-filter"     = "true"
		398 |     "--enable-metrics"                   = ""
		399 |   }
		400 |   command {
		401 |     python_version  = "3"
		402 |     script_location = "s3://${module.s3-glue-job-script-bucket.bucket.id}/create_or_replace_dv_table.py"
		403 |   }
		404 | 
		405 |   tags = merge(
		406 |     local.tags,
		407 |     {
		408 |       Resource_Type = "Py script as glue-job that creates dv table / refreshes its partitions",
		409 |     }
		410 |   )
		411 | 
		412 | }

Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_crawler.rds_sqlserver_db_glue_crawler
	File: /dms_glue_crawler.tf:35-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		35 | resource "aws_glue_crawler" "rds_sqlserver_db_glue_crawler" {
		36 |   name          = "rds-sqlserver-${aws_db_instance.database_2022.identifier}-tf"
		37 |   role          = aws_iam_role.dms_dv_glue_job_iam_role.arn
		38 |   database_name = aws_glue_catalog_database.rds_sqlserver_glue_catalog_db.name
		39 |   description   = "Crawler to fetch database names"
		40 |   #   table_prefix  = "your_table_prefix"
		41 | 
		42 |   jdbc_target {
		43 |     connection_name = aws_glue_connection.glue_rds_sqlserver_db_connection.name
		44 |     path            = "%"
		45 |   }
		46 |   tags = merge(
		47 |     local.tags,
		48 |     {
		49 |       Resource_Type = "RDS-SQLServer Glue-Crawler for DMS",
		50 |     }
		51 |   )
		52 | 
		53 |   # provisioner "local-exec" {
		54 |   #   command = "aws glue start-crawler --name ${self.name}"
		55 |   # }
		56 | }

Check: CKV_AWS_212: "Ensure DMS replication instance is encrypted by KMS using a customer managed Key (CMK)"
	FAILED for resource: aws_dms_replication_instance.dms_replication_instance
	File: /dms_replication_instance.tf:24-55
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-ebs-volume-is-encrypted-by-key-management-service-kms-using-a-customer-managed-key-cmk

		24 | resource "aws_dms_replication_instance" "dms_replication_instance" {
		25 |   allocated_storage          = var.dms_allocated_storage_gib
		26 |   apply_immediately          = true
		27 |   auto_minor_version_upgrade = true
		28 |   availability_zone          = var.dms_availability_zone
		29 |   engine_version             = var.dms_engine_version
		30 |   #   kms_key_arn                  = "arn:aws:kms:eu-west-2:800964199911:key/b7f54acb-16a3-4958-9340-3bdf5f5842d8"
		31 |   multi_az = false
		32 |   #   preferred_maintenance_window = "sun:10:30-sun:14:30"
		33 |   publicly_accessible         = false
		34 |   replication_instance_class  = var.dms_replication_instance_class
		35 |   replication_instance_id     = "dms-replication-instance-tf"
		36 |   replication_subnet_group_id = aws_dms_replication_subnet_group.dms_replication_subnet_group.id
		37 | 
		38 |   tags = merge(
		39 |     local.tags,
		40 |     {
		41 |       Resource_Type = "DMS Replication Instance",
		42 |     }
		43 |   )
		44 | 
		45 |   vpc_security_group_ids = [
		46 |     aws_security_group.dms_ri_security_group.id,
		47 |   ]
		48 | 
		49 |   depends_on = [
		50 |     aws_iam_role.dms_vpc_role,
		51 |     aws_iam_role.dms_cloudwatch_logs_role,
		52 |     aws_iam_role.dms_endpoint_role
		53 |   ]
		54 | 
		55 | }

Check: CKV_AWS_25: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389"
	FAILED for resource: aws_vpc_security_group_ingress_rule.glue_rds_conn_inbound
	File: /dms_security_groups.tf:69-77
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-2

		69 | resource "aws_vpc_security_group_ingress_rule" "glue_rds_conn_inbound" {
		70 |   security_group_id = aws_security_group.glue_rds_conn_security_group.id
		71 | 
		72 |   referenced_security_group_id = aws_security_group.glue_rds_conn_security_group.id
		73 |   ip_protocol                  = "tcp"
		74 |   from_port                    = 0
		75 |   to_port                      = 65535
		76 |   description                  = "Required ports open for Glue-RDS-Connection"
		77 | }

Check: CKV_AWS_24: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 22"
	FAILED for resource: aws_vpc_security_group_ingress_rule.glue_rds_conn_inbound
	File: /dms_security_groups.tf:69-77
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-1-port-security

		69 | resource "aws_vpc_security_group_ingress_rule" "glue_rds_conn_inbound" {
		70 |   security_group_id = aws_security_group.glue_rds_conn_security_group.id
		71 | 
		72 |   referenced_security_group_id = aws_security_group.glue_rds_conn_security_group.id
		73 |   ip_protocol                  = "tcp"
		74 |   from_port                    = 0
		75 |   to_port                      = 65535
		76 |   description                  = "Required ports open for Glue-RDS-Connection"
		77 | }

Check: CKV_AWS_260: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 80"
	FAILED for resource: aws_vpc_security_group_ingress_rule.glue_rds_conn_inbound
	File: /dms_security_groups.tf:69-77
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-aws-security-groups-do-not-allow-ingress-from-00000-to-port-80

		69 | resource "aws_vpc_security_group_ingress_rule" "glue_rds_conn_inbound" {
		70 |   security_group_id = aws_security_group.glue_rds_conn_security_group.id
		71 | 
		72 |   referenced_security_group_id = aws_security_group.glue_rds_conn_security_group.id
		73 |   ip_protocol                  = "tcp"
		74 |   from_port                    = 0
		75 |   to_port                      = 65535
		76 |   description                  = "Required ports open for Glue-RDS-Connection"
		77 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.glue_notebook_ec2_iam_policy_document
	File: /glue_data.tf:103-118
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		103 | data "aws_iam_policy_document" "glue_notebook_ec2_iam_policy_document" {
		104 |   statement {
		105 |     effect = "Allow"
		106 |     actions = [
		107 |       "ec2:CreateNetworkInterface",
		108 |       "ec2:DescribeNetworkInterfaces",
		109 |       "ec2:DeleteNetworkInterface",
		110 |       "ec2:DescribeVpcEndpoints",
		111 |       "ec2:DescribeSubnets",
		112 |       "ec2:DescribeVpcAttribute",
		113 |       "ec2:DescribeRouteTables",
		114 |       "ec2:DescribeSecurityGroups"
		115 |     ]
		116 |     resources = ["*"]
		117 |   }
		118 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.glue_notebook_ec2_iam_policy_document
	File: /glue_data.tf:103-118
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		103 | data "aws_iam_policy_document" "glue_notebook_ec2_iam_policy_document" {
		104 |   statement {
		105 |     effect = "Allow"
		106 |     actions = [
		107 |       "ec2:CreateNetworkInterface",
		108 |       "ec2:DescribeNetworkInterfaces",
		109 |       "ec2:DeleteNetworkInterface",
		110 |       "ec2:DescribeVpcEndpoints",
		111 |       "ec2:DescribeSubnets",
		112 |       "ec2:DescribeVpcAttribute",
		113 |       "ec2:DescribeRouteTables",
		114 |       "ec2:DescribeSecurityGroups"
		115 |     ]
		116 |     resources = ["*"]
		117 |   }
		118 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.load_json_table_s3_policy_document
	File: /lambdas_iam.tf:430-487
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.load_json_table_s3_policy_document
	File: /lambdas_iam.tf:430-487
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.db_glue_connection
	File: /lambdas_secrets.tf:1-3
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		1 | resource "aws_secretsmanager_secret" "db_glue_connection" {
		2 |   name = "db_glue_connection"
		3 | }

Check: CKV_AWS_296: "Ensure DMS endpoint uses Customer Managed Key (CMK)"
	FAILED for resource: module.dms_task.aws_dms_endpoint.dms_rds_source
	File: /modules/dms/endpoints_rds_s3.tf:2-23
	Calling File: /dms_main.tf:1-39
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-296

		2  | resource "aws_dms_endpoint" "dms_rds_source" {
		3  | 
		4  |   #   certificate_arn             = ""
		5  |   database_name = var.database_name
		6  |   endpoint_id   = "rds-mssql-${replace(var.database_name, "_", "-")}-tf"
		7  |   endpoint_type = "source"
		8  |   engine_name   = "sqlserver"
		9  |   #   extra_connection_attributes = ""
		10 |   #   kms_key_arn                 = aws_db_instance.database_2022.kms_key_id
		11 |   password    = var.rds_db_instance_pasword
		12 |   port        = var.rds_db_instance_port
		13 |   server_name = var.rds_db_server_name
		14 |   ssl_mode    = "require"
		15 |   username    = var.rds_db_username
		16 | 
		17 |   tags = merge(
		18 |     var.local_tags,
		19 |     {
		20 |       Resource_Type = "DMS Source Endpoint - RDS MSSQL",
		21 |     },
		22 |   )
		23 | }

Check: CKV_AWS_298: "Ensure DMS S3 uses Customer Managed Key (CMK)"
	FAILED for resource: module.dms_task.aws_dms_s3_endpoint.dms_s3_parquet_target
	File: /modules/dms/endpoints_rds_s3.tf:28-84
	Calling File: /dms_main.tf:1-39
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-298

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:38-47
	Calling File: /step_functions_main.tf:233-243
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		38 | data "aws_iam_policy_document" "step_function_base_permissions" {
		39 |   statement {
		40 |     effect = "Allow"
		41 |     actions = [
		42 |       "sns:Publish",
		43 |       "sqs:SendMessage"
		44 |     ]
		45 |     resources = ["*"]
		46 |   }
		47 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:38-47
	Calling File: /step_functions_main.tf:233-243
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		38 | data "aws_iam_policy_document" "step_function_base_permissions" {
		39 |   statement {
		40 |     effect = "Allow"
		41 |     actions = [
		42 |       "sns:Publish",
		43 |       "sqs:SendMessage"
		44 |     ]
		45 |     resources = ["*"]
		46 |   }
		47 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:54-82
	Calling File: /step_functions_main.tf:233-243
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		54 | data "aws_iam_policy_document" "this_log_key_document" {
		55 |   statement {
		56 |     sid    = "EnableIAMUserPermissions"
		57 |     effect = "Allow"
		58 |     principals {
		59 |       type        = "AWS"
		60 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		61 |     }
		62 |     actions   = ["kms:*"]
		63 |     resources = ["*"]
		64 |   }
		65 | 
		66 |   statement {
		67 |     sid    = "EnableLogServicePermissions"
		68 |     effect = "Allow"
		69 |     principals {
		70 |       type        = "Service"
		71 |       identifiers = ["logs.eu-west-2.amazonaws.com"]
		72 |     }
		73 |     actions = [
		74 |       "kms:Encrypt*",
		75 |       "kms:Decrypt*",
		76 |       "kms:ReEncrypt*",
		77 |       "kms:GenerateDataKey*",
		78 |       "kms:Describe*",
		79 |     ]
		80 |     resources = ["*"]
		81 |   }
		82 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:54-82
	Calling File: /step_functions_main.tf:233-243
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		54 | data "aws_iam_policy_document" "this_log_key_document" {
		55 |   statement {
		56 |     sid    = "EnableIAMUserPermissions"
		57 |     effect = "Allow"
		58 |     principals {
		59 |       type        = "AWS"
		60 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		61 |     }
		62 |     actions   = ["kms:*"]
		63 |     resources = ["*"]
		64 |   }
		65 | 
		66 |   statement {
		67 |     sid    = "EnableLogServicePermissions"
		68 |     effect = "Allow"
		69 |     principals {
		70 |       type        = "Service"
		71 |       identifiers = ["logs.eu-west-2.amazonaws.com"]
		72 |     }
		73 |     actions = [
		74 |       "kms:Encrypt*",
		75 |       "kms:Decrypt*",
		76 |       "kms:ReEncrypt*",
		77 |       "kms:GenerateDataKey*",
		78 |       "kms:Describe*",
		79 |     ]
		80 |     resources = ["*"]
		81 |   }
		82 | }

Check: CKV_AWS_109: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:54-82
	Calling File: /step_functions_main.tf:233-243
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-permissions-management-resource-exposure-without-constraint

		54 | data "aws_iam_policy_document" "this_log_key_document" {
		55 |   statement {
		56 |     sid    = "EnableIAMUserPermissions"
		57 |     effect = "Allow"
		58 |     principals {
		59 |       type        = "AWS"
		60 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		61 |     }
		62 |     actions   = ["kms:*"]
		63 |     resources = ["*"]
		64 |   }
		65 | 
		66 |   statement {
		67 |     sid    = "EnableLogServicePermissions"
		68 |     effect = "Allow"
		69 |     principals {
		70 |       type        = "Service"
		71 |       identifiers = ["logs.eu-west-2.amazonaws.com"]
		72 |     }
		73 |     actions = [
		74 |       "kms:Encrypt*",
		75 |       "kms:Decrypt*",
		76 |       "kms:ReEncrypt*",
		77 |       "kms:GenerateDataKey*",
		78 |       "kms:Describe*",
		79 |     ]
		80 |     resources = ["*"]
		81 |   }
		82 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: module.get_zipped_file.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:3-7
	Calling File: /step_functions_main.tf:233-243
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		3 | resource "aws_sfn_state_machine" "this" {
		4 |   name       = var.name
		5 |   role_arn   = aws_iam_role.step_function_role.arn
		6 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		7 | }

Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: module.get_zipped_file.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:3-7
	Calling File: /step_functions_main.tf:233-243
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		3 | resource "aws_sfn_state_machine" "this" {
		4 |   name       = var.name
		5 |   role_arn   = aws_iam_role.step_function_role.arn
		6 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		7 | }

Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.db_password
	File: /server_backups.tf:4-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		4 | resource "aws_secretsmanager_secret" "db_password" {
		5 |   name = "db_password"
		6 | }

Check: CKV_AWS_157: "Ensure that RDS instances have Multi-AZ enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-73

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_118: "Ensure that enhanced monitoring is enabled for Amazon RDS instances"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/ensure-that-enhanced-monitoring-is-enabled-for-amazon-rds-instances

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_129: "Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-that-respective-logs-of-amazon-relational-database-service-amazon-rds-are-enabled

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_354: "Ensure RDS Performance Insights are encrypted using KMS CMKs"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-354

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_353: "Ensure that RDS instances have performance insights enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-353

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_293: "Ensure that AWS database instances have deletion protection enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-293

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_25: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389"
	FAILED for resource: aws_vpc_security_group_ingress_rule.db_glue_access
	File: /server_backups.tf:123-131
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-2

		123 | resource "aws_vpc_security_group_ingress_rule" "db_glue_access" {
		124 | 
		125 |   security_group_id            = aws_security_group.db.id
		126 |   description                  = "glue"
		127 |   ip_protocol                  = "tcp"
		128 |   from_port                    = 0
		129 |   to_port                      = 65535
		130 |   referenced_security_group_id = aws_security_group.db.id
		131 | }

Check: CKV_AWS_24: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 22"
	FAILED for resource: aws_vpc_security_group_ingress_rule.db_glue_access
	File: /server_backups.tf:123-131
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-1-port-security

		123 | resource "aws_vpc_security_group_ingress_rule" "db_glue_access" {
		124 | 
		125 |   security_group_id            = aws_security_group.db.id
		126 |   description                  = "glue"
		127 |   ip_protocol                  = "tcp"
		128 |   from_port                    = 0
		129 |   to_port                      = 65535
		130 |   referenced_security_group_id = aws_security_group.db.id
		131 | }

Check: CKV_AWS_260: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 80"
	FAILED for resource: aws_vpc_security_group_ingress_rule.db_glue_access
	File: /server_backups.tf:123-131
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-aws-security-groups-do-not-allow-ingress-from-00000-to-port-80

		123 | resource "aws_vpc_security_group_ingress_rule" "db_glue_access" {
		124 | 
		125 |   security_group_id            = aws_security_group.db.id
		126 |   description                  = "glue"
		127 |   ip_protocol                  = "tcp"
		128 |   from_port                    = 0
		129 |   to_port                      = 65535
		130 |   referenced_security_group_id = aws_security_group.db.id
		131 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.send_database_to_ap_athena_queries
	File: /step_functions_iam.tf:151-196
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		151 | data "aws_iam_policy_document" "send_database_to_ap_athena_queries" {
		152 |   statement {
		153 |     effect = "Allow"
		154 | 
		155 |     actions = [
		156 |       "athena:startQueryExecution",
		157 |       "athena:getQueryExecution",
		158 |       "athena:getQueryResults"
		159 |     ]
		160 | 
		161 |     resources = [
		162 |       "*"
		163 |     ]
		164 |   }
		165 |   statement {
		166 |     effect = "Allow"
		167 | 
		168 |     actions = [
		169 |       "s3:PutObject",
		170 |       "s3:GetObject",
		171 |       "s3:ListBucket",
		172 |       "s3:GetBucketLocation"
		173 |     ]
		174 | 
		175 |     resources = [
		176 |       module.s3-athena-bucket.bucket.arn,
		177 |       "${module.s3-athena-bucket.bucket.arn}/*",
		178 |       "${module.s3-dms-data-validation-bucket.bucket.arn}/*",
		179 |       module.s3-dms-data-validation-bucket.bucket.arn
		180 |     ]
		181 |   }
		182 |   statement {
		183 |     effect = "Allow"
		184 | 
		185 |     actions = [
		186 |       "glue:GetDatabase",
		187 |       "glue:GetTable",
		188 |       "glue:GetPartitions",
		189 |       "glue:GetTables"
		190 |     ]
		191 | 
		192 |     resources = [
		193 |       "*"
		194 |     ]
		195 |   }
		196 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.send_database_to_ap_athena_queries
	File: /step_functions_iam.tf:151-196
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		151 | data "aws_iam_policy_document" "send_database_to_ap_athena_queries" {
		152 |   statement {
		153 |     effect = "Allow"
		154 | 
		155 |     actions = [
		156 |       "athena:startQueryExecution",
		157 |       "athena:getQueryExecution",
		158 |       "athena:getQueryResults"
		159 |     ]
		160 | 
		161 |     resources = [
		162 |       "*"
		163 |     ]
		164 |   }
		165 |   statement {
		166 |     effect = "Allow"
		167 | 
		168 |     actions = [
		169 |       "s3:PutObject",
		170 |       "s3:GetObject",
		171 |       "s3:ListBucket",
		172 |       "s3:GetBucketLocation"
		173 |     ]
		174 | 
		175 |     resources = [
		176 |       module.s3-athena-bucket.bucket.arn,
		177 |       "${module.s3-athena-bucket.bucket.arn}/*",
		178 |       "${module.s3-dms-data-validation-bucket.bucket.arn}/*",
		179 |       module.s3-dms-data-validation-bucket.bucket.arn
		180 |     ]
		181 |   }
		182 |   statement {
		183 |     effect = "Allow"
		184 | 
		185 |     actions = [
		186 |       "glue:GetDatabase",
		187 |       "glue:GetTable",
		188 |       "glue:GetPartitions",
		189 |       "glue:GetTables"
		190 |     ]
		191 | 
		192 |     resources = [
		193 |       "*"
		194 |     ]
		195 |   }
		196 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: aws_sfn_state_machine.athena_layer
	File: /step_functions_main.tf:1-36
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		1  | resource "aws_sfn_state_machine" "athena_layer" {
		2  |   name     = "athena-layer"
		3  |   role_arn = aws_iam_role.step_functions_role.arn
		4  | 
		5  |   definition = jsonencode(
		6  |     {
		7  |       "StartAt" : "GetMetadataList",
		8  |       "States" : {
		9  |         "GetMetadataList" : {
		10 |           "Type" : "Task",
		11 |           "Resource" : "${module.get_metadata_from_rds_lambda.lambda_function_arn}",
		12 |           "ResultPath" : "$.metadata_list",
		13 |           "Next" : "LoopThroughMetadataList"
		14 |         },
		15 |         "LoopThroughMetadataList" : {
		16 |           "Type" : "Map",
		17 |           "ItemsPath" : "$.metadata_list.metadata_list",
		18 |           "MaxConcurrency" : 4,
		19 |           "Iterator" : {
		20 |             "StartAt" : "CreateAthenaTable",
		21 |             "States" : {
		22 |               "CreateAthenaTable" : {
		23 |                 "Type" : "Task",
		24 |                 "Resource" : "${module.create_athena_table.lambda_function_arn}",
		25 |                 "ResultPath" : "$.result",
		26 |                 "End" : true
		27 |               }
		28 |             }
		29 |           },
		30 |           "End" : true
		31 |         }
		32 |       }
		33 |     }
		34 |   )
		35 | 
		36 | }

Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: aws_sfn_state_machine.athena_layer
	File: /step_functions_main.tf:1-36
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		1  | resource "aws_sfn_state_machine" "athena_layer" {
		2  |   name     = "athena-layer"
		3  |   role_arn = aws_iam_role.step_functions_role.arn
		4  | 
		5  |   definition = jsonencode(
		6  |     {
		7  |       "StartAt" : "GetMetadataList",
		8  |       "States" : {
		9  |         "GetMetadataList" : {
		10 |           "Type" : "Task",
		11 |           "Resource" : "${module.get_metadata_from_rds_lambda.lambda_function_arn}",
		12 |           "ResultPath" : "$.metadata_list",
		13 |           "Next" : "LoopThroughMetadataList"
		14 |         },
		15 |         "LoopThroughMetadataList" : {
		16 |           "Type" : "Map",
		17 |           "ItemsPath" : "$.metadata_list.metadata_list",
		18 |           "MaxConcurrency" : 4,
		19 |           "Iterator" : {
		20 |             "StartAt" : "CreateAthenaTable",
		21 |             "States" : {
		22 |               "CreateAthenaTable" : {
		23 |                 "Type" : "Task",
		24 |                 "Resource" : "${module.create_athena_table.lambda_function_arn}",
		25 |                 "ResultPath" : "$.result",
		26 |                 "End" : true
		27 |               }
		28 |             }
		29 |           },
		30 |           "End" : true
		31 |         }
		32 |       }
		33 |     }
		34 |   )
		35 | 
		36 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: aws_sfn_state_machine.send_database_to_ap
	File: /step_functions_main.tf:85-171
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: aws_sfn_state_machine.send_database_to_ap
	File: /step_functions_main.tf:85-171
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_18: "Ensure the S3 bucket has access logging enabled"
	FAILED for resource: aws_s3_bucket.data_store
	File: /s3.tf:1061-1080
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-13-enable-logging

		1061 | resource "aws_s3_bucket" "data_store" {
		1062 |   #checkov:skip:CKV_AWS_145
		1063 |   #checkov:skip:CKV_AWS_144
		1064 |   #checkov:skip:CKV_AWS_21
		1065 |   #checkov:skip:CKV2_AWS_65
		1066 |   #checkov:skip:CKV2_AWS_62
		1067 |   #checkov:skip:CKV_AWS_18
		1068 |   #checkov:skip:CKV2_AWS_61
		1069 |   bucket_prefix = "em-data-store-"
		1070 |   force_destroy = false
		1071 |   tags = {
		1072 |     "application"            = "electronic-monitoring-data"
		1073 |     "business-unit"          = "HMPPS"
		1074 |     "environment-name"       = "electronic-monitoring-data-production"
		1075 |     "infrastructure-support" = "dataengineering@digital.justice.gov.uk"
		1076 |     "is-production"          = "true"
		1077 |     "owner"                  = "Data engineering: dataengineering@digital.justice.gov.uk"
		1078 |     "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
		1079 |   }
		1080 | }

Check: CKV2_AWS_61: "Ensure that an S3 bucket has a lifecycle configuration"
	FAILED for resource: aws_s3_bucket.data_store
	File: /s3.tf:1061-1080
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-2-61

		1061 | resource "aws_s3_bucket" "data_store" {
		1062 |   #checkov:skip:CKV_AWS_145
		1063 |   #checkov:skip:CKV_AWS_144
		1064 |   #checkov:skip:CKV_AWS_21
		1065 |   #checkov:skip:CKV2_AWS_65
		1066 |   #checkov:skip:CKV2_AWS_62
		1067 |   #checkov:skip:CKV_AWS_18
		1068 |   #checkov:skip:CKV2_AWS_61
		1069 |   bucket_prefix = "em-data-store-"
		1070 |   force_destroy = false
		1071 |   tags = {
		1072 |     "application"            = "electronic-monitoring-data"
		1073 |     "business-unit"          = "HMPPS"
		1074 |     "environment-name"       = "electronic-monitoring-data-production"
		1075 |     "infrastructure-support" = "dataengineering@digital.justice.gov.uk"
		1076 |     "is-production"          = "true"
		1077 |     "owner"                  = "Data engineering: dataengineering@digital.justice.gov.uk"
		1078 |     "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
		1079 |   }
		1080 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: aws_security_group.glue_rds_conn_security_group
	File: /dms_security_groups.tf:46-57
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		46 | resource "aws_security_group" "glue_rds_conn_security_group" {
		47 |   name        = "glue-rds-sqlserver-connection-tf"
		48 |   description = "Secuity Group for Glue-RDS-Connection"
		49 |   vpc_id      = data.aws_vpc.shared.id
		50 | 
		51 |   tags = merge(
		52 |     local.tags,
		53 |     {
		54 |       Resource_Type = "Secuity Group for Glue-RDS-Connection",
		55 |     }
		56 |   )
		57 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: module.buddi.module.landing_zone_security_groups.aws_security_group.this
	File: /modules/landing_zone/server_security_group/main.tf:7-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		7  | resource "aws_security_group" "this" {
		8  |   name        = "${var.supplier}-${var.user_name}-inbound-ips"
		9  |   description = "Allowed IP addresses for ${var.user_name} on ${var.supplier} server"
		10 |   vpc_id      = var.vpc_id
		11 | 
		12 |   lifecycle {
		13 |     create_before_destroy = true
		14 |   }
		15 | 
		16 |   tags = merge(
		17 |     var.local_tags,
		18 |     {
		19 |       supplier = var.user_name,
		20 |     },
		21 |   )
		22 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: module.capita.module.landing_zone_security_groups.aws_security_group.this
	File: /modules/landing_zone/server_security_group/main.tf:7-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		7  | resource "aws_security_group" "this" {
		8  |   name        = "${var.supplier}-${var.user_name}-inbound-ips"
		9  |   description = "Allowed IP addresses for ${var.user_name} on ${var.supplier} server"
		10 |   vpc_id      = var.vpc_id
		11 | 
		12 |   lifecycle {
		13 |     create_before_destroy = true
		14 |   }
		15 | 
		16 |   tags = merge(
		17 |     var.local_tags,
		18 |     {
		19 |       supplier = var.user_name,
		20 |     },
		21 |   )
		22 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: module.g4s.module.landing_zone_security_groups.aws_security_group.this
	File: /modules/landing_zone/server_security_group/main.tf:7-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		7  | resource "aws_security_group" "this" {
		8  |   name        = "${var.supplier}-${var.user_name}-inbound-ips"
		9  |   description = "Allowed IP addresses for ${var.user_name} on ${var.supplier} server"
		10 |   vpc_id      = var.vpc_id
		11 | 
		12 |   lifecycle {
		13 |     create_before_destroy = true
		14 |   }
		15 | 
		16 |   tags = merge(
		17 |     var.local_tags,
		18 |     {
		19 |       supplier = var.user_name,
		20 |     },
		21 |   )
		22 | }

Check: CKV_AWS_144: "Ensure that S3 bucket has cross-region replication enabled"
	FAILED for resource: aws_s3_bucket.data_store
	File: /s3.tf:1061-1080
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-s3-bucket-has-cross-region-replication-enabled

		1061 | resource "aws_s3_bucket" "data_store" {
		1062 |   #checkov:skip:CKV_AWS_145
		1063 |   #checkov:skip:CKV_AWS_144
		1064 |   #checkov:skip:CKV_AWS_21
		1065 |   #checkov:skip:CKV2_AWS_65
		1066 |   #checkov:skip:CKV2_AWS_62
		1067 |   #checkov:skip:CKV_AWS_18
		1068 |   #checkov:skip:CKV2_AWS_61
		1069 |   bucket_prefix = "em-data-store-"
		1070 |   force_destroy = false
		1071 |   tags = {
		1072 |     "application"            = "electronic-monitoring-data"
		1073 |     "business-unit"          = "HMPPS"
		1074 |     "environment-name"       = "electronic-monitoring-data-production"
		1075 |     "infrastructure-support" = "dataengineering@digital.justice.gov.uk"
		1076 |     "is-production"          = "true"
		1077 |     "owner"                  = "Data engineering: dataengineering@digital.justice.gov.uk"
		1078 |     "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
		1079 |   }
		1080 | }

Check: CKV2_AWS_65: "Ensure access control lists for S3 buckets are disabled"
	FAILED for resource: aws_s3_bucket_ownership_controls.bucket
	File: /s3.tf:1090-1095
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-general-112

		1090 | resource "aws_s3_bucket_ownership_controls" "bucket" {
		1091 |   bucket = aws_s3_bucket.data_store.id
		1092 |   rule {
		1093 |     object_ownership = "ObjectWriter"
		1094 |   }
		1095 | }

Check: CKV_AWS_145: "Ensure that S3 buckets are encrypted with KMS by default"
	FAILED for resource: aws_s3_bucket.data_store
	File: /s3.tf:1061-1080
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-s3-buckets-are-encrypted-with-kms-by-default

		1061 | resource "aws_s3_bucket" "data_store" {
		1062 |   #checkov:skip:CKV_AWS_145
		1063 |   #checkov:skip:CKV_AWS_144
		1064 |   #checkov:skip:CKV_AWS_21
		1065 |   #checkov:skip:CKV2_AWS_65
		1066 |   #checkov:skip:CKV2_AWS_62
		1067 |   #checkov:skip:CKV_AWS_18
		1068 |   #checkov:skip:CKV2_AWS_61
		1069 |   bucket_prefix = "em-data-store-"
		1070 |   force_destroy = false
		1071 |   tags = {
		1072 |     "application"            = "electronic-monitoring-data"
		1073 |     "business-unit"          = "HMPPS"
		1074 |     "environment-name"       = "electronic-monitoring-data-production"
		1075 |     "infrastructure-support" = "dataengineering@digital.justice.gov.uk"
		1076 |     "is-production"          = "true"
		1077 |     "owner"                  = "Data engineering: dataengineering@digital.justice.gov.uk"
		1078 |     "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
		1079 |   }
		1080 | }

Check: CKV2_AWS_60: "Ensure RDS instance with copy tags to snapshots is enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-60

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV2_AWS_62: "Ensure S3 buckets should have event notifications enabled"
	FAILED for resource: aws_s3_bucket.data_store
	File: /s3.tf:1061-1080
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-2-62

		1061 | resource "aws_s3_bucket" "data_store" {
		1062 |   #checkov:skip:CKV_AWS_145
		1063 |   #checkov:skip:CKV_AWS_144
		1064 |   #checkov:skip:CKV_AWS_21
		1065 |   #checkov:skip:CKV2_AWS_65
		1066 |   #checkov:skip:CKV2_AWS_62
		1067 |   #checkov:skip:CKV_AWS_18
		1068 |   #checkov:skip:CKV2_AWS_61
		1069 |   bucket_prefix = "em-data-store-"
		1070 |   force_destroy = false
		1071 |   tags = {
		1072 |     "application"            = "electronic-monitoring-data"
		1073 |     "business-unit"          = "HMPPS"
		1074 |     "environment-name"       = "electronic-monitoring-data-production"
		1075 |     "infrastructure-support" = "dataengineering@digital.justice.gov.uk"
		1076 |     "is-production"          = "true"
		1077 |     "owner"                  = "Data engineering: dataengineering@digital.justice.gov.uk"
		1078 |     "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
		1079 |   }
		1080 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.db_glue_connection
	File: /lambdas_secrets.tf:1-3
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		1 | resource "aws_secretsmanager_secret" "db_glue_connection" {
		2 |   name = "db_glue_connection"
		3 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.db_password
	File: /server_backups.tf:4-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		4 | resource "aws_secretsmanager_secret" "db_password" {
		5 |   name = "db_password"
		6 | }

Check: CKV_AWS_21: "Ensure all data stored in the S3 bucket have versioning enabled"
	FAILED for resource: aws_s3_bucket.data_store
	File: /s3.tf:1061-1080
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-16-enable-versioning

		1061 | resource "aws_s3_bucket" "data_store" {
		1062 |   #checkov:skip:CKV_AWS_145
		1063 |   #checkov:skip:CKV_AWS_144
		1064 |   #checkov:skip:CKV_AWS_21
		1065 |   #checkov:skip:CKV2_AWS_65
		1066 |   #checkov:skip:CKV2_AWS_62
		1067 |   #checkov:skip:CKV_AWS_18
		1068 |   #checkov:skip:CKV2_AWS_61
		1069 |   bucket_prefix = "em-data-store-"
		1070 |   force_destroy = false
		1071 |   tags = {
		1072 |     "application"            = "electronic-monitoring-data"
		1073 |     "business-unit"          = "HMPPS"
		1074 |     "environment-name"       = "electronic-monitoring-data-production"
		1075 |     "infrastructure-support" = "dataengineering@digital.justice.gov.uk"
		1076 |     "is-production"          = "true"
		1077 |     "owner"                  = "Data engineering: dataengineering@digital.justice.gov.uk"
		1078 |     "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
		1079 |   }
		1080 | }

dockerfile scan results:

Passed checks: 21, Failed checks: 2, Skipped checks: 0

Check: CKV_DOCKER_2: "Ensure that HEALTHCHECK instructions have been added to container images"
	FAILED for resource: /lambdas/update_log_table/Dockerfile.
	File: /lambdas/update_log_table/Dockerfile:1-9
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/docker-policies/docker-policy-index/ensure-that-healthcheck-instructions-have-been-added-to-container-images

		1 | FROM public.ecr.aws/lambda/python:3.11
		2 | 
		3 | COPY requirements.txt .
		4 | 
		5 | RUN pip install -r requirements.txt --target "${LAMBDA_TASK_ROOT}"
		6 | 
		7 | COPY update_log_table.py ${LAMBDA_TASK_ROOT}
		8 | 
		9 | CMD ["update_log_table.handler"]

Check: CKV_DOCKER_3: "Ensure that a user for the container has been created"
	FAILED for resource: /lambdas/update_log_table/Dockerfile.
	File: /lambdas/update_log_table/Dockerfile:1-9
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/docker-policies/docker-policy-index/ensure-that-a-user-for-the-container-has-been-created

		1 | FROM public.ecr.aws/lambda/python:3.11
		2 | 
		3 | COPY requirements.txt .
		4 | 
		5 | RUN pip install -r requirements.txt --target "${LAMBDA_TASK_ROOT}"
		6 | 
		7 | COPY update_log_table.py ${LAMBDA_TASK_ROOT}
		8 | 
		9 | CMD ["update_log_table.handler"]


checkov_exitcode=1

CTFLint Scan Failed

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
terraform/environments/electronic-monitoring-data

*****************************

Running tflint in terraform/environments/electronic-monitoring-data
Excluding the following checks: terraform_unused_declarations
11 issue(s) found:

Warning: Missing version constraint for provider "archive" in `required_providers` (terraform_required_providers)

  on terraform/environments/electronic-monitoring-data/glue_data.tf line 1:
   1: data "archive_file" "archive_file_zip_py_files" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

Warning: `s3_pylib_dir_path` variable has no type (terraform_typed_variables)

  on terraform/environments/electronic-monitoring-data/glue_variables.tf line 1:
   1: variable "s3_pylib_dir_path" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_typed_variables.md

Warning: Missing version constraint for provider "random" in `required_providers` (terraform_required_providers)

  on terraform/environments/electronic-monitoring-data/server_backups.tf line 13:
  13: resource "random_password" "random_password" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 11:
  11:           "Resource" : "${module.get_metadata_from_rds_lambda.lambda_function_arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 24:
  24:                 "Resource" : "${module.create_athena_table.lambda_function_arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 98:
  98:             "WorkGroup" : "${aws_athena_workgroup.default.name}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 114:
 114:           "Resource" : "${module.query_output_to_list.lambda_function_arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 127:
 127:                 "Resource" : "${module.get_file_keys_for_table.lambda_function_arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 141:
 141:                       "Resource" : "${module.send_table_to_ap.lambda_function_arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 152:
 152:                 "Resource" : "${module.update_log_table.lambda_function_arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 164:
 164:             "WorkGroup" : "${aws_athena_workgroup.default.name}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

tflint_exitcode=2

Trivy Scan Failed

Show Output

*****************************

Trivy will check the following folders:
terraform/environments/electronic-monitoring-data

*****************************

Running Trivy in terraform/environments/electronic-monitoring-data
2024-10-14T18:49:18Z	INFO	[vulndb] Need to update DB
2024-10-14T18:49:18Z	INFO	[vulndb] Downloading vulnerability DB...
2024-10-14T18:49:18Z	INFO	[vulndb] Downloading artifact...	repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-14T18:49:20Z	INFO	[vulndb] Artifact successfully downloaded	repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-14T18:49:20Z	INFO	[vuln] Vulnerability scanning is enabled
2024-10-14T18:49:20Z	INFO	[misconfig] Misconfiguration scanning is enabled
2024-10-14T18:49:20Z	INFO	[misconfig] Need to update the built-in checks
2024-10-14T18:49:20Z	INFO	[misconfig] Downloading the built-in checks...
156.02 KiB / 156.02 KiB [---------------------------------------------------------] 100.00% ? p/s 0s2024-10-14T18:49:20Z	INFO	[secret] Secret scanning is enabled
2024-10-14T18:49:20Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-14T18:49:20Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-10-14T18:49:21Z	INFO	[terraform scanner] Scanning root module	file_path="."
2024-10-14T18:49:22Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="networking"
2024-10-14T18:49:23Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:49:23Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:49:23Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:49:23Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:49:23Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:49:23Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:49:23Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:49:23Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:49:23Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:49:23Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:49:23Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.aws_s3_object.user_public_keys" value="cty.NilVal"
2024-10-14T18:49:23Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.data.aws_subnet.local_account" value="cty.NilVal"
2024-10-14T18:49:23Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-14T18:49:23Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T18:49:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T18:49:31Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-bucket-encryption" range="s3.tf:1061-1080"
2024-10-14T18:49:31Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-logging" range="s3.tf:1061-1080"
2024-10-14T18:49:31Z	INFO	[terraform executor] Ignore finding	rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:281-286"
2024-10-14T18:49:31Z	INFO	[terraform executor] Ignore finding	rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:407-411"
2024-10-14T18:49:31Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T18:49:31Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T18:49:31Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T18:49:31Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T18:49:31Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T18:49:31Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T18:49:31Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T18:49:31Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T18:49:31Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T18:49:31Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T18:49:31Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T18:49:31Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=95ed3c3/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=568694e50e03630d99cb569eafa06a0b879a1239/main.tf:171-179"
2024-10-14T18:49:31Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="s3.tf:1061-1080"
2024-10-14T18:49:31Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-versioning" range="s3.tf:1061-1080"
2024-10-14T18:49:31Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-14T18:49:31Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-14T18:49:31Z	WARN	[pip] Unable to find python `site-packages` directory. License detection is skipped.	err="site-packages directory not found"
2024-10-14T18:49:32Z	INFO	Number of language-specific files	num=1
2024-10-14T18:49:32Z	INFO	[pip] Detecting vulnerabilities...
2024-10-14T18:49:32Z	INFO	Detected config files	num=17

data_store.tf (terraform)
=========================
Tests: 1 (SUCCESSES: 0, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Topic does not have encryption enabled.
════════════════════════════════════════
Topics should be encrypted to protect their contents.


See https://avd.aquasec.com/misconfig/avd-aws-0095
────────────────────────────────────────
 data_store.tf:17-19
────────────────────────────────────────
  17 ┌ resource "aws_sns_topic" "s3_events" {
  18 │   name = "${module.s3-data-bucket.bucket.id}-object-created-topic"
  19 └ }
────────────────────────────────────────



lambdas/update_log_table/Dockerfile (dockerfile)
================================================
Tests: 20 (SUCCESSES: 19, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Specify at least 1 USER command in Dockerfile with non-root user as argument
════════════════════════════════════════
Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

See https://avd.aquasec.com/misconfig/ds002
────────────────────────────────────────


trivy_exitcode=1

[github-actions]

Trivy Scan Failed

Show Output

```hcl

---

Trivy will check the following folders:
terraform/environments/electronic-monitoring-data

---

Running Trivy in terraform/environments/electronic-monitoring-data
2024-10-14T19:02:06Z INFO [vulndb] Need to update DB
2024-10-14T19:02:06Z INFO [vulndb] Downloading vulnerability DB...
2024-10-14T19:02:06Z INFO [vulndb] Downloading artifact... repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-14T19:02:08Z INFO [vulndb] Artifact successfully downloaded repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-14T19:02:08Z INFO [vuln] Vulnerability scanning is enabled
2024-10-14T19:02:08Z INFO [misconfig] Misconfiguration scanning is enabled
2024-10-14T19:02:08Z INFO [misconfig] Need to update the built-in checks
2024-10-14T19:02:08Z INFO [misconfig] Downloading the built-in checks...
156.02 KiB / 156.02 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2024-10-14T19:02:09Z INFO [secret] Secret scanning is enabled
2024-10-14T19:02:09Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-14T19:02:09Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-10-14T19:02:09Z WARN [pip] Unable to find python site-packages directory. License detection is skipped. err="site-packages directory not found"
2024-10-14T19:02:10Z INFO [terraform scanner] Scanning root module file_path="."
2024-10-14T19:02:10Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="networking"
2024-10-14T19:02:11Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T19:02:11Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T19:02:11Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T19:02:11Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T19:02:11Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T19:02:11Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T19:02:11Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T19:02:11Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.aws_s3_object.user_public_keys" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.data.aws_subnet.local_account" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:18Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-versioning" range="s3.tf:1061-1080"
2024-10-14T19:02:18Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-bucket-encryption" range="s3.tf:1061-1080"
2024-10-14T19:02:18Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-logging" range="s3.tf:1061-1080"
2024-10-14T19:02:18Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T19:02:18Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T19:02:18Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T19:02:18Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T19:02:18Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T19:02:18Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T19:02:18Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T19:02:18Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T19:02:18Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T19:02:18Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T19:02:18Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T19:02:18Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=95ed3c3/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=568694e50e03630d99cb569eafa06a0b879a1239/main.tf:171-179"
2024-10-14T19:02:18Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="s3.tf:1061-1080"
2024-10-14T19:02:18Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-14T19:02:18Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-14T19:02:18Z INFO [terraform executor] Ignore finding rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:281-286"
2024-10-14T19:02:18Z INFO [terraform executor] Ignore finding rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:407-411"
2024-10-14T19:02:18Z INFO Number of language-specific files num=1
2024-10-14T19:02:18Z INFO [pip] Detecting vulnerabilities...
2024-10-14T19:02:18Z INFO Detected config files num=17

data_store.tf (terraform)

Tests: 1 (SUCCESSES: 0, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Topic does not have encryption enabled.
════════════════════════════════════════
Topics should be encrypted to protect their contents.

See https://avd.aquasec.com/misconfig/avd-aws-0095
────────────────────────────────────────
data_store.tf:17-19
────────────────────────────────────────
17 ┌ resource "aws_sns_topic" "s3_events" {
18 │ name = "${module.s3-data-bucket.bucket.id}-object-created-topic"
19 └ }
────────────────────────────────────────

lambdas/update_log_table/Dockerfile (dockerfile)

Tests: 20 (SUCCESSES: 19, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Specify at least 1 USER command in Dockerfile with non-root user as argument
════════════════════════════════════════
Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

See https://avd.aquasec.com/misconfig/ds002
────────────────────────────────────────

trivy_exitcode=1

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/electronic-monitoring-data

*****************************

Running Checkov in terraform/environments/electronic-monitoring-data
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2024-10-14 19:02:20,602 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060:None (for external modules, the --download-external-modules flag is required)
2024-10-14 19:02:20,602 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=95ed3c3:None (for external modules, the --download-external-modules flag is required)
2024-10-14 19:02:20,602 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/secrets-manager/aws:1.3.0 (for external modules, the --download-external-modules flag is required)
2024-10-14 19:02:20,603 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=52a40b0:None (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 2286, Failed checks: 75, Skipped checks: 27

Check: CKV_AWS_26: "Ensure all data stored in the SNS topic is encrypted"
	FAILED for resource: aws_sns_topic.s3_events
	File: /data_store.tf:17-19
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-15

		17 | resource "aws_sns_topic" "s3_events" {
		18 |   name = "${module.s3-data-bucket.bucket.id}-object-created-topic"
		19 | }

Check: CKV_AWS_115: "Ensure that AWS Lambda function is configured for function-level concurrent execution limit"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-function-level-concurrent-execution-limit

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_272: "Ensure AWS Lambda function is configured to validate code-signing"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-272

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_173: "Check encryption settings for Lambda environmental variable"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-5

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_117: "Ensure that AWS Lambda function is configured inside a VPC"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-inside-a-vpc-1

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_116: "Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-a-dead-letter-queue-dlq

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_115: "Ensure that AWS Lambda function is configured for function-level concurrent execution limit"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-function-level-concurrent-execution-limit

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_272: "Ensure AWS Lambda function is configured to validate code-signing"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-272

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_117: "Ensure that AWS Lambda function is configured inside a VPC"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-inside-a-vpc-1

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_116: "Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-a-dead-letter-queue-dlq

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group
	File: /dms_data_validation_glue_job.tf:65-68
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		65 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group" {
		66 |   name              = "dms-dv-glue-job"
		67 |   retention_in_days = 14
		68 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group
	File: /dms_data_validation_glue_job.tf:65-68
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		65 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group" {
		66 |   name              = "dms-dv-glue-job"
		67 |   retention_in_days = 14
		68 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group_v2
	File: /dms_data_validation_glue_job.tf:70-73
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		70 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group_v2" {
		71 |   name              = "dms-dv-glue-job-v2"
		72 |   retention_in_days = 14
		73 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group_v2
	File: /dms_data_validation_glue_job.tf:70-73
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		70 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group_v2" {
		71 |   name              = "dms-dv-glue-job-v2"
		72 |   retention_in_days = 14
		73 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.rds_to_s3_parquet_migration
	File: /dms_data_validation_glue_job.tf:75-78
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		75 | resource "aws_cloudwatch_log_group" "rds_to_s3_parquet_migration" {
		76 |   name              = "rds-to-s3-parquet-migration"
		77 |   retention_in_days = 14
		78 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.rds_to_s3_parquet_migration
	File: /dms_data_validation_glue_job.tf:75-78
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		75 | resource "aws_cloudwatch_log_group" "rds_to_s3_parquet_migration" {
		76 |   name              = "rds-to-s3-parquet-migration"
		77 |   retention_in_days = 14
		78 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.resizing_parquet_files
	File: /dms_data_validation_glue_job.tf:80-83
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		80 | resource "aws_cloudwatch_log_group" "resizing_parquet_files" {
		81 |   name              = "resizing-parquet-files"
		82 |   retention_in_days = 14
		83 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.resizing_parquet_files
	File: /dms_data_validation_glue_job.tf:80-83
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		80 | resource "aws_cloudwatch_log_group" "resizing_parquet_files" {
		81 |   name              = "resizing-parquet-files"
		82 |   retention_in_days = 14
		83 | }

Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.dms_dv_glue_job_v2
	File: /dms_data_validation_glue_job.tf:86-140
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.dms_dv_glue_job_v4d
	File: /dms_data_validation_glue_job.tf:148-201
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.rds_to_s3_parquet_migration
	File: /dms_data_validation_glue_job.tf:204-268
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.rds_to_s3_parquet_migration_monthly
	File: /dms_data_validation_glue_job.tf:272-326
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.resizing_parquet_files
	File: /dms_data_validation_glue_job.tf:329-381
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.catalog_dv_table_glue_job
	File: /dms_data_validation_glue_job.tf:384-412
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		384 | resource "aws_glue_job" "catalog_dv_table_glue_job" {
		385 |   name              = "catalog-dv-table-glue-job"
		386 |   description       = "Python script uses Boto3-Athena-Client to run sql-statements"
		387 |   role_arn          = aws_iam_role.dms_dv_glue_job_iam_role.arn
		388 |   glue_version      = "4.0"
		389 |   worker_type       = "G.1X"
		390 |   number_of_workers = 2
		391 |   default_arguments = {
		392 |     "--parquet_output_bucket_name"       = module.s3-dms-data-validation-bucket.bucket.id
		393 |     "--glue_catalog_db_name"             = aws_glue_catalog_database.dms_dv_glue_catalog_db.name
		394 |     "--glue_catalog_tbl_name"            = "glue_df_output"
		395 |     "--continuous-log-logGroup"          = aws_cloudwatch_log_group.dms_dv_cw_log_group.name
		396 |     "--enable-continuous-cloudwatch-log" = "true"
		397 |     "--enable-continuous-log-filter"     = "true"
		398 |     "--enable-metrics"                   = ""
		399 |   }
		400 |   command {
		401 |     python_version  = "3"
		402 |     script_location = "s3://${module.s3-glue-job-script-bucket.bucket.id}/create_or_replace_dv_table.py"
		403 |   }
		404 | 
		405 |   tags = merge(
		406 |     local.tags,
		407 |     {
		408 |       Resource_Type = "Py script as glue-job that creates dv table / refreshes its partitions",
		409 |     }
		410 |   )
		411 | 
		412 | }

Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_crawler.rds_sqlserver_db_glue_crawler
	File: /dms_glue_crawler.tf:35-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		35 | resource "aws_glue_crawler" "rds_sqlserver_db_glue_crawler" {
		36 |   name          = "rds-sqlserver-${aws_db_instance.database_2022.identifier}-tf"
		37 |   role          = aws_iam_role.dms_dv_glue_job_iam_role.arn
		38 |   database_name = aws_glue_catalog_database.rds_sqlserver_glue_catalog_db.name
		39 |   description   = "Crawler to fetch database names"
		40 |   #   table_prefix  = "your_table_prefix"
		41 | 
		42 |   jdbc_target {
		43 |     connection_name = aws_glue_connection.glue_rds_sqlserver_db_connection.name
		44 |     path            = "%"
		45 |   }
		46 |   tags = merge(
		47 |     local.tags,
		48 |     {
		49 |       Resource_Type = "RDS-SQLServer Glue-Crawler for DMS",
		50 |     }
		51 |   )
		52 | 
		53 |   # provisioner "local-exec" {
		54 |   #   command = "aws glue start-crawler --name ${self.name}"
		55 |   # }
		56 | }

Check: CKV_AWS_212: "Ensure DMS replication instance is encrypted by KMS using a customer managed Key (CMK)"
	FAILED for resource: aws_dms_replication_instance.dms_replication_instance
	File: /dms_replication_instance.tf:24-55
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-ebs-volume-is-encrypted-by-key-management-service-kms-using-a-customer-managed-key-cmk

		24 | resource "aws_dms_replication_instance" "dms_replication_instance" {
		25 |   allocated_storage          = var.dms_allocated_storage_gib
		26 |   apply_immediately          = true
		27 |   auto_minor_version_upgrade = true
		28 |   availability_zone          = var.dms_availability_zone
		29 |   engine_version             = var.dms_engine_version
		30 |   #   kms_key_arn                  = "arn:aws:kms:eu-west-2:800964199911:key/b7f54acb-16a3-4958-9340-3bdf5f5842d8"
		31 |   multi_az = false
		32 |   #   preferred_maintenance_window = "sun:10:30-sun:14:30"
		33 |   publicly_accessible         = false
		34 |   replication_instance_class  = var.dms_replication_instance_class
		35 |   replication_instance_id     = "dms-replication-instance-tf"
		36 |   replication_subnet_group_id = aws_dms_replication_subnet_group.dms_replication_subnet_group.id
		37 | 
		38 |   tags = merge(
		39 |     local.tags,
		40 |     {
		41 |       Resource_Type = "DMS Replication Instance",
		42 |     }
		43 |   )
		44 | 
		45 |   vpc_security_group_ids = [
		46 |     aws_security_group.dms_ri_security_group.id,
		47 |   ]
		48 | 
		49 |   depends_on = [
		50 |     aws_iam_role.dms_vpc_role,
		51 |     aws_iam_role.dms_cloudwatch_logs_role,
		52 |     aws_iam_role.dms_endpoint_role
		53 |   ]
		54 | 
		55 | }

Check: CKV_AWS_25: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389"
	FAILED for resource: aws_vpc_security_group_ingress_rule.glue_rds_conn_inbound
	File: /dms_security_groups.tf:69-77
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-2

		69 | resource "aws_vpc_security_group_ingress_rule" "glue_rds_conn_inbound" {
		70 |   security_group_id = aws_security_group.glue_rds_conn_security_group.id
		71 | 
		72 |   referenced_security_group_id = aws_security_group.glue_rds_conn_security_group.id
		73 |   ip_protocol                  = "tcp"
		74 |   from_port                    = 0
		75 |   to_port                      = 65535
		76 |   description                  = "Required ports open for Glue-RDS-Connection"
		77 | }

Check: CKV_AWS_24: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 22"
	FAILED for resource: aws_vpc_security_group_ingress_rule.glue_rds_conn_inbound
	File: /dms_security_groups.tf:69-77
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-1-port-security

		69 | resource "aws_vpc_security_group_ingress_rule" "glue_rds_conn_inbound" {
		70 |   security_group_id = aws_security_group.glue_rds_conn_security_group.id
		71 | 
		72 |   referenced_security_group_id = aws_security_group.glue_rds_conn_security_group.id
		73 |   ip_protocol                  = "tcp"
		74 |   from_port                    = 0
		75 |   to_port                      = 65535
		76 |   description                  = "Required ports open for Glue-RDS-Connection"
		77 | }

Check: CKV_AWS_260: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 80"
	FAILED for resource: aws_vpc_security_group_ingress_rule.glue_rds_conn_inbound
	File: /dms_security_groups.tf:69-77
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-aws-security-groups-do-not-allow-ingress-from-00000-to-port-80

		69 | resource "aws_vpc_security_group_ingress_rule" "glue_rds_conn_inbound" {
		70 |   security_group_id = aws_security_group.glue_rds_conn_security_group.id
		71 | 
		72 |   referenced_security_group_id = aws_security_group.glue_rds_conn_security_group.id
		73 |   ip_protocol                  = "tcp"
		74 |   from_port                    = 0
		75 |   to_port                      = 65535
		76 |   description                  = "Required ports open for Glue-RDS-Connection"
		77 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.glue_notebook_ec2_iam_policy_document
	File: /glue_data.tf:103-118
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		103 | data "aws_iam_policy_document" "glue_notebook_ec2_iam_policy_document" {
		104 |   statement {
		105 |     effect = "Allow"
		106 |     actions = [
		107 |       "ec2:CreateNetworkInterface",
		108 |       "ec2:DescribeNetworkInterfaces",
		109 |       "ec2:DeleteNetworkInterface",
		110 |       "ec2:DescribeVpcEndpoints",
		111 |       "ec2:DescribeSubnets",
		112 |       "ec2:DescribeVpcAttribute",
		113 |       "ec2:DescribeRouteTables",
		114 |       "ec2:DescribeSecurityGroups"
		115 |     ]
		116 |     resources = ["*"]
		117 |   }
		118 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.glue_notebook_ec2_iam_policy_document
	File: /glue_data.tf:103-118
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		103 | data "aws_iam_policy_document" "glue_notebook_ec2_iam_policy_document" {
		104 |   statement {
		105 |     effect = "Allow"
		106 |     actions = [
		107 |       "ec2:CreateNetworkInterface",
		108 |       "ec2:DescribeNetworkInterfaces",
		109 |       "ec2:DeleteNetworkInterface",
		110 |       "ec2:DescribeVpcEndpoints",
		111 |       "ec2:DescribeSubnets",
		112 |       "ec2:DescribeVpcAttribute",
		113 |       "ec2:DescribeRouteTables",
		114 |       "ec2:DescribeSecurityGroups"
		115 |     ]
		116 |     resources = ["*"]
		117 |   }
		118 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.load_json_table_s3_policy_document
	File: /lambdas_iam.tf:430-487
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.load_json_table_s3_policy_document
	File: /lambdas_iam.tf:430-487
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.db_glue_connection
	File: /lambdas_secrets.tf:1-3
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		1 | resource "aws_secretsmanager_secret" "db_glue_connection" {
		2 |   name = "db_glue_connection"
		3 | }

Check: CKV_AWS_296: "Ensure DMS endpoint uses Customer Managed Key (CMK)"
	FAILED for resource: module.dms_task.aws_dms_endpoint.dms_rds_source
	File: /modules/dms/endpoints_rds_s3.tf:2-23
	Calling File: /dms_main.tf:1-39
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-296

		2  | resource "aws_dms_endpoint" "dms_rds_source" {
		3  | 
		4  |   #   certificate_arn             = ""
		5  |   database_name = var.database_name
		6  |   endpoint_id   = "rds-mssql-${replace(var.database_name, "_", "-")}-tf"
		7  |   endpoint_type = "source"
		8  |   engine_name   = "sqlserver"
		9  |   #   extra_connection_attributes = ""
		10 |   #   kms_key_arn                 = aws_db_instance.database_2022.kms_key_id
		11 |   password    = var.rds_db_instance_pasword
		12 |   port        = var.rds_db_instance_port
		13 |   server_name = var.rds_db_server_name
		14 |   ssl_mode    = "require"
		15 |   username    = var.rds_db_username
		16 | 
		17 |   tags = merge(
		18 |     var.local_tags,
		19 |     {
		20 |       Resource_Type = "DMS Source Endpoint - RDS MSSQL",
		21 |     },
		22 |   )
		23 | }

Check: CKV_AWS_298: "Ensure DMS S3 uses Customer Managed Key (CMK)"
	FAILED for resource: module.dms_task.aws_dms_s3_endpoint.dms_s3_parquet_target
	File: /modules/dms/endpoints_rds_s3.tf:28-84
	Calling File: /dms_main.tf:1-39
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-298

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:38-47
	Calling File: /step_functions_main.tf:233-243
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		38 | data "aws_iam_policy_document" "step_function_base_permissions" {
		39 |   statement {
		40 |     effect = "Allow"
		41 |     actions = [
		42 |       "sns:Publish",
		43 |       "sqs:SendMessage"
		44 |     ]
		45 |     resources = ["*"]
		46 |   }
		47 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:38-47
	Calling File: /step_functions_main.tf:233-243
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		38 | data "aws_iam_policy_document" "step_function_base_permissions" {
		39 |   statement {
		40 |     effect = "Allow"
		41 |     actions = [
		42 |       "sns:Publish",
		43 |       "sqs:SendMessage"
		44 |     ]
		45 |     resources = ["*"]
		46 |   }
		47 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:54-82
	Calling File: /step_functions_main.tf:233-243
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		54 | data "aws_iam_policy_document" "this_log_key_document" {
		55 |   statement {
		56 |     sid    = "EnableIAMUserPermissions"
		57 |     effect = "Allow"
		58 |     principals {
		59 |       type        = "AWS"
		60 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		61 |     }
		62 |     actions   = ["kms:*"]
		63 |     resources = ["*"]
		64 |   }
		65 | 
		66 |   statement {
		67 |     sid    = "EnableLogServicePermissions"
		68 |     effect = "Allow"
		69 |     principals {
		70 |       type        = "Service"
		71 |       identifiers = ["logs.eu-west-2.amazonaws.com"]
		72 |     }
		73 |     actions = [
		74 |       "kms:Encrypt*",
		75 |       "kms:Decrypt*",
		76 |       "kms:ReEncrypt*",
		77 |       "kms:GenerateDataKey*",
		78 |       "kms:Describe*",
		79 |     ]
		80 |     resources = ["*"]
		81 |   }
		82 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:54-82
	Calling File: /step_functions_main.tf:233-243
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		54 | data "aws_iam_policy_document" "this_log_key_document" {
		55 |   statement {
		56 |     sid    = "EnableIAMUserPermissions"
		57 |     effect = "Allow"
		58 |     principals {
		59 |       type        = "AWS"
		60 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		61 |     }
		62 |     actions   = ["kms:*"]
		63 |     resources = ["*"]
		64 |   }
		65 | 
		66 |   statement {
		67 |     sid    = "EnableLogServicePermissions"
		68 |     effect = "Allow"
		69 |     principals {
		70 |       type        = "Service"
		71 |       identifiers = ["logs.eu-west-2.amazonaws.com"]
		72 |     }
		73 |     actions = [
		74 |       "kms:Encrypt*",
		75 |       "kms:Decrypt*",
		76 |       "kms:ReEncrypt*",
		77 |       "kms:GenerateDataKey*",
		78 |       "kms:Describe*",
		79 |     ]
		80 |     resources = ["*"]
		81 |   }
		82 | }

Check: CKV_AWS_109: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:54-82
	Calling File: /step_functions_main.tf:233-243
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-permissions-management-resource-exposure-without-constraint

		54 | data "aws_iam_policy_document" "this_log_key_document" {
		55 |   statement {
		56 |     sid    = "EnableIAMUserPermissions"
		57 |     effect = "Allow"
		58 |     principals {
		59 |       type        = "AWS"
		60 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		61 |     }
		62 |     actions   = ["kms:*"]
		63 |     resources = ["*"]
		64 |   }
		65 | 
		66 |   statement {
		67 |     sid    = "EnableLogServicePermissions"
		68 |     effect = "Allow"
		69 |     principals {
		70 |       type        = "Service"
		71 |       identifiers = ["logs.eu-west-2.amazonaws.com"]
		72 |     }
		73 |     actions = [
		74 |       "kms:Encrypt*",
		75 |       "kms:Decrypt*",
		76 |       "kms:ReEncrypt*",
		77 |       "kms:GenerateDataKey*",
		78 |       "kms:Describe*",
		79 |     ]
		80 |     resources = ["*"]
		81 |   }
		82 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: module.get_zipped_file.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:3-7
	Calling File: /step_functions_main.tf:233-243
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		3 | resource "aws_sfn_state_machine" "this" {
		4 |   name       = var.name
		5 |   role_arn   = aws_iam_role.step_function_role.arn
		6 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		7 | }

Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: module.get_zipped_file.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:3-7
	Calling File: /step_functions_main.tf:233-243
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		3 | resource "aws_sfn_state_machine" "this" {
		4 |   name       = var.name
		5 |   role_arn   = aws_iam_role.step_function_role.arn
		6 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		7 | }

Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.db_password
	File: /server_backups.tf:4-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		4 | resource "aws_secretsmanager_secret" "db_password" {
		5 |   name = "db_password"
		6 | }

Check: CKV_AWS_157: "Ensure that RDS instances have Multi-AZ enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-73

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_118: "Ensure that enhanced monitoring is enabled for Amazon RDS instances"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/ensure-that-enhanced-monitoring-is-enabled-for-amazon-rds-instances

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_129: "Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-that-respective-logs-of-amazon-relational-database-service-amazon-rds-are-enabled

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_354: "Ensure RDS Performance Insights are encrypted using KMS CMKs"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-354

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_353: "Ensure that RDS instances have performance insights enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-353

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_293: "Ensure that AWS database instances have deletion protection enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-293

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_25: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389"
	FAILED for resource: aws_vpc_security_group_ingress_rule.db_glue_access
	File: /server_backups.tf:123-131
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-2

		123 | resource "aws_vpc_security_group_ingress_rule" "db_glue_access" {
		124 | 
		125 |   security_group_id            = aws_security_group.db.id
		126 |   description                  = "glue"
		127 |   ip_protocol                  = "tcp"
		128 |   from_port                    = 0
		129 |   to_port                      = 65535
		130 |   referenced_security_group_id = aws_security_group.db.id
		131 | }

Check: CKV_AWS_24: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 22"
	FAILED for resource: aws_vpc_security_group_ingress_rule.db_glue_access
	File: /server_backups.tf:123-131
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-1-port-security

		123 | resource "aws_vpc_security_group_ingress_rule" "db_glue_access" {
		124 | 
		125 |   security_group_id            = aws_security_group.db.id
		126 |   description                  = "glue"
		127 |   ip_protocol                  = "tcp"
		128 |   from_port                    = 0
		129 |   to_port                      = 65535
		130 |   referenced_security_group_id = aws_security_group.db.id
		131 | }

Check: CKV_AWS_260: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 80"
	FAILED for resource: aws_vpc_security_group_ingress_rule.db_glue_access
	File: /server_backups.tf:123-131
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-aws-security-groups-do-not-allow-ingress-from-00000-to-port-80

		123 | resource "aws_vpc_security_group_ingress_rule" "db_glue_access" {
		124 | 
		125 |   security_group_id            = aws_security_group.db.id
		126 |   description                  = "glue"
		127 |   ip_protocol                  = "tcp"
		128 |   from_port                    = 0
		129 |   to_port                      = 65535
		130 |   referenced_security_group_id = aws_security_group.db.id
		131 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.send_database_to_ap_athena_queries
	File: /step_functions_iam.tf:151-196
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		151 | data "aws_iam_policy_document" "send_database_to_ap_athena_queries" {
		152 |   statement {
		153 |     effect = "Allow"
		154 | 
		155 |     actions = [
		156 |       "athena:startQueryExecution",
		157 |       "athena:getQueryExecution",
		158 |       "athena:getQueryResults"
		159 |     ]
		160 | 
		161 |     resources = [
		162 |       "*"
		163 |     ]
		164 |   }
		165 |   statement {
		166 |     effect = "Allow"
		167 | 
		168 |     actions = [
		169 |       "s3:PutObject",
		170 |       "s3:GetObject",
		171 |       "s3:ListBucket",
		172 |       "s3:GetBucketLocation"
		173 |     ]
		174 | 
		175 |     resources = [
		176 |       module.s3-athena-bucket.bucket.arn,
		177 |       "${module.s3-athena-bucket.bucket.arn}/*",
		178 |       "${module.s3-dms-data-validation-bucket.bucket.arn}/*",
		179 |       module.s3-dms-data-validation-bucket.bucket.arn
		180 |     ]
		181 |   }
		182 |   statement {
		183 |     effect = "Allow"
		184 | 
		185 |     actions = [
		186 |       "glue:GetDatabase",
		187 |       "glue:GetTable",
		188 |       "glue:GetPartitions",
		189 |       "glue:GetTables"
		190 |     ]
		191 | 
		192 |     resources = [
		193 |       "*"
		194 |     ]
		195 |   }
		196 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.send_database_to_ap_athena_queries
	File: /step_functions_iam.tf:151-196
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		151 | data "aws_iam_policy_document" "send_database_to_ap_athena_queries" {
		152 |   statement {
		153 |     effect = "Allow"
		154 | 
		155 |     actions = [
		156 |       "athena:startQueryExecution",
		157 |       "athena:getQueryExecution",
		158 |       "athena:getQueryResults"
		159 |     ]
		160 | 
		161 |     resources = [
		162 |       "*"
		163 |     ]
		164 |   }
		165 |   statement {
		166 |     effect = "Allow"
		167 | 
		168 |     actions = [
		169 |       "s3:PutObject",
		170 |       "s3:GetObject",
		171 |       "s3:ListBucket",
		172 |       "s3:GetBucketLocation"
		173 |     ]
		174 | 
		175 |     resources = [
		176 |       module.s3-athena-bucket.bucket.arn,
		177 |       "${module.s3-athena-bucket.bucket.arn}/*",
		178 |       "${module.s3-dms-data-validation-bucket.bucket.arn}/*",
		179 |       module.s3-dms-data-validation-bucket.bucket.arn
		180 |     ]
		181 |   }
		182 |   statement {
		183 |     effect = "Allow"
		184 | 
		185 |     actions = [
		186 |       "glue:GetDatabase",
		187 |       "glue:GetTable",
		188 |       "glue:GetPartitions",
		189 |       "glue:GetTables"
		190 |     ]
		191 | 
		192 |     resources = [
		193 |       "*"
		194 |     ]
		195 |   }
		196 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: aws_sfn_state_machine.athena_layer
	File: /step_functions_main.tf:1-36
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		1  | resource "aws_sfn_state_machine" "athena_layer" {
		2  |   name     = "athena-layer"
		3  |   role_arn = aws_iam_role.step_functions_role.arn
		4  | 
		5  |   definition = jsonencode(
		6  |     {
		7  |       "StartAt" : "GetMetadataList",
		8  |       "States" : {
		9  |         "GetMetadataList" : {
		10 |           "Type" : "Task",
		11 |           "Resource" : "${module.get_metadata_from_rds_lambda.lambda_function_arn}",
		12 |           "ResultPath" : "$.metadata_list",
		13 |           "Next" : "LoopThroughMetadataList"
		14 |         },
		15 |         "LoopThroughMetadataList" : {
		16 |           "Type" : "Map",
		17 |           "ItemsPath" : "$.metadata_list.metadata_list",
		18 |           "MaxConcurrency" : 4,
		19 |           "Iterator" : {
		20 |             "StartAt" : "CreateAthenaTable",
		21 |             "States" : {
		22 |               "CreateAthenaTable" : {
		23 |                 "Type" : "Task",
		24 |                 "Resource" : "${module.create_athena_table.lambda_function_arn}",
		25 |                 "ResultPath" : "$.result",
		26 |                 "End" : true
		27 |               }
		28 |             }
		29 |           },
		30 |           "End" : true
		31 |         }
		32 |       }
		33 |     }
		34 |   )
		35 | 
		36 | }

Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: aws_sfn_state_machine.athena_layer
	File: /step_functions_main.tf:1-36
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		1  | resource "aws_sfn_state_machine" "athena_layer" {
		2  |   name     = "athena-layer"
		3  |   role_arn = aws_iam_role.step_functions_role.arn
		4  | 
		5  |   definition = jsonencode(
		6  |     {
		7  |       "StartAt" : "GetMetadataList",
		8  |       "States" : {
		9  |         "GetMetadataList" : {
		10 |           "Type" : "Task",
		11 |           "Resource" : "${module.get_metadata_from_rds_lambda.lambda_function_arn}",
		12 |           "ResultPath" : "$.metadata_list",
		13 |           "Next" : "LoopThroughMetadataList"
		14 |         },
		15 |         "LoopThroughMetadataList" : {
		16 |           "Type" : "Map",
		17 |           "ItemsPath" : "$.metadata_list.metadata_list",
		18 |           "MaxConcurrency" : 4,
		19 |           "Iterator" : {
		20 |             "StartAt" : "CreateAthenaTable",
		21 |             "States" : {
		22 |               "CreateAthenaTable" : {
		23 |                 "Type" : "Task",
		24 |                 "Resource" : "${module.create_athena_table.lambda_function_arn}",
		25 |                 "ResultPath" : "$.result",
		26 |                 "End" : true
		27 |               }
		28 |             }
		29 |           },
		30 |           "End" : true
		31 |         }
		32 |       }
		33 |     }
		34 |   )
		35 | 
		36 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: aws_sfn_state_machine.send_database_to_ap
	File: /step_functions_main.tf:85-171
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: aws_sfn_state_machine.send_database_to_ap
	File: /step_functions_main.tf:85-171
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_18: "Ensure the S3 bucket has access logging enabled"
	FAILED for resource: aws_s3_bucket.data_store
	File: /s3.tf:1061-1080
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-13-enable-logging

		1061 | resource "aws_s3_bucket" "data_store" {
		1062 |   #checkov:skip:CKV_AWS_145
		1063 |   #checkov:skip:CKV_AWS_144
		1064 |   #checkov:skip:CKV_AWS_21
		1065 |   #checkov:skip:CKV2_AWS_65
		1066 |   #checkov:skip:CKV2_AWS_62
		1067 |   #checkov:skip:CKV_AWS_18
		1068 |   #checkov:skip:CKV2_AWS_61
		1069 |   bucket_prefix = "em-data-store-"
		1070 |   force_destroy = false
		1071 |   tags = {
		1072 |     "application"            = "electronic-monitoring-data"
		1073 |     "business-unit"          = "HMPPS"
		1074 |     "environment-name"       = "electronic-monitoring-data-production"
		1075 |     "infrastructure-support" = "dataengineering@digital.justice.gov.uk"
		1076 |     "is-production"          = "true"
		1077 |     "owner"                  = "Data engineering: dataengineering@digital.justice.gov.uk"
		1078 |     "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
		1079 |   }
		1080 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: aws_security_group.glue_rds_conn_security_group
	File: /dms_security_groups.tf:46-57
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		46 | resource "aws_security_group" "glue_rds_conn_security_group" {
		47 |   name        = "glue-rds-sqlserver-connection-tf"
		48 |   description = "Secuity Group for Glue-RDS-Connection"
		49 |   vpc_id      = data.aws_vpc.shared.id
		50 | 
		51 |   tags = merge(
		52 |     local.tags,
		53 |     {
		54 |       Resource_Type = "Secuity Group for Glue-RDS-Connection",
		55 |     }
		56 |   )
		57 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: module.buddi.module.landing_zone_security_groups.aws_security_group.this
	File: /modules/landing_zone/server_security_group/main.tf:7-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		7  | resource "aws_security_group" "this" {
		8  |   name        = "${var.supplier}-${var.user_name}-inbound-ips"
		9  |   description = "Allowed IP addresses for ${var.user_name} on ${var.supplier} server"
		10 |   vpc_id      = var.vpc_id
		11 | 
		12 |   lifecycle {
		13 |     create_before_destroy = true
		14 |   }
		15 | 
		16 |   tags = merge(
		17 |     var.local_tags,
		18 |     {
		19 |       supplier = var.user_name,
		20 |     },
		21 |   )
		22 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: module.capita.module.landing_zone_security_groups.aws_security_group.this
	File: /modules/landing_zone/server_security_group/main.tf:7-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		7  | resource "aws_security_group" "this" {
		8  |   name        = "${var.supplier}-${var.user_name}-inbound-ips"
		9  |   description = "Allowed IP addresses for ${var.user_name} on ${var.supplier} server"
		10 |   vpc_id      = var.vpc_id
		11 | 
		12 |   lifecycle {
		13 |     create_before_destroy = true
		14 |   }
		15 | 
		16 |   tags = merge(
		17 |     var.local_tags,
		18 |     {
		19 |       supplier = var.user_name,
		20 |     },
		21 |   )
		22 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: module.g4s.module.landing_zone_security_groups.aws_security_group.this
	File: /modules/landing_zone/server_security_group/main.tf:7-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		7  | resource "aws_security_group" "this" {
		8  |   name        = "${var.supplier}-${var.user_name}-inbound-ips"
		9  |   description = "Allowed IP addresses for ${var.user_name} on ${var.supplier} server"
		10 |   vpc_id      = var.vpc_id
		11 | 
		12 |   lifecycle {
		13 |     create_before_destroy = true
		14 |   }
		15 | 
		16 |   tags = merge(
		17 |     var.local_tags,
		18 |     {
		19 |       supplier = var.user_name,
		20 |     },
		21 |   )
		22 | }

Check: CKV2_AWS_61: "Ensure that an S3 bucket has a lifecycle configuration"
	FAILED for resource: aws_s3_bucket.data_store
	File: /s3.tf:1061-1080
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-2-61

		1061 | resource "aws_s3_bucket" "data_store" {
		1062 |   #checkov:skip:CKV_AWS_145
		1063 |   #checkov:skip:CKV_AWS_144
		1064 |   #checkov:skip:CKV_AWS_21
		1065 |   #checkov:skip:CKV2_AWS_65
		1066 |   #checkov:skip:CKV2_AWS_62
		1067 |   #checkov:skip:CKV_AWS_18
		1068 |   #checkov:skip:CKV2_AWS_61
		1069 |   bucket_prefix = "em-data-store-"
		1070 |   force_destroy = false
		1071 |   tags = {
		1072 |     "application"            = "electronic-monitoring-data"
		1073 |     "business-unit"          = "HMPPS"
		1074 |     "environment-name"       = "electronic-monitoring-data-production"
		1075 |     "infrastructure-support" = "dataengineering@digital.justice.gov.uk"
		1076 |     "is-production"          = "true"
		1077 |     "owner"                  = "Data engineering: dataengineering@digital.justice.gov.uk"
		1078 |     "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
		1079 |   }
		1080 | }

Check: CKV_AWS_144: "Ensure that S3 bucket has cross-region replication enabled"
	FAILED for resource: aws_s3_bucket.data_store
	File: /s3.tf:1061-1080
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-s3-bucket-has-cross-region-replication-enabled

		1061 | resource "aws_s3_bucket" "data_store" {
		1062 |   #checkov:skip:CKV_AWS_145
		1063 |   #checkov:skip:CKV_AWS_144
		1064 |   #checkov:skip:CKV_AWS_21
		1065 |   #checkov:skip:CKV2_AWS_65
		1066 |   #checkov:skip:CKV2_AWS_62
		1067 |   #checkov:skip:CKV_AWS_18
		1068 |   #checkov:skip:CKV2_AWS_61
		1069 |   bucket_prefix = "em-data-store-"
		1070 |   force_destroy = false
		1071 |   tags = {
		1072 |     "application"            = "electronic-monitoring-data"
		1073 |     "business-unit"          = "HMPPS"
		1074 |     "environment-name"       = "electronic-monitoring-data-production"
		1075 |     "infrastructure-support" = "dataengineering@digital.justice.gov.uk"
		1076 |     "is-production"          = "true"
		1077 |     "owner"                  = "Data engineering: dataengineering@digital.justice.gov.uk"
		1078 |     "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
		1079 |   }
		1080 | }

Check: CKV2_AWS_65: "Ensure access control lists for S3 buckets are disabled"
	FAILED for resource: aws_s3_bucket_ownership_controls.bucket
	File: /s3.tf:1090-1095
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-general-112

		1090 | resource "aws_s3_bucket_ownership_controls" "bucket" {
		1091 |   bucket = aws_s3_bucket.data_store.id
		1092 |   rule {
		1093 |     object_ownership = "ObjectWriter"
		1094 |   }
		1095 | }

Check: CKV_AWS_145: "Ensure that S3 buckets are encrypted with KMS by default"
	FAILED for resource: aws_s3_bucket.data_store
	File: /s3.tf:1061-1080
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-s3-buckets-are-encrypted-with-kms-by-default

		1061 | resource "aws_s3_bucket" "data_store" {
		1062 |   #checkov:skip:CKV_AWS_145
		1063 |   #checkov:skip:CKV_AWS_144
		1064 |   #checkov:skip:CKV_AWS_21
		1065 |   #checkov:skip:CKV2_AWS_65
		1066 |   #checkov:skip:CKV2_AWS_62
		1067 |   #checkov:skip:CKV_AWS_18
		1068 |   #checkov:skip:CKV2_AWS_61
		1069 |   bucket_prefix = "em-data-store-"
		1070 |   force_destroy = false
		1071 |   tags = {
		1072 |     "application"            = "electronic-monitoring-data"
		1073 |     "business-unit"          = "HMPPS"
		1074 |     "environment-name"       = "electronic-monitoring-data-production"
		1075 |     "infrastructure-support" = "dataengineering@digital.justice.gov.uk"
		1076 |     "is-production"          = "true"
		1077 |     "owner"                  = "Data engineering: dataengineering@digital.justice.gov.uk"
		1078 |     "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
		1079 |   }
		1080 | }

Check: CKV2_AWS_60: "Ensure RDS instance with copy tags to snapshots is enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-60

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV2_AWS_62: "Ensure S3 buckets should have event notifications enabled"
	FAILED for resource: aws_s3_bucket.data_store
	File: /s3.tf:1061-1080
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-2-62

		1061 | resource "aws_s3_bucket" "data_store" {
		1062 |   #checkov:skip:CKV_AWS_145
		1063 |   #checkov:skip:CKV_AWS_144
		1064 |   #checkov:skip:CKV_AWS_21
		1065 |   #checkov:skip:CKV2_AWS_65
		1066 |   #checkov:skip:CKV2_AWS_62
		1067 |   #checkov:skip:CKV_AWS_18
		1068 |   #checkov:skip:CKV2_AWS_61
		1069 |   bucket_prefix = "em-data-store-"
		1070 |   force_destroy = false
		1071 |   tags = {
		1072 |     "application"            = "electronic-monitoring-data"
		1073 |     "business-unit"          = "HMPPS"
		1074 |     "environment-name"       = "electronic-monitoring-data-production"
		1075 |     "infrastructure-support" = "dataengineering@digital.justice.gov.uk"
		1076 |     "is-production"          = "true"
		1077 |     "owner"                  = "Data engineering: dataengineering@digital.justice.gov.uk"
		1078 |     "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
		1079 |   }
		1080 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.db_glue_connection
	File: /lambdas_secrets.tf:1-3
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		1 | resource "aws_secretsmanager_secret" "db_glue_connection" {
		2 |   name = "db_glue_connection"
		3 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.db_password
	File: /server_backups.tf:4-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		4 | resource "aws_secretsmanager_secret" "db_password" {
		5 |   name = "db_password"
		6 | }

Check: CKV_AWS_21: "Ensure all data stored in the S3 bucket have versioning enabled"
	FAILED for resource: aws_s3_bucket.data_store
	File: /s3.tf:1061-1080
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-16-enable-versioning

		1061 | resource "aws_s3_bucket" "data_store" {
		1062 |   #checkov:skip:CKV_AWS_145
		1063 |   #checkov:skip:CKV_AWS_144
		1064 |   #checkov:skip:CKV_AWS_21
		1065 |   #checkov:skip:CKV2_AWS_65
		1066 |   #checkov:skip:CKV2_AWS_62
		1067 |   #checkov:skip:CKV_AWS_18
		1068 |   #checkov:skip:CKV2_AWS_61
		1069 |   bucket_prefix = "em-data-store-"
		1070 |   force_destroy = false
		1071 |   tags = {
		1072 |     "application"            = "electronic-monitoring-data"
		1073 |     "business-unit"          = "HMPPS"
		1074 |     "environment-name"       = "electronic-monitoring-data-production"
		1075 |     "infrastructure-support" = "dataengineering@digital.justice.gov.uk"
		1076 |     "is-production"          = "true"
		1077 |     "owner"                  = "Data engineering: dataengineering@digital.justice.gov.uk"
		1078 |     "source-code"            = "https://github.com/ministryofjustice/modernisation-platform-environments"
		1079 |   }
		1080 | }

dockerfile scan results:

Passed checks: 21, Failed checks: 2, Skipped checks: 0

Check: CKV_DOCKER_2: "Ensure that HEALTHCHECK instructions have been added to container images"
	FAILED for resource: /lambdas/update_log_table/Dockerfile.
	File: /lambdas/update_log_table/Dockerfile:1-9
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/docker-policies/docker-policy-index/ensure-that-healthcheck-instructions-have-been-added-to-container-images

		1 | FROM public.ecr.aws/lambda/python:3.11
		2 | 
		3 | COPY requirements.txt .
		4 | 
		5 | RUN pip install -r requirements.txt --target "${LAMBDA_TASK_ROOT}"
		6 | 
		7 | COPY update_log_table.py ${LAMBDA_TASK_ROOT}
		8 | 
		9 | CMD ["update_log_table.handler"]

Check: CKV_DOCKER_3: "Ensure that a user for the container has been created"
	FAILED for resource: /lambdas/update_log_table/Dockerfile.
	File: /lambdas/update_log_table/Dockerfile:1-9
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/docker-policies/docker-policy-index/ensure-that-a-user-for-the-container-has-been-created

		1 | FROM public.ecr.aws/lambda/python:3.11
		2 | 
		3 | COPY requirements.txt .
		4 | 
		5 | RUN pip install -r requirements.txt --target "${LAMBDA_TASK_ROOT}"
		6 | 
		7 | COPY update_log_table.py ${LAMBDA_TASK_ROOT}
		8 | 
		9 | CMD ["update_log_table.handler"]


checkov_exitcode=1

CTFLint Scan Failed

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
terraform/environments/electronic-monitoring-data

*****************************

Running tflint in terraform/environments/electronic-monitoring-data
Excluding the following checks: terraform_unused_declarations
11 issue(s) found:

Warning: `s3_pylib_dir_path` variable has no type (terraform_typed_variables)

  on terraform/environments/electronic-monitoring-data/glue_variables.tf line 1:
   1: variable "s3_pylib_dir_path" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_typed_variables.md

Warning: Missing version constraint for provider "archive" in `required_providers` (terraform_required_providers)

  on terraform/environments/electronic-monitoring-data/lambdas_main.tf line 189:
 189: data "archive_file" "query_output_to_list" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

Warning: Missing version constraint for provider "random" in `required_providers` (terraform_required_providers)

  on terraform/environments/electronic-monitoring-data/server_backups.tf line 13:
  13: resource "random_password" "random_password" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 11:
  11:           "Resource" : "${module.get_metadata_from_rds_lambda.lambda_function_arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 24:
  24:                 "Resource" : "${module.create_athena_table.lambda_function_arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 98:
  98:             "WorkGroup" : "${aws_athena_workgroup.default.name}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 114:
 114:           "Resource" : "${module.query_output_to_list.lambda_function_arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 127:
 127:                 "Resource" : "${module.get_file_keys_for_table.lambda_function_arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 141:
 141:                       "Resource" : "${module.send_table_to_ap.lambda_function_arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 152:
 152:                 "Resource" : "${module.update_log_table.lambda_function_arn}",

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on terraform/environments/electronic-monitoring-data/step_functions_main.tf line 164:
 164:             "WorkGroup" : "${aws_athena_workgroup.default.name}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

tflint_exitcode=2

Trivy Scan Failed

Show Output

*****************************

Trivy will check the following folders:
terraform/environments/electronic-monitoring-data

*****************************

Running Trivy in terraform/environments/electronic-monitoring-data
2024-10-14T19:02:06Z	INFO	[vulndb] Need to update DB
2024-10-14T19:02:06Z	INFO	[vulndb] Downloading vulnerability DB...
2024-10-14T19:02:06Z	INFO	[vulndb] Downloading artifact...	repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-14T19:02:08Z	INFO	[vulndb] Artifact successfully downloaded	repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-14T19:02:08Z	INFO	[vuln] Vulnerability scanning is enabled
2024-10-14T19:02:08Z	INFO	[misconfig] Misconfiguration scanning is enabled
2024-10-14T19:02:08Z	INFO	[misconfig] Need to update the built-in checks
2024-10-14T19:02:08Z	INFO	[misconfig] Downloading the built-in checks...
156.02 KiB / 156.02 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2024-10-14T19:02:09Z	INFO	[secret] Secret scanning is enabled
2024-10-14T19:02:09Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-14T19:02:09Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-10-14T19:02:09Z	WARN	[pip] Unable to find python `site-packages` directory. License detection is skipped.	err="site-packages directory not found"
2024-10-14T19:02:10Z	INFO	[terraform scanner] Scanning root module	file_path="."
2024-10-14T19:02:10Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="networking"
2024-10-14T19:02:11Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T19:02:11Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T19:02:11Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T19:02:11Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T19:02:11Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T19:02:11Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T19:02:11Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T19:02:11Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.aws_s3_object.user_public_keys" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.data.aws_subnet.local_account" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-14T19:02:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-14T19:02:18Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-versioning" range="s3.tf:1061-1080"
2024-10-14T19:02:18Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-bucket-encryption" range="s3.tf:1061-1080"
2024-10-14T19:02:18Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-logging" range="s3.tf:1061-1080"
2024-10-14T19:02:18Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T19:02:18Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T19:02:18Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T19:02:18Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T19:02:18Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T19:02:18Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T19:02:18Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T19:02:18Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T19:02:18Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T19:02:18Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T19:02:18Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-14T19:02:18Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=95ed3c3/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=568694e50e03630d99cb569eafa06a0b879a1239/main.tf:171-179"
2024-10-14T19:02:18Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="s3.tf:1061-1080"
2024-10-14T19:02:18Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-14T19:02:18Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-14T19:02:18Z	INFO	[terraform executor] Ignore finding	rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:281-286"
2024-10-14T19:02:18Z	INFO	[terraform executor] Ignore finding	rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:407-411"
2024-10-14T19:02:18Z	INFO	Number of language-specific files	num=1
2024-10-14T19:02:18Z	INFO	[pip] Detecting vulnerabilities...
2024-10-14T19:02:18Z	INFO	Detected config files	num=17

data_store.tf (terraform)
=========================
Tests: 1 (SUCCESSES: 0, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Topic does not have encryption enabled.
════════════════════════════════════════
Topics should be encrypted to protect their contents.


See https://avd.aquasec.com/misconfig/avd-aws-0095
────────────────────────────────────────
 data_store.tf:17-19
────────────────────────────────────────
  17 ┌ resource "aws_sns_topic" "s3_events" {
  18 │   name = "${module.s3-data-bucket.bucket.id}-object-created-topic"
  19 └ }
────────────────────────────────────────



lambdas/update_log_table/Dockerfile (dockerfile)
================================================
Tests: 20 (SUCCESSES: 19, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Specify at least 1 USER command in Dockerfile with non-root user as argument
════════════════════════════════════════
Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

See https://avd.aquasec.com/misconfig/ds002
────────────────────────────────────────


trivy_exitcode=1

[github-actions]

Trivy Scan Failed

Show Output

```hcl

---

Trivy will check the following folders:
terraform/environments/electronic-monitoring-data

---

Running Trivy in terraform/environments/electronic-monitoring-data
2024-10-16T19:14:31Z INFO [vulndb] Need to update DB
2024-10-16T19:14:31Z INFO [vulndb] Downloading vulnerability DB...
2024-10-16T19:14:31Z INFO [vulndb] Downloading artifact... repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-16T19:14:33Z INFO [vulndb] Artifact successfully downloaded repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-16T19:14:33Z INFO [vuln] Vulnerability scanning is enabled
2024-10-16T19:14:33Z INFO [misconfig] Misconfiguration scanning is enabled
2024-10-16T19:14:33Z INFO [misconfig] Need to update the built-in checks
2024-10-16T19:14:33Z INFO [misconfig] Downloading the built-in checks...
156.02 KiB / 156.02 KiB [---------------------------------------------------------] 100.00% ? p/s 0s2024-10-16T19:14:34Z INFO [secret] Secret scanning is enabled
2024-10-16T19:14:34Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-16T19:14:34Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-10-16T19:14:35Z WARN [pip] Unable to find python site-packages directory. License detection is skipped. err="site-packages directory not found"
2024-10-16T19:14:36Z INFO [terraform scanner] Scanning root module file_path="."
2024-10-16T19:14:36Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="networking"
2024-10-16T19:14:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-16T19:14:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-16T19:14:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-16T19:14:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-16T19:14:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-16T19:14:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-16T19:14:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-16T19:14:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-16T19:14:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-16T19:14:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-16T19:14:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.aws_s3_object.user_public_keys" value="cty.NilVal"
2024-10-16T19:14:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.data.aws_subnet.local_account" value="cty.NilVal"
2024-10-16T19:14:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-16T19:14:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-16T19:14:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-16T19:14:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-16T19:14:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-16T19:14:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-16T19:14:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-16T19:14:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-16T19:14:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-16T19:14:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-16T19:14:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-16T19:14:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-16T19:14:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-16T19:14:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-16T19:14:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-16T19:14:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-16T19:14:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-16T19:14:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-16T19:14:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-16T19:14:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-16T19:14:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-16T19:14:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-16T19:14:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-16T19:14:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-16T19:14:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-16T19:14:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-16T19:14:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-16T19:14:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-16T19:14:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-16T19:14:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-16T19:14:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-16T19:14:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-16T19:14:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-16T19:14:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-16T19:14:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-16T19:14:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-16T19:14:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-16T19:14:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-16T19:14:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-16T19:14:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-16T19:14:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-16T19:14:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-16T19:14:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.transition" value="cty.NilVal"
2024-10-16T19:14:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-16T19:14:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-16T19:14:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.principals" value="cty.NilVal"
2024-10-16T19:14:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.condition" value="cty.NilVal"
2024-10-16T19:14:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-16T19:14:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.transition" value="cty.NilVal"
2024-10-16T19:14:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-16T19:14:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-16T19:14:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.principals" value="cty.NilVal"
2024-10-16T19:14:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.condition" value="cty.NilVal"
2024-10-16T19:14:45Z INFO [terraform executor] Ignore finding rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:281-286"
2024-10-16T19:14:45Z INFO [terraform executor] Ignore finding rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:407-411"
2024-10-16T19:14:45Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-bucket-encryption" range="s3.tf:1061-1080"
2024-10-16T19:14:45Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-16T19:14:45Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-16T19:14:45Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-16T19:14:45Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-16T19:14:45Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-16T19:14:45Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-16T19:14:45Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-16T19:14:45Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-16T19:14:45Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-16T19:14:45Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-16T19:14:45Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-16T19:14:45Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-16T19:14:45Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-16T19:14:45Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=95ed3c3/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=568694e50e03630d99cb569eafa06a0b879a1239/main.tf:171-179"
2024-10-16T19:14:45Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="s3.tf:1061-1080"
2024-10-16T19:14:45Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-versioning" range="s3.tf:1061-1080"
2024-10-16T19:14:45Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-logging" range="s3.tf:1061-1080"
2024-10-16T19:14:45Z INFO Number of language-specific files num=1
2024-10-16T19:14:45Z INFO [pip] Detecting vulnerabilities...
2024-10-16T19:14:45Z INFO Detected config files num=16

lambdas/update_log_table/Dockerfile (dockerfile)

Tests: 20 (SUCCESSES: 19, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Specify at least 1 USER command in Dockerfile with non-root user as argument
════════════════════════════════════════
Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

See https://avd.aquasec.com/misconfig/ds002
────────────────────────────────────────

trivy_exitcode=1

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/electronic-monitoring-data

*****************************

Running Checkov in terraform/environments/electronic-monitoring-data
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2024-10-16 19:14:48,009 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=95ed3c3:None (for external modules, the --download-external-modules flag is required)
2024-10-16 19:14:48,009 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060:None (for external modules, the --download-external-modules flag is required)
2024-10-16 19:14:48,009 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/secrets-manager/aws:1.3.0 (for external modules, the --download-external-modules flag is required)
2024-10-16 19:14:48,010 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=52a40b0:None (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 2275, Failed checks: 72, Skipped checks: 34

Check: CKV_AWS_26: "Ensure all data stored in the SNS topic is encrypted"
	FAILED for resource: aws_sns_topic.s3_events
	File: /data_store.tf:17-19
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-15

		17 | resource "aws_sns_topic" "s3_events" {
		18 |   name = "${module.s3-data-bucket.bucket.id}-object-created-topic"
		19 | }

Check: CKV_AWS_115: "Ensure that AWS Lambda function is configured for function-level concurrent execution limit"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-function-level-concurrent-execution-limit

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_173: "Check encryption settings for Lambda environmental variable"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-5

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_116: "Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-a-dead-letter-queue-dlq

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_272: "Ensure AWS Lambda function is configured to validate code-signing"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-272

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_117: "Ensure that AWS Lambda function is configured inside a VPC"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-inside-a-vpc-1

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_115: "Ensure that AWS Lambda function is configured for function-level concurrent execution limit"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-function-level-concurrent-execution-limit

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_116: "Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-a-dead-letter-queue-dlq

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_272: "Ensure AWS Lambda function is configured to validate code-signing"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-272

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_117: "Ensure that AWS Lambda function is configured inside a VPC"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-inside-a-vpc-1

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group
	File: /dms_data_validation_glue_job.tf:65-68
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		65 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group" {
		66 |   name              = "dms-dv-glue-job"
		67 |   retention_in_days = 14
		68 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group
	File: /dms_data_validation_glue_job.tf:65-68
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		65 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group" {
		66 |   name              = "dms-dv-glue-job"
		67 |   retention_in_days = 14
		68 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group_v2
	File: /dms_data_validation_glue_job.tf:70-73
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		70 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group_v2" {
		71 |   name              = "dms-dv-glue-job-v2"
		72 |   retention_in_days = 14
		73 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group_v2
	File: /dms_data_validation_glue_job.tf:70-73
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		70 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group_v2" {
		71 |   name              = "dms-dv-glue-job-v2"
		72 |   retention_in_days = 14
		73 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.rds_to_s3_parquet_migration
	File: /dms_data_validation_glue_job.tf:75-78
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		75 | resource "aws_cloudwatch_log_group" "rds_to_s3_parquet_migration" {
		76 |   name              = "rds-to-s3-parquet-migration"
		77 |   retention_in_days = 14
		78 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.rds_to_s3_parquet_migration
	File: /dms_data_validation_glue_job.tf:75-78
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		75 | resource "aws_cloudwatch_log_group" "rds_to_s3_parquet_migration" {
		76 |   name              = "rds-to-s3-parquet-migration"
		77 |   retention_in_days = 14
		78 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.resizing_parquet_files
	File: /dms_data_validation_glue_job.tf:80-83
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		80 | resource "aws_cloudwatch_log_group" "resizing_parquet_files" {
		81 |   name              = "resizing-parquet-files"
		82 |   retention_in_days = 14
		83 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.resizing_parquet_files
	File: /dms_data_validation_glue_job.tf:80-83
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		80 | resource "aws_cloudwatch_log_group" "resizing_parquet_files" {
		81 |   name              = "resizing-parquet-files"
		82 |   retention_in_days = 14
		83 | }

Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.dms_dv_glue_job_v2
	File: /dms_data_validation_glue_job.tf:86-140
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.dms_dv_glue_job_v4d
	File: /dms_data_validation_glue_job.tf:148-201
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.rds_to_s3_parquet_migration
	File: /dms_data_validation_glue_job.tf:204-268
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.rds_to_s3_parquet_migration_monthly
	File: /dms_data_validation_glue_job.tf:272-326
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.resizing_parquet_files
	File: /dms_data_validation_glue_job.tf:329-381
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.catalog_dv_table_glue_job
	File: /dms_data_validation_glue_job.tf:384-412
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		384 | resource "aws_glue_job" "catalog_dv_table_glue_job" {
		385 |   name              = "catalog-dv-table-glue-job"
		386 |   description       = "Python script uses Boto3-Athena-Client to run sql-statements"
		387 |   role_arn          = aws_iam_role.dms_dv_glue_job_iam_role.arn
		388 |   glue_version      = "4.0"
		389 |   worker_type       = "G.1X"
		390 |   number_of_workers = 2
		391 |   default_arguments = {
		392 |     "--parquet_output_bucket_name"       = module.s3-dms-data-validation-bucket.bucket.id
		393 |     "--glue_catalog_db_name"             = aws_glue_catalog_database.dms_dv_glue_catalog_db.name
		394 |     "--glue_catalog_tbl_name"            = "glue_df_output"
		395 |     "--continuous-log-logGroup"          = aws_cloudwatch_log_group.dms_dv_cw_log_group.name
		396 |     "--enable-continuous-cloudwatch-log" = "true"
		397 |     "--enable-continuous-log-filter"     = "true"
		398 |     "--enable-metrics"                   = ""
		399 |   }
		400 |   command {
		401 |     python_version  = "3"
		402 |     script_location = "s3://${module.s3-glue-job-script-bucket.bucket.id}/create_or_replace_dv_table.py"
		403 |   }
		404 | 
		405 |   tags = merge(
		406 |     local.tags,
		407 |     {
		408 |       Resource_Type = "Py script as glue-job that creates dv table / refreshes its partitions",
		409 |     }
		410 |   )
		411 | 
		412 | }

Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_crawler.rds_sqlserver_db_glue_crawler
	File: /dms_glue_crawler.tf:35-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		35 | resource "aws_glue_crawler" "rds_sqlserver_db_glue_crawler" {
		36 |   name          = "rds-sqlserver-${aws_db_instance.database_2022.identifier}-tf"
		37 |   role          = aws_iam_role.dms_dv_glue_job_iam_role.arn
		38 |   database_name = aws_glue_catalog_database.rds_sqlserver_glue_catalog_db.name
		39 |   description   = "Crawler to fetch database names"
		40 |   #   table_prefix  = "your_table_prefix"
		41 | 
		42 |   jdbc_target {
		43 |     connection_name = aws_glue_connection.glue_rds_sqlserver_db_connection.name
		44 |     path            = "%"
		45 |   }
		46 |   tags = merge(
		47 |     local.tags,
		48 |     {
		49 |       Resource_Type = "RDS-SQLServer Glue-Crawler for DMS",
		50 |     }
		51 |   )
		52 | 
		53 |   # provisioner "local-exec" {
		54 |   #   command = "aws glue start-crawler --name ${self.name}"
		55 |   # }
		56 | }

Check: CKV_AWS_212: "Ensure DMS replication instance is encrypted by KMS using a customer managed Key (CMK)"
	FAILED for resource: aws_dms_replication_instance.dms_replication_instance
	File: /dms_replication_instance.tf:24-55
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-ebs-volume-is-encrypted-by-key-management-service-kms-using-a-customer-managed-key-cmk

		24 | resource "aws_dms_replication_instance" "dms_replication_instance" {
		25 |   allocated_storage          = var.dms_allocated_storage_gib
		26 |   apply_immediately          = true
		27 |   auto_minor_version_upgrade = true
		28 |   availability_zone          = var.dms_availability_zone
		29 |   engine_version             = var.dms_engine_version
		30 |   #   kms_key_arn                  = "arn:aws:kms:eu-west-2:800964199911:key/b7f54acb-16a3-4958-9340-3bdf5f5842d8"
		31 |   multi_az = false
		32 |   #   preferred_maintenance_window = "sun:10:30-sun:14:30"
		33 |   publicly_accessible         = false
		34 |   replication_instance_class  = var.dms_replication_instance_class
		35 |   replication_instance_id     = "dms-replication-instance-tf"
		36 |   replication_subnet_group_id = aws_dms_replication_subnet_group.dms_replication_subnet_group.id
		37 | 
		38 |   tags = merge(
		39 |     local.tags,
		40 |     {
		41 |       Resource_Type = "DMS Replication Instance",
		42 |     }
		43 |   )
		44 | 
		45 |   vpc_security_group_ids = [
		46 |     aws_security_group.dms_ri_security_group.id,
		47 |   ]
		48 | 
		49 |   depends_on = [
		50 |     aws_iam_role.dms_vpc_role,
		51 |     aws_iam_role.dms_cloudwatch_logs_role,
		52 |     aws_iam_role.dms_endpoint_role
		53 |   ]
		54 | 
		55 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.glue_notebook_ec2_iam_policy_document
	File: /glue_data.tf:103-118
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		103 | data "aws_iam_policy_document" "glue_notebook_ec2_iam_policy_document" {
		104 |   statement {
		105 |     effect = "Allow"
		106 |     actions = [
		107 |       "ec2:CreateNetworkInterface",
		108 |       "ec2:DescribeNetworkInterfaces",
		109 |       "ec2:DeleteNetworkInterface",
		110 |       "ec2:DescribeVpcEndpoints",
		111 |       "ec2:DescribeSubnets",
		112 |       "ec2:DescribeVpcAttribute",
		113 |       "ec2:DescribeRouteTables",
		114 |       "ec2:DescribeSecurityGroups"
		115 |     ]
		116 |     resources = ["*"]
		117 |   }
		118 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.glue_notebook_ec2_iam_policy_document
	File: /glue_data.tf:103-118
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		103 | data "aws_iam_policy_document" "glue_notebook_ec2_iam_policy_document" {
		104 |   statement {
		105 |     effect = "Allow"
		106 |     actions = [
		107 |       "ec2:CreateNetworkInterface",
		108 |       "ec2:DescribeNetworkInterfaces",
		109 |       "ec2:DeleteNetworkInterface",
		110 |       "ec2:DescribeVpcEndpoints",
		111 |       "ec2:DescribeSubnets",
		112 |       "ec2:DescribeVpcAttribute",
		113 |       "ec2:DescribeRouteTables",
		114 |       "ec2:DescribeSecurityGroups"
		115 |     ]
		116 |     resources = ["*"]
		117 |   }
		118 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.load_json_table_s3_policy_document
	File: /lambdas_iam.tf:430-487
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.load_json_table_s3_policy_document
	File: /lambdas_iam.tf:430-487
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.db_glue_connection
	File: /lambdas_secrets.tf:1-3
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		1 | resource "aws_secretsmanager_secret" "db_glue_connection" {
		2 |   name = "db_glue_connection"
		3 | }

Check: CKV_AWS_296: "Ensure DMS endpoint uses Customer Managed Key (CMK)"
	FAILED for resource: module.dms_task.aws_dms_endpoint.dms_rds_source
	File: /modules/dms/endpoints_rds_s3.tf:2-23
	Calling File: /dms_main.tf:1-39
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-296

		2  | resource "aws_dms_endpoint" "dms_rds_source" {
		3  | 
		4  |   #   certificate_arn             = ""
		5  |   database_name = var.database_name
		6  |   endpoint_id   = "rds-mssql-${replace(var.database_name, "_", "-")}-tf"
		7  |   endpoint_type = "source"
		8  |   engine_name   = "sqlserver"
		9  |   #   extra_connection_attributes = ""
		10 |   #   kms_key_arn                 = aws_db_instance.database_2022.kms_key_id
		11 |   password    = var.rds_db_instance_pasword
		12 |   port        = var.rds_db_instance_port
		13 |   server_name = var.rds_db_server_name
		14 |   ssl_mode    = "require"
		15 |   username    = var.rds_db_username
		16 | 
		17 |   tags = merge(
		18 |     var.local_tags,
		19 |     {
		20 |       Resource_Type = "DMS Source Endpoint - RDS MSSQL",
		21 |     },
		22 |   )
		23 | }

Check: CKV_AWS_298: "Ensure DMS S3 uses Customer Managed Key (CMK)"
	FAILED for resource: module.dms_task.aws_dms_s3_endpoint.dms_s3_parquet_target
	File: /modules/dms/endpoints_rds_s3.tf:28-84
	Calling File: /dms_main.tf:1-39
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-298

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: module.athena_layer.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-8
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: module.athena_layer.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-8
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.athena_layer.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:39-48
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		39 | data "aws_iam_policy_document" "step_function_base_permissions" {
		40 |   statement {
		41 |     effect = "Allow"
		42 |     actions = [
		43 |       "sns:Publish",
		44 |       "sqs:SendMessage"
		45 |     ]
		46 |     resources = ["*"]
		47 |   }
		48 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.athena_layer.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:39-48
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		39 | data "aws_iam_policy_document" "step_function_base_permissions" {
		40 |   statement {
		41 |     effect = "Allow"
		42 |     actions = [
		43 |       "sns:Publish",
		44 |       "sqs:SendMessage"
		45 |     ]
		46 |     resources = ["*"]
		47 |   }
		48 | }

Check: CKV_AWS_109: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: module.athena_layer.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:55-79
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-permissions-management-resource-exposure-without-constraint

		55 | data "aws_iam_policy_document" "this_log_key_document" {
		56 |   statement {
		57 |     sid    = "EnableIAMUserPermissions"
		58 |     effect = "Allow"
		59 |     principals {
		60 |       type        = "AWS"
		61 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		62 |     }
		63 |     actions   = ["kms:*"]
		64 |     resources = ["*"]
		65 |   }
		66 | 
		67 |   statement {
		68 |     sid    = "EnableLogServicePermissions"
		69 |     effect = "Allow"
		70 |     principals {
		71 |       type        = "Service"
		72 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		73 |     }
		74 |     actions = [
		75 |       "kms:*",
		76 |     ]
		77 |     resources = ["*"]
		78 |   }
		79 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.athena_layer.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:55-79
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		55 | data "aws_iam_policy_document" "this_log_key_document" {
		56 |   statement {
		57 |     sid    = "EnableIAMUserPermissions"
		58 |     effect = "Allow"
		59 |     principals {
		60 |       type        = "AWS"
		61 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		62 |     }
		63 |     actions   = ["kms:*"]
		64 |     resources = ["*"]
		65 |   }
		66 | 
		67 |   statement {
		68 |     sid    = "EnableLogServicePermissions"
		69 |     effect = "Allow"
		70 |     principals {
		71 |       type        = "Service"
		72 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		73 |     }
		74 |     actions = [
		75 |       "kms:*",
		76 |     ]
		77 |     resources = ["*"]
		78 |   }
		79 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.athena_layer.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:55-79
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		55 | data "aws_iam_policy_document" "this_log_key_document" {
		56 |   statement {
		57 |     sid    = "EnableIAMUserPermissions"
		58 |     effect = "Allow"
		59 |     principals {
		60 |       type        = "AWS"
		61 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		62 |     }
		63 |     actions   = ["kms:*"]
		64 |     resources = ["*"]
		65 |   }
		66 | 
		67 |   statement {
		68 |     sid    = "EnableLogServicePermissions"
		69 |     effect = "Allow"
		70 |     principals {
		71 |       type        = "Service"
		72 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		73 |     }
		74 |     actions = [
		75 |       "kms:*",
		76 |     ]
		77 |     resources = ["*"]
		78 |   }
		79 | }

Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: module.get_zipped_file.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-8
	Calling File: /step_functions_main.tf:38-48
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: module.get_zipped_file.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-8
	Calling File: /step_functions_main.tf:38-48
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:39-48
	Calling File: /step_functions_main.tf:38-48
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		39 | data "aws_iam_policy_document" "step_function_base_permissions" {
		40 |   statement {
		41 |     effect = "Allow"
		42 |     actions = [
		43 |       "sns:Publish",
		44 |       "sqs:SendMessage"
		45 |     ]
		46 |     resources = ["*"]
		47 |   }
		48 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:39-48
	Calling File: /step_functions_main.tf:38-48
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		39 | data "aws_iam_policy_document" "step_function_base_permissions" {
		40 |   statement {
		41 |     effect = "Allow"
		42 |     actions = [
		43 |       "sns:Publish",
		44 |       "sqs:SendMessage"
		45 |     ]
		46 |     resources = ["*"]
		47 |   }
		48 | }

Check: CKV_AWS_109: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:55-79
	Calling File: /step_functions_main.tf:38-48
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-permissions-management-resource-exposure-without-constraint

		55 | data "aws_iam_policy_document" "this_log_key_document" {
		56 |   statement {
		57 |     sid    = "EnableIAMUserPermissions"
		58 |     effect = "Allow"
		59 |     principals {
		60 |       type        = "AWS"
		61 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		62 |     }
		63 |     actions   = ["kms:*"]
		64 |     resources = ["*"]
		65 |   }
		66 | 
		67 |   statement {
		68 |     sid    = "EnableLogServicePermissions"
		69 |     effect = "Allow"
		70 |     principals {
		71 |       type        = "Service"
		72 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		73 |     }
		74 |     actions = [
		75 |       "kms:*",
		76 |     ]
		77 |     resources = ["*"]
		78 |   }
		79 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:55-79
	Calling File: /step_functions_main.tf:38-48
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		55 | data "aws_iam_policy_document" "this_log_key_document" {
		56 |   statement {
		57 |     sid    = "EnableIAMUserPermissions"
		58 |     effect = "Allow"
		59 |     principals {
		60 |       type        = "AWS"
		61 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		62 |     }
		63 |     actions   = ["kms:*"]
		64 |     resources = ["*"]
		65 |   }
		66 | 
		67 |   statement {
		68 |     sid    = "EnableLogServicePermissions"
		69 |     effect = "Allow"
		70 |     principals {
		71 |       type        = "Service"
		72 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		73 |     }
		74 |     actions = [
		75 |       "kms:*",
		76 |     ]
		77 |     resources = ["*"]
		78 |   }
		79 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:55-79
	Calling File: /step_functions_main.tf:38-48
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		55 | data "aws_iam_policy_document" "this_log_key_document" {
		56 |   statement {
		57 |     sid    = "EnableIAMUserPermissions"
		58 |     effect = "Allow"
		59 |     principals {
		60 |       type        = "AWS"
		61 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		62 |     }
		63 |     actions   = ["kms:*"]
		64 |     resources = ["*"]
		65 |   }
		66 | 
		67 |   statement {
		68 |     sid    = "EnableLogServicePermissions"
		69 |     effect = "Allow"
		70 |     principals {
		71 |       type        = "Service"
		72 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		73 |     }
		74 |     actions = [
		75 |       "kms:*",
		76 |     ]
		77 |     resources = ["*"]
		78 |   }
		79 | }

Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: module.send_database_to_ap.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-8
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: module.send_database_to_ap.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-8
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.send_database_to_ap.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:39-48
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		39 | data "aws_iam_policy_document" "step_function_base_permissions" {
		40 |   statement {
		41 |     effect = "Allow"
		42 |     actions = [
		43 |       "sns:Publish",
		44 |       "sqs:SendMessage"
		45 |     ]
		46 |     resources = ["*"]
		47 |   }
		48 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.send_database_to_ap.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:39-48
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		39 | data "aws_iam_policy_document" "step_function_base_permissions" {
		40 |   statement {
		41 |     effect = "Allow"
		42 |     actions = [
		43 |       "sns:Publish",
		44 |       "sqs:SendMessage"
		45 |     ]
		46 |     resources = ["*"]
		47 |   }
		48 | }

Check: CKV_AWS_109: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: module.send_database_to_ap.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:55-79
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-permissions-management-resource-exposure-without-constraint

		55 | data "aws_iam_policy_document" "this_log_key_document" {
		56 |   statement {
		57 |     sid    = "EnableIAMUserPermissions"
		58 |     effect = "Allow"
		59 |     principals {
		60 |       type        = "AWS"
		61 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		62 |     }
		63 |     actions   = ["kms:*"]
		64 |     resources = ["*"]
		65 |   }
		66 | 
		67 |   statement {
		68 |     sid    = "EnableLogServicePermissions"
		69 |     effect = "Allow"
		70 |     principals {
		71 |       type        = "Service"
		72 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		73 |     }
		74 |     actions = [
		75 |       "kms:*",
		76 |     ]
		77 |     resources = ["*"]
		78 |   }
		79 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.send_database_to_ap.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:55-79
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		55 | data "aws_iam_policy_document" "this_log_key_document" {
		56 |   statement {
		57 |     sid    = "EnableIAMUserPermissions"
		58 |     effect = "Allow"
		59 |     principals {
		60 |       type        = "AWS"
		61 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		62 |     }
		63 |     actions   = ["kms:*"]
		64 |     resources = ["*"]
		65 |   }
		66 | 
		67 |   statement {
		68 |     sid    = "EnableLogServicePermissions"
		69 |     effect = "Allow"
		70 |     principals {
		71 |       type        = "Service"
		72 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		73 |     }
		74 |     actions = [
		75 |       "kms:*",
		76 |     ]
		77 |     resources = ["*"]
		78 |   }
		79 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.send_database_to_ap.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:55-79
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		55 | data "aws_iam_policy_document" "this_log_key_document" {
		56 |   statement {
		57 |     sid    = "EnableIAMUserPermissions"
		58 |     effect = "Allow"
		59 |     principals {
		60 |       type        = "AWS"
		61 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		62 |     }
		63 |     actions   = ["kms:*"]
		64 |     resources = ["*"]
		65 |   }
		66 | 
		67 |   statement {
		68 |     sid    = "EnableLogServicePermissions"
		69 |     effect = "Allow"
		70 |     principals {
		71 |       type        = "Service"
		72 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		73 |     }
		74 |     actions = [
		75 |       "kms:*",
		76 |     ]
		77 |     resources = ["*"]
		78 |   }
		79 | }

Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.db_password
	File: /server_backups.tf:4-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		4 | resource "aws_secretsmanager_secret" "db_password" {
		5 |   name = "db_password"
		6 | }

Check: CKV_AWS_354: "Ensure RDS Performance Insights are encrypted using KMS CMKs"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-354

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_157: "Ensure that RDS instances have Multi-AZ enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-73

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_118: "Ensure that enhanced monitoring is enabled for Amazon RDS instances"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/ensure-that-enhanced-monitoring-is-enabled-for-amazon-rds-instances

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_353: "Ensure that RDS instances have performance insights enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-353

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_293: "Ensure that AWS database instances have deletion protection enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-293

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_129: "Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-that-respective-logs-of-amazon-relational-database-service-amazon-rds-are-enabled

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.send_database_to_ap
	File: /step_functions_iam.tf:44-118
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.send_database_to_ap
	File: /step_functions_iam.tf:44-118
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.db_glue_connection
	File: /lambdas_secrets.tf:1-3
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		1 | resource "aws_secretsmanager_secret" "db_glue_connection" {
		2 |   name = "db_glue_connection"
		3 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.db_password
	File: /server_backups.tf:4-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		4 | resource "aws_secretsmanager_secret" "db_password" {
		5 |   name = "db_password"
		6 | }

Check: CKV2_AWS_60: "Ensure RDS instance with copy tags to snapshots is enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-60

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: aws_security_group.glue_rds_conn_security_group
	File: /dms_security_groups.tf:71-82
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		71 | resource "aws_security_group" "glue_rds_conn_security_group" {
		72 |   name        = "glue-rds-sqlserver-connection-tf"
		73 |   description = "Secuity Group for Glue-RDS-Connection"
		74 |   vpc_id      = data.aws_vpc.shared.id
		75 | 
		76 |   tags = merge(
		77 |     local.tags,
		78 |     {
		79 |       Resource_Type = "Secuity Group for Glue-RDS-Connection",
		80 |     }
		81 |   )
		82 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: module.buddi.module.landing_zone_security_groups.aws_security_group.this
	File: /modules/landing_zone/server_security_group/main.tf:7-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		7  | resource "aws_security_group" "this" {
		8  |   name        = "${var.supplier}-${var.user_name}-inbound-ips"
		9  |   description = "Allowed IP addresses for ${var.user_name} on ${var.supplier} server"
		10 |   vpc_id      = var.vpc_id
		11 | 
		12 |   lifecycle {
		13 |     create_before_destroy = true
		14 |   }
		15 | 
		16 |   tags = merge(
		17 |     var.local_tags,
		18 |     {
		19 |       supplier = var.user_name,
		20 |     },
		21 |   )
		22 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: module.capita.module.landing_zone_security_groups.aws_security_group.this
	File: /modules/landing_zone/server_security_group/main.tf:7-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		7  | resource "aws_security_group" "this" {
		8  |   name        = "${var.supplier}-${var.user_name}-inbound-ips"
		9  |   description = "Allowed IP addresses for ${var.user_name} on ${var.supplier} server"
		10 |   vpc_id      = var.vpc_id
		11 | 
		12 |   lifecycle {
		13 |     create_before_destroy = true
		14 |   }
		15 | 
		16 |   tags = merge(
		17 |     var.local_tags,
		18 |     {
		19 |       supplier = var.user_name,
		20 |     },
		21 |   )
		22 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: module.g4s.module.landing_zone_security_groups.aws_security_group.this
	File: /modules/landing_zone/server_security_group/main.tf:7-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		7  | resource "aws_security_group" "this" {
		8  |   name        = "${var.supplier}-${var.user_name}-inbound-ips"
		9  |   description = "Allowed IP addresses for ${var.user_name} on ${var.supplier} server"
		10 |   vpc_id      = var.vpc_id
		11 | 
		12 |   lifecycle {
		13 |     create_before_destroy = true
		14 |   }
		15 | 
		16 |   tags = merge(
		17 |     var.local_tags,
		18 |     {
		19 |       supplier = var.user_name,
		20 |     },
		21 |   )
		22 | }

dockerfile scan results:

Passed checks: 21, Failed checks: 2, Skipped checks: 0

Check: CKV_DOCKER_2: "Ensure that HEALTHCHECK instructions have been added to container images"
	FAILED for resource: /lambdas/update_log_table/Dockerfile.
	File: /lambdas/update_log_table/Dockerfile:1-9
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/docker-policies/docker-policy-index/ensure-that-healthcheck-instructions-have-been-added-to-container-images

		1 | FROM public.ecr.aws/lambda/python:3.11
		2 | 
		3 | COPY requirements.txt .
		4 | 
		5 | RUN pip install -r requirements.txt --target "${LAMBDA_TASK_ROOT}"
		6 | 
		7 | COPY update_log_table.py ${LAMBDA_TASK_ROOT}
		8 | 
		9 | CMD ["update_log_table.handler"]

Check: CKV_DOCKER_3: "Ensure that a user for the container has been created"
	FAILED for resource: /lambdas/update_log_table/Dockerfile.
	File: /lambdas/update_log_table/Dockerfile:1-9
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/docker-policies/docker-policy-index/ensure-that-a-user-for-the-container-has-been-created

		1 | FROM public.ecr.aws/lambda/python:3.11
		2 | 
		3 | COPY requirements.txt .
		4 | 
		5 | RUN pip install -r requirements.txt --target "${LAMBDA_TASK_ROOT}"
		6 | 
		7 | COPY update_log_table.py ${LAMBDA_TASK_ROOT}
		8 | 
		9 | CMD ["update_log_table.handler"]


checkov_exitcode=1

CTFLint Scan Failed

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
terraform/environments/electronic-monitoring-data

*****************************

Running tflint in terraform/environments/electronic-monitoring-data
Excluding the following checks: terraform_unused_declarations
3 issue(s) found:

Warning: `s3_pylib_dir_path` variable has no type (terraform_typed_variables)

  on terraform/environments/electronic-monitoring-data/glue_variables.tf line 1:
   1: variable "s3_pylib_dir_path" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_typed_variables.md

Warning: Missing version constraint for provider "archive" in `required_providers` (terraform_required_providers)

  on terraform/environments/electronic-monitoring-data/lambdas_main.tf line 189:
 189: data "archive_file" "query_output_to_list" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

Warning: Missing version constraint for provider "random" in `required_providers` (terraform_required_providers)

  on terraform/environments/electronic-monitoring-data/server_backups.tf line 13:
  13: resource "random_password" "random_password" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

tflint_exitcode=2

Trivy Scan Failed

Show Output

*****************************

Trivy will check the following folders:
terraform/environments/electronic-monitoring-data

*****************************

Running Trivy in terraform/environments/electronic-monitoring-data
2024-10-16T19:14:31Z	INFO	[vulndb] Need to update DB
2024-10-16T19:14:31Z	INFO	[vulndb] Downloading vulnerability DB...
2024-10-16T19:14:31Z	INFO	[vulndb] Downloading artifact...	repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-16T19:14:33Z	INFO	[vulndb] Artifact successfully downloaded	repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-16T19:14:33Z	INFO	[vuln] Vulnerability scanning is enabled
2024-10-16T19:14:33Z	INFO	[misconfig] Misconfiguration scanning is enabled
2024-10-16T19:14:33Z	INFO	[misconfig] Need to update the built-in checks
2024-10-16T19:14:33Z	INFO	[misconfig] Downloading the built-in checks...
156.02 KiB / 156.02 KiB [---------------------------------------------------------] 100.00% ? p/s 0s2024-10-16T19:14:34Z	INFO	[secret] Secret scanning is enabled
2024-10-16T19:14:34Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-16T19:14:34Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-10-16T19:14:35Z	WARN	[pip] Unable to find python `site-packages` directory. License detection is skipped.	err="site-packages directory not found"
2024-10-16T19:14:36Z	INFO	[terraform scanner] Scanning root module	file_path="."
2024-10-16T19:14:36Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="networking"
2024-10-16T19:14:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-16T19:14:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-16T19:14:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-16T19:14:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-16T19:14:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-16T19:14:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-16T19:14:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-16T19:14:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-16T19:14:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-16T19:14:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-16T19:14:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.aws_s3_object.user_public_keys" value="cty.NilVal"
2024-10-16T19:14:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.data.aws_subnet.local_account" value="cty.NilVal"
2024-10-16T19:14:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-16T19:14:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-16T19:14:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-16T19:14:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-16T19:14:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-16T19:14:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-16T19:14:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-16T19:14:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-16T19:14:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-16T19:14:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-16T19:14:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-16T19:14:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-16T19:14:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-16T19:14:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-16T19:14:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-16T19:14:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-16T19:14:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-16T19:14:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-16T19:14:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-16T19:14:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-16T19:14:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-16T19:14:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-16T19:14:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-16T19:14:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-16T19:14:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-16T19:14:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-16T19:14:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-16T19:14:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-16T19:14:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-16T19:14:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-16T19:14:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-16T19:14:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-16T19:14:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-16T19:14:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-16T19:14:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-16T19:14:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-16T19:14:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-16T19:14:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-16T19:14:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-16T19:14:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-16T19:14:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-16T19:14:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-16T19:14:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.transition" value="cty.NilVal"
2024-10-16T19:14:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-16T19:14:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-16T19:14:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.principals" value="cty.NilVal"
2024-10-16T19:14:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.condition" value="cty.NilVal"
2024-10-16T19:14:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-16T19:14:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.transition" value="cty.NilVal"
2024-10-16T19:14:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-16T19:14:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-16T19:14:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.principals" value="cty.NilVal"
2024-10-16T19:14:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.condition" value="cty.NilVal"
2024-10-16T19:14:45Z	INFO	[terraform executor] Ignore finding	rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:281-286"
2024-10-16T19:14:45Z	INFO	[terraform executor] Ignore finding	rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:407-411"
2024-10-16T19:14:45Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-bucket-encryption" range="s3.tf:1061-1080"
2024-10-16T19:14:45Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-16T19:14:45Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-16T19:14:45Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-16T19:14:45Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-16T19:14:45Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-16T19:14:45Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-16T19:14:45Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-16T19:14:45Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-16T19:14:45Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-16T19:14:45Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-16T19:14:45Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-16T19:14:45Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-16T19:14:45Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-16T19:14:45Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=95ed3c3/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=568694e50e03630d99cb569eafa06a0b879a1239/main.tf:171-179"
2024-10-16T19:14:45Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="s3.tf:1061-1080"
2024-10-16T19:14:45Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-versioning" range="s3.tf:1061-1080"
2024-10-16T19:14:45Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-logging" range="s3.tf:1061-1080"
2024-10-16T19:14:45Z	INFO	Number of language-specific files	num=1
2024-10-16T19:14:45Z	INFO	[pip] Detecting vulnerabilities...
2024-10-16T19:14:45Z	INFO	Detected config files	num=16

lambdas/update_log_table/Dockerfile (dockerfile)
================================================
Tests: 20 (SUCCESSES: 19, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Specify at least 1 USER command in Dockerfile with non-root user as argument
════════════════════════════════════════
Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

See https://avd.aquasec.com/misconfig/ds002
────────────────────────────────────────


trivy_exitcode=1

[github-actions]

Trivy Scan Failed

Show Output

```hcl

---

Trivy will check the following folders:
terraform/environments/electronic-monitoring-data

---

Running Trivy in terraform/environments/electronic-monitoring-data
2024-10-17T09:33:18Z INFO [vulndb] Need to update DB
2024-10-17T09:33:18Z INFO [vulndb] Downloading vulnerability DB...
2024-10-17T09:33:18Z INFO [vulndb] Downloading artifact... repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-17T09:33:20Z INFO [vulndb] Artifact successfully downloaded repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-17T09:33:20Z INFO [vuln] Vulnerability scanning is enabled
2024-10-17T09:33:20Z INFO [misconfig] Misconfiguration scanning is enabled
2024-10-17T09:33:20Z INFO [misconfig] Need to update the built-in checks
2024-10-17T09:33:20Z INFO [misconfig] Downloading the built-in checks...
2024-10-17T09:33:21Z ERROR [misconfig] Falling back to embedded checks err="failed to download built-in policies: download error: oci download error: failed to fetch the layer: GET https://ghcr.io/v2/aquasecurity/trivy-checks/blobs/sha256:16957b935ef82529bc26f3ceeeb60d798c90ef142d25e3715ab4478b204ed1bb: TOOMANYREQUESTS: retry-after: 461.518µs, allowed: 44000/minute"
2024-10-17T09:33:21Z INFO [secret] Secret scanning is enabled
2024-10-17T09:33:21Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-17T09:33:21Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-10-17T09:33:22Z INFO [terraform scanner] Scanning root module file_path="."
2024-10-17T09:33:22Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="networking"
2024-10-17T09:33:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T09:33:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T09:33:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T09:33:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T09:33:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T09:33:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T09:33:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T09:33:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T09:33:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T09:33:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T09:33:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.aws_s3_object.user_public_keys" value="cty.NilVal"
2024-10-17T09:33:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.data.aws_subnet.local_account" value="cty.NilVal"
2024-10-17T09:33:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-17T09:33:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T09:33:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T09:33:27Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T09:33:27Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T09:33:27Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T09:33:27Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T09:33:27Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T09:33:27Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T09:33:27Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T09:33:27Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T09:33:27Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T09:33:27Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T09:33:27Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T09:33:27Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T09:33:27Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T09:33:27Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T09:33:27Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T09:33:27Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T09:33:27Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T09:33:27Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T09:33:27Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T09:33:27Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T09:33:27Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T09:33:27Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T09:33:27Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T09:33:27Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T09:33:27Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T09:33:27Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T09:33:27Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T09:33:27Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T09:33:27Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T09:33:27Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T09:33:27Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T09:33:27Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T09:33:27Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T09:33:27Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T09:33:27Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T09:33:27Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T09:33:27Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T09:33:27Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T09:33:27Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T09:33:27Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T09:33:27Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T09:33:27Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T09:33:27Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T09:33:27Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T09:33:27Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T09:33:27Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T09:33:27Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T09:33:27Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T09:33:27Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T09:33:27Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T09:33:31Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-bucket-encryption" range="s3.tf:1061-1080"
2024-10-17T09:33:31Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-logging" range="s3.tf:1061-1080"
2024-10-17T09:33:31Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-versioning" range="s3.tf:1061-1080"
2024-10-17T09:33:31Z INFO [terraform executor] Ignore finding rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:281-286"
2024-10-17T09:33:31Z INFO [terraform executor] Ignore finding rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:407-411"
2024-10-17T09:33:31Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-17T09:33:31Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-17T09:33:31Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T09:33:31Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T09:33:31Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T09:33:31Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T09:33:31Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T09:33:31Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T09:33:31Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T09:33:31Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T09:33:31Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T09:33:31Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T09:33:31Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T09:33:31Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=95ed3c3/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=568694e50e03630d99cb569eafa06a0b879a1239/main.tf:171-179"
2024-10-17T09:33:31Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="s3.tf:1061-1080"
2024-10-17T09:33:32Z WARN [pip] Unable to find python site-packages directory. License detection is skipped. err="site-packages directory not found"
2024-10-17T09:33:32Z INFO Number of language-specific files num=1
2024-10-17T09:33:32Z INFO [pip] Detecting vulnerabilities...
2024-10-17T09:33:32Z INFO Detected config files num=17

lambdas/update_log_table/Dockerfile (dockerfile)

Tests: 20 (SUCCESSES: 19, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Specify at least 1 USER command in Dockerfile with non-root user as argument
════════════════════════════════════════
Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

See https://avd.aquasec.com/misconfig/ds002
────────────────────────────────────────

trivy_exitcode=1

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/electronic-monitoring-data

*****************************

Running Checkov in terraform/environments/electronic-monitoring-data
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2024-10-17 09:33:35,443 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=95ed3c3:None (for external modules, the --download-external-modules flag is required)
2024-10-17 09:33:35,443 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060:None (for external modules, the --download-external-modules flag is required)
2024-10-17 09:33:35,443 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/secrets-manager/aws:1.3.0 (for external modules, the --download-external-modules flag is required)
2024-10-17 09:33:35,443 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=52a40b0:None (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 2272, Failed checks: 75, Skipped checks: 35

Check: CKV_AWS_26: "Ensure all data stored in the SNS topic is encrypted"
	FAILED for resource: aws_sns_topic.s3_events
	File: /data_store.tf:17-19
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-15

		17 | resource "aws_sns_topic" "s3_events" {
		18 |   name = "${module.s3-data-bucket.bucket.id}-object-created-topic"
		19 | }

Check: CKV_AWS_115: "Ensure that AWS Lambda function is configured for function-level concurrent execution limit"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-function-level-concurrent-execution-limit

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_173: "Check encryption settings for Lambda environmental variable"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-5

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_116: "Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-a-dead-letter-queue-dlq

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_272: "Ensure AWS Lambda function is configured to validate code-signing"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-272

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_117: "Ensure that AWS Lambda function is configured inside a VPC"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-inside-a-vpc-1

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_115: "Ensure that AWS Lambda function is configured for function-level concurrent execution limit"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-function-level-concurrent-execution-limit

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_116: "Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-a-dead-letter-queue-dlq

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_272: "Ensure AWS Lambda function is configured to validate code-signing"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-272

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_117: "Ensure that AWS Lambda function is configured inside a VPC"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-inside-a-vpc-1

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group
	File: /dms_data_validation_glue_job.tf:65-68
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		65 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group" {
		66 |   name              = "dms-dv-glue-job"
		67 |   retention_in_days = 14
		68 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group
	File: /dms_data_validation_glue_job.tf:65-68
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		65 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group" {
		66 |   name              = "dms-dv-glue-job"
		67 |   retention_in_days = 14
		68 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group_v2
	File: /dms_data_validation_glue_job.tf:70-73
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		70 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group_v2" {
		71 |   name              = "dms-dv-glue-job-v2"
		72 |   retention_in_days = 14
		73 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group_v2
	File: /dms_data_validation_glue_job.tf:70-73
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		70 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group_v2" {
		71 |   name              = "dms-dv-glue-job-v2"
		72 |   retention_in_days = 14
		73 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.rds_to_s3_parquet_migration
	File: /dms_data_validation_glue_job.tf:75-78
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		75 | resource "aws_cloudwatch_log_group" "rds_to_s3_parquet_migration" {
		76 |   name              = "rds-to-s3-parquet-migration"
		77 |   retention_in_days = 14
		78 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.rds_to_s3_parquet_migration
	File: /dms_data_validation_glue_job.tf:75-78
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		75 | resource "aws_cloudwatch_log_group" "rds_to_s3_parquet_migration" {
		76 |   name              = "rds-to-s3-parquet-migration"
		77 |   retention_in_days = 14
		78 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.resizing_parquet_files
	File: /dms_data_validation_glue_job.tf:80-83
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		80 | resource "aws_cloudwatch_log_group" "resizing_parquet_files" {
		81 |   name              = "resizing-parquet-files"
		82 |   retention_in_days = 14
		83 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.resizing_parquet_files
	File: /dms_data_validation_glue_job.tf:80-83
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		80 | resource "aws_cloudwatch_log_group" "resizing_parquet_files" {
		81 |   name              = "resizing-parquet-files"
		82 |   retention_in_days = 14
		83 | }

Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.dms_dv_glue_job_v2
	File: /dms_data_validation_glue_job.tf:86-140
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.dms_dv_glue_job_v4d
	File: /dms_data_validation_glue_job.tf:148-201
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.rds_to_s3_parquet_migration
	File: /dms_data_validation_glue_job.tf:204-268
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.rds_to_s3_parquet_migration_monthly
	File: /dms_data_validation_glue_job.tf:272-326
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.resizing_parquet_files
	File: /dms_data_validation_glue_job.tf:329-381
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.catalog_dv_table_glue_job
	File: /dms_data_validation_glue_job.tf:384-412
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		384 | resource "aws_glue_job" "catalog_dv_table_glue_job" {
		385 |   name              = "catalog-dv-table-glue-job"
		386 |   description       = "Python script uses Boto3-Athena-Client to run sql-statements"
		387 |   role_arn          = aws_iam_role.dms_dv_glue_job_iam_role.arn
		388 |   glue_version      = "4.0"
		389 |   worker_type       = "G.1X"
		390 |   number_of_workers = 2
		391 |   default_arguments = {
		392 |     "--parquet_output_bucket_name"       = module.s3-dms-data-validation-bucket.bucket.id
		393 |     "--glue_catalog_db_name"             = aws_glue_catalog_database.dms_dv_glue_catalog_db.name
		394 |     "--glue_catalog_tbl_name"            = "glue_df_output"
		395 |     "--continuous-log-logGroup"          = aws_cloudwatch_log_group.dms_dv_cw_log_group.name
		396 |     "--enable-continuous-cloudwatch-log" = "true"
		397 |     "--enable-continuous-log-filter"     = "true"
		398 |     "--enable-metrics"                   = ""
		399 |   }
		400 |   command {
		401 |     python_version  = "3"
		402 |     script_location = "s3://${module.s3-glue-job-script-bucket.bucket.id}/create_or_replace_dv_table.py"
		403 |   }
		404 | 
		405 |   tags = merge(
		406 |     local.tags,
		407 |     {
		408 |       Resource_Type = "Py script as glue-job that creates dv table / refreshes its partitions",
		409 |     }
		410 |   )
		411 | 
		412 | }

Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_crawler.rds_sqlserver_db_glue_crawler
	File: /dms_glue_crawler.tf:35-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		35 | resource "aws_glue_crawler" "rds_sqlserver_db_glue_crawler" {
		36 |   name          = "rds-sqlserver-${aws_db_instance.database_2022.identifier}-tf"
		37 |   role          = aws_iam_role.dms_dv_glue_job_iam_role.arn
		38 |   database_name = aws_glue_catalog_database.rds_sqlserver_glue_catalog_db.name
		39 |   description   = "Crawler to fetch database names"
		40 |   #   table_prefix  = "your_table_prefix"
		41 | 
		42 |   jdbc_target {
		43 |     connection_name = aws_glue_connection.glue_rds_sqlserver_db_connection.name
		44 |     path            = "%"
		45 |   }
		46 |   tags = merge(
		47 |     local.tags,
		48 |     {
		49 |       Resource_Type = "RDS-SQLServer Glue-Crawler for DMS",
		50 |     }
		51 |   )
		52 | 
		53 |   # provisioner "local-exec" {
		54 |   #   command = "aws glue start-crawler --name ${self.name}"
		55 |   # }
		56 | }

Check: CKV_AWS_212: "Ensure DMS replication instance is encrypted by KMS using a customer managed Key (CMK)"
	FAILED for resource: aws_dms_replication_instance.dms_replication_instance
	File: /dms_replication_instance.tf:24-55
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-ebs-volume-is-encrypted-by-key-management-service-kms-using-a-customer-managed-key-cmk

		24 | resource "aws_dms_replication_instance" "dms_replication_instance" {
		25 |   allocated_storage          = var.dms_allocated_storage_gib
		26 |   apply_immediately          = true
		27 |   auto_minor_version_upgrade = true
		28 |   availability_zone          = var.dms_availability_zone
		29 |   engine_version             = var.dms_engine_version
		30 |   #   kms_key_arn                  = "arn:aws:kms:eu-west-2:800964199911:key/b7f54acb-16a3-4958-9340-3bdf5f5842d8"
		31 |   multi_az = false
		32 |   #   preferred_maintenance_window = "sun:10:30-sun:14:30"
		33 |   publicly_accessible         = false
		34 |   replication_instance_class  = var.dms_replication_instance_class
		35 |   replication_instance_id     = "dms-replication-instance-tf"
		36 |   replication_subnet_group_id = aws_dms_replication_subnet_group.dms_replication_subnet_group.id
		37 | 
		38 |   tags = merge(
		39 |     local.tags,
		40 |     {
		41 |       Resource_Type = "DMS Replication Instance",
		42 |     }
		43 |   )
		44 | 
		45 |   vpc_security_group_ids = [
		46 |     aws_security_group.dms_ri_security_group.id,
		47 |   ]
		48 | 
		49 |   depends_on = [
		50 |     aws_iam_role.dms_vpc_role,
		51 |     aws_iam_role.dms_cloudwatch_logs_role,
		52 |     aws_iam_role.dms_endpoint_role
		53 |   ]
		54 | 
		55 | }

Check: CKV_AWS_260: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 80"
	FAILED for resource: aws_vpc_security_group_ingress_rule.glue_rds_conn_inbound
	File: /dms_security_groups.tf:95-103
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-aws-security-groups-do-not-allow-ingress-from-00000-to-port-80

		95  | resource "aws_vpc_security_group_ingress_rule" "glue_rds_conn_inbound" {
		96  |   security_group_id = aws_security_group.glue_rds_conn_security_group.id
		97  | 
		98  |   referenced_security_group_id = aws_security_group.glue_rds_conn_security_group.id
		99  |   ip_protocol                  = "tcp"
		100 |   from_port                    = 0
		101 |   to_port                      = 65535
		102 |   description                  = "Required ports open for Glue-RDS-Connection"
		103 | }

Check: CKV_AWS_24: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 22"
	FAILED for resource: aws_vpc_security_group_ingress_rule.glue_rds_conn_inbound
	File: /dms_security_groups.tf:95-103
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-1-port-security

		95  | resource "aws_vpc_security_group_ingress_rule" "glue_rds_conn_inbound" {
		96  |   security_group_id = aws_security_group.glue_rds_conn_security_group.id
		97  | 
		98  |   referenced_security_group_id = aws_security_group.glue_rds_conn_security_group.id
		99  |   ip_protocol                  = "tcp"
		100 |   from_port                    = 0
		101 |   to_port                      = 65535
		102 |   description                  = "Required ports open for Glue-RDS-Connection"
		103 | }

Check: CKV_AWS_25: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389"
	FAILED for resource: aws_vpc_security_group_ingress_rule.glue_rds_conn_inbound
	File: /dms_security_groups.tf:95-103
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-2

		95  | resource "aws_vpc_security_group_ingress_rule" "glue_rds_conn_inbound" {
		96  |   security_group_id = aws_security_group.glue_rds_conn_security_group.id
		97  | 
		98  |   referenced_security_group_id = aws_security_group.glue_rds_conn_security_group.id
		99  |   ip_protocol                  = "tcp"
		100 |   from_port                    = 0
		101 |   to_port                      = 65535
		102 |   description                  = "Required ports open for Glue-RDS-Connection"
		103 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.glue_notebook_ec2_iam_policy_document
	File: /glue_data.tf:103-118
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		103 | data "aws_iam_policy_document" "glue_notebook_ec2_iam_policy_document" {
		104 |   statement {
		105 |     effect = "Allow"
		106 |     actions = [
		107 |       "ec2:CreateNetworkInterface",
		108 |       "ec2:DescribeNetworkInterfaces",
		109 |       "ec2:DeleteNetworkInterface",
		110 |       "ec2:DescribeVpcEndpoints",
		111 |       "ec2:DescribeSubnets",
		112 |       "ec2:DescribeVpcAttribute",
		113 |       "ec2:DescribeRouteTables",
		114 |       "ec2:DescribeSecurityGroups"
		115 |     ]
		116 |     resources = ["*"]
		117 |   }
		118 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.glue_notebook_ec2_iam_policy_document
	File: /glue_data.tf:103-118
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		103 | data "aws_iam_policy_document" "glue_notebook_ec2_iam_policy_document" {
		104 |   statement {
		105 |     effect = "Allow"
		106 |     actions = [
		107 |       "ec2:CreateNetworkInterface",
		108 |       "ec2:DescribeNetworkInterfaces",
		109 |       "ec2:DeleteNetworkInterface",
		110 |       "ec2:DescribeVpcEndpoints",
		111 |       "ec2:DescribeSubnets",
		112 |       "ec2:DescribeVpcAttribute",
		113 |       "ec2:DescribeRouteTables",
		114 |       "ec2:DescribeSecurityGroups"
		115 |     ]
		116 |     resources = ["*"]
		117 |   }
		118 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.load_json_table_s3_policy_document
	File: /lambdas_iam.tf:430-487
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.load_json_table_s3_policy_document
	File: /lambdas_iam.tf:430-487
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.db_glue_connection
	File: /lambdas_secrets.tf:1-3
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		1 | resource "aws_secretsmanager_secret" "db_glue_connection" {
		2 |   name = "db_glue_connection"
		3 | }

Check: CKV_AWS_296: "Ensure DMS endpoint uses Customer Managed Key (CMK)"
	FAILED for resource: module.dms_task.aws_dms_endpoint.dms_rds_source
	File: /modules/dms/endpoints_rds_s3.tf:2-23
	Calling File: /dms_main.tf:1-39
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-296

		2  | resource "aws_dms_endpoint" "dms_rds_source" {
		3  | 
		4  |   #   certificate_arn             = ""
		5  |   database_name = var.database_name
		6  |   endpoint_id   = "rds-mssql-${replace(var.database_name, "_", "-")}-tf"
		7  |   endpoint_type = "source"
		8  |   engine_name   = "sqlserver"
		9  |   #   extra_connection_attributes = ""
		10 |   #   kms_key_arn                 = aws_db_instance.database_2022.kms_key_id
		11 |   password    = var.rds_db_instance_pasword
		12 |   port        = var.rds_db_instance_port
		13 |   server_name = var.rds_db_server_name
		14 |   ssl_mode    = "require"
		15 |   username    = var.rds_db_username
		16 | 
		17 |   tags = merge(
		18 |     var.local_tags,
		19 |     {
		20 |       Resource_Type = "DMS Source Endpoint - RDS MSSQL",
		21 |     },
		22 |   )
		23 | }

Check: CKV_AWS_298: "Ensure DMS S3 uses Customer Managed Key (CMK)"
	FAILED for resource: module.dms_task.aws_dms_s3_endpoint.dms_s3_parquet_target
	File: /modules/dms/endpoints_rds_s3.tf:28-84
	Calling File: /dms_main.tf:1-39
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-298

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.athena_layer.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:39-48
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		39 | data "aws_iam_policy_document" "step_function_base_permissions" {
		40 |   statement {
		41 |     effect = "Allow"
		42 |     actions = [
		43 |       "sns:Publish",
		44 |       "sqs:SendMessage"
		45 |     ]
		46 |     resources = ["*"]
		47 |   }
		48 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.athena_layer.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:39-48
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		39 | data "aws_iam_policy_document" "step_function_base_permissions" {
		40 |   statement {
		41 |     effect = "Allow"
		42 |     actions = [
		43 |       "sns:Publish",
		44 |       "sqs:SendMessage"
		45 |     ]
		46 |     resources = ["*"]
		47 |   }
		48 | }

Check: CKV_AWS_109: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: module.athena_layer.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:55-79
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-permissions-management-resource-exposure-without-constraint

		55 | data "aws_iam_policy_document" "this_log_key_document" {
		56 |   statement {
		57 |     sid    = "EnableIAMUserPermissions"
		58 |     effect = "Allow"
		59 |     principals {
		60 |       type        = "AWS"
		61 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		62 |     }
		63 |     actions   = ["kms:*"]
		64 |     resources = ["*"]
		65 |   }
		66 | 
		67 |   statement {
		68 |     sid    = "EnableLogServicePermissions"
		69 |     effect = "Allow"
		70 |     principals {
		71 |       type        = "Service"
		72 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		73 |     }
		74 |     actions = [
		75 |       "kms:*",
		76 |     ]
		77 |     resources = ["*"]
		78 |   }
		79 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.athena_layer.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:55-79
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		55 | data "aws_iam_policy_document" "this_log_key_document" {
		56 |   statement {
		57 |     sid    = "EnableIAMUserPermissions"
		58 |     effect = "Allow"
		59 |     principals {
		60 |       type        = "AWS"
		61 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		62 |     }
		63 |     actions   = ["kms:*"]
		64 |     resources = ["*"]
		65 |   }
		66 | 
		67 |   statement {
		68 |     sid    = "EnableLogServicePermissions"
		69 |     effect = "Allow"
		70 |     principals {
		71 |       type        = "Service"
		72 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		73 |     }
		74 |     actions = [
		75 |       "kms:*",
		76 |     ]
		77 |     resources = ["*"]
		78 |   }
		79 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.athena_layer.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:55-79
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		55 | data "aws_iam_policy_document" "this_log_key_document" {
		56 |   statement {
		57 |     sid    = "EnableIAMUserPermissions"
		58 |     effect = "Allow"
		59 |     principals {
		60 |       type        = "AWS"
		61 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		62 |     }
		63 |     actions   = ["kms:*"]
		64 |     resources = ["*"]
		65 |   }
		66 | 
		67 |   statement {
		68 |     sid    = "EnableLogServicePermissions"
		69 |     effect = "Allow"
		70 |     principals {
		71 |       type        = "Service"
		72 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		73 |     }
		74 |     actions = [
		75 |       "kms:*",
		76 |     ]
		77 |     resources = ["*"]
		78 |   }
		79 | }

Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: module.athena_layer.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-8
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: module.athena_layer.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-8
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:39-48
	Calling File: /step_functions_main.tf:38-48
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		39 | data "aws_iam_policy_document" "step_function_base_permissions" {
		40 |   statement {
		41 |     effect = "Allow"
		42 |     actions = [
		43 |       "sns:Publish",
		44 |       "sqs:SendMessage"
		45 |     ]
		46 |     resources = ["*"]
		47 |   }
		48 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:39-48
	Calling File: /step_functions_main.tf:38-48
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		39 | data "aws_iam_policy_document" "step_function_base_permissions" {
		40 |   statement {
		41 |     effect = "Allow"
		42 |     actions = [
		43 |       "sns:Publish",
		44 |       "sqs:SendMessage"
		45 |     ]
		46 |     resources = ["*"]
		47 |   }
		48 | }

Check: CKV_AWS_109: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:55-79
	Calling File: /step_functions_main.tf:38-48
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-permissions-management-resource-exposure-without-constraint

		55 | data "aws_iam_policy_document" "this_log_key_document" {
		56 |   statement {
		57 |     sid    = "EnableIAMUserPermissions"
		58 |     effect = "Allow"
		59 |     principals {
		60 |       type        = "AWS"
		61 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		62 |     }
		63 |     actions   = ["kms:*"]
		64 |     resources = ["*"]
		65 |   }
		66 | 
		67 |   statement {
		68 |     sid    = "EnableLogServicePermissions"
		69 |     effect = "Allow"
		70 |     principals {
		71 |       type        = "Service"
		72 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		73 |     }
		74 |     actions = [
		75 |       "kms:*",
		76 |     ]
		77 |     resources = ["*"]
		78 |   }
		79 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:55-79
	Calling File: /step_functions_main.tf:38-48
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		55 | data "aws_iam_policy_document" "this_log_key_document" {
		56 |   statement {
		57 |     sid    = "EnableIAMUserPermissions"
		58 |     effect = "Allow"
		59 |     principals {
		60 |       type        = "AWS"
		61 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		62 |     }
		63 |     actions   = ["kms:*"]
		64 |     resources = ["*"]
		65 |   }
		66 | 
		67 |   statement {
		68 |     sid    = "EnableLogServicePermissions"
		69 |     effect = "Allow"
		70 |     principals {
		71 |       type        = "Service"
		72 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		73 |     }
		74 |     actions = [
		75 |       "kms:*",
		76 |     ]
		77 |     resources = ["*"]
		78 |   }
		79 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:55-79
	Calling File: /step_functions_main.tf:38-48
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		55 | data "aws_iam_policy_document" "this_log_key_document" {
		56 |   statement {
		57 |     sid    = "EnableIAMUserPermissions"
		58 |     effect = "Allow"
		59 |     principals {
		60 |       type        = "AWS"
		61 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		62 |     }
		63 |     actions   = ["kms:*"]
		64 |     resources = ["*"]
		65 |   }
		66 | 
		67 |   statement {
		68 |     sid    = "EnableLogServicePermissions"
		69 |     effect = "Allow"
		70 |     principals {
		71 |       type        = "Service"
		72 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		73 |     }
		74 |     actions = [
		75 |       "kms:*",
		76 |     ]
		77 |     resources = ["*"]
		78 |   }
		79 | }

Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: module.get_zipped_file.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-8
	Calling File: /step_functions_main.tf:38-48
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: module.get_zipped_file.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-8
	Calling File: /step_functions_main.tf:38-48
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.send_database_to_ap.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:39-48
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		39 | data "aws_iam_policy_document" "step_function_base_permissions" {
		40 |   statement {
		41 |     effect = "Allow"
		42 |     actions = [
		43 |       "sns:Publish",
		44 |       "sqs:SendMessage"
		45 |     ]
		46 |     resources = ["*"]
		47 |   }
		48 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.send_database_to_ap.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:39-48
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		39 | data "aws_iam_policy_document" "step_function_base_permissions" {
		40 |   statement {
		41 |     effect = "Allow"
		42 |     actions = [
		43 |       "sns:Publish",
		44 |       "sqs:SendMessage"
		45 |     ]
		46 |     resources = ["*"]
		47 |   }
		48 | }

Check: CKV_AWS_109: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: module.send_database_to_ap.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:55-79
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-permissions-management-resource-exposure-without-constraint

		55 | data "aws_iam_policy_document" "this_log_key_document" {
		56 |   statement {
		57 |     sid    = "EnableIAMUserPermissions"
		58 |     effect = "Allow"
		59 |     principals {
		60 |       type        = "AWS"
		61 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		62 |     }
		63 |     actions   = ["kms:*"]
		64 |     resources = ["*"]
		65 |   }
		66 | 
		67 |   statement {
		68 |     sid    = "EnableLogServicePermissions"
		69 |     effect = "Allow"
		70 |     principals {
		71 |       type        = "Service"
		72 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		73 |     }
		74 |     actions = [
		75 |       "kms:*",
		76 |     ]
		77 |     resources = ["*"]
		78 |   }
		79 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.send_database_to_ap.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:55-79
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		55 | data "aws_iam_policy_document" "this_log_key_document" {
		56 |   statement {
		57 |     sid    = "EnableIAMUserPermissions"
		58 |     effect = "Allow"
		59 |     principals {
		60 |       type        = "AWS"
		61 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		62 |     }
		63 |     actions   = ["kms:*"]
		64 |     resources = ["*"]
		65 |   }
		66 | 
		67 |   statement {
		68 |     sid    = "EnableLogServicePermissions"
		69 |     effect = "Allow"
		70 |     principals {
		71 |       type        = "Service"
		72 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		73 |     }
		74 |     actions = [
		75 |       "kms:*",
		76 |     ]
		77 |     resources = ["*"]
		78 |   }
		79 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.send_database_to_ap.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:55-79
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		55 | data "aws_iam_policy_document" "this_log_key_document" {
		56 |   statement {
		57 |     sid    = "EnableIAMUserPermissions"
		58 |     effect = "Allow"
		59 |     principals {
		60 |       type        = "AWS"
		61 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		62 |     }
		63 |     actions   = ["kms:*"]
		64 |     resources = ["*"]
		65 |   }
		66 | 
		67 |   statement {
		68 |     sid    = "EnableLogServicePermissions"
		69 |     effect = "Allow"
		70 |     principals {
		71 |       type        = "Service"
		72 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		73 |     }
		74 |     actions = [
		75 |       "kms:*",
		76 |     ]
		77 |     resources = ["*"]
		78 |   }
		79 | }

Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: module.send_database_to_ap.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-8
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: module.send_database_to_ap.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-8
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 | }

Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.db_password
	File: /server_backups.tf:4-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		4 | resource "aws_secretsmanager_secret" "db_password" {
		5 |   name = "db_password"
		6 | }

Check: CKV_AWS_354: "Ensure RDS Performance Insights are encrypted using KMS CMKs"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-354

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_157: "Ensure that RDS instances have Multi-AZ enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-73

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_118: "Ensure that enhanced monitoring is enabled for Amazon RDS instances"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/ensure-that-enhanced-monitoring-is-enabled-for-amazon-rds-instances

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_353: "Ensure that RDS instances have performance insights enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-353

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_293: "Ensure that AWS database instances have deletion protection enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-293

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_129: "Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-that-respective-logs-of-amazon-relational-database-service-amazon-rds-are-enabled

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.send_database_to_ap
	File: /step_functions_iam.tf:44-118
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.send_database_to_ap
	File: /step_functions_iam.tf:44-118
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.db_glue_connection
	File: /lambdas_secrets.tf:1-3
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		1 | resource "aws_secretsmanager_secret" "db_glue_connection" {
		2 |   name = "db_glue_connection"
		3 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.db_password
	File: /server_backups.tf:4-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		4 | resource "aws_secretsmanager_secret" "db_password" {
		5 |   name = "db_password"
		6 | }

Check: CKV2_AWS_60: "Ensure RDS instance with copy tags to snapshots is enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-60

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: aws_security_group.glue_rds_conn_security_group
	File: /dms_security_groups.tf:71-82
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		71 | resource "aws_security_group" "glue_rds_conn_security_group" {
		72 |   name        = "glue-rds-sqlserver-connection-tf"
		73 |   description = "Secuity Group for Glue-RDS-Connection"
		74 |   vpc_id      = data.aws_vpc.shared.id
		75 | 
		76 |   tags = merge(
		77 |     local.tags,
		78 |     {
		79 |       Resource_Type = "Secuity Group for Glue-RDS-Connection",
		80 |     }
		81 |   )
		82 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: module.buddi.module.landing_zone_security_groups.aws_security_group.this
	File: /modules/landing_zone/server_security_group/main.tf:7-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		7  | resource "aws_security_group" "this" {
		8  |   name        = "${var.supplier}-${var.user_name}-inbound-ips"
		9  |   description = "Allowed IP addresses for ${var.user_name} on ${var.supplier} server"
		10 |   vpc_id      = var.vpc_id
		11 | 
		12 |   lifecycle {
		13 |     create_before_destroy = true
		14 |   }
		15 | 
		16 |   tags = merge(
		17 |     var.local_tags,
		18 |     {
		19 |       supplier = var.user_name,
		20 |     },
		21 |   )
		22 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: module.capita.module.landing_zone_security_groups.aws_security_group.this
	File: /modules/landing_zone/server_security_group/main.tf:7-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		7  | resource "aws_security_group" "this" {
		8  |   name        = "${var.supplier}-${var.user_name}-inbound-ips"
		9  |   description = "Allowed IP addresses for ${var.user_name} on ${var.supplier} server"
		10 |   vpc_id      = var.vpc_id
		11 | 
		12 |   lifecycle {
		13 |     create_before_destroy = true
		14 |   }
		15 | 
		16 |   tags = merge(
		17 |     var.local_tags,
		18 |     {
		19 |       supplier = var.user_name,
		20 |     },
		21 |   )
		22 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: module.g4s.module.landing_zone_security_groups.aws_security_group.this
	File: /modules/landing_zone/server_security_group/main.tf:7-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		7  | resource "aws_security_group" "this" {
		8  |   name        = "${var.supplier}-${var.user_name}-inbound-ips"
		9  |   description = "Allowed IP addresses for ${var.user_name} on ${var.supplier} server"
		10 |   vpc_id      = var.vpc_id
		11 | 
		12 |   lifecycle {
		13 |     create_before_destroy = true
		14 |   }
		15 | 
		16 |   tags = merge(
		17 |     var.local_tags,
		18 |     {
		19 |       supplier = var.user_name,
		20 |     },
		21 |   )
		22 | }

dockerfile scan results:

Passed checks: 21, Failed checks: 2, Skipped checks: 0

Check: CKV_DOCKER_2: "Ensure that HEALTHCHECK instructions have been added to container images"
	FAILED for resource: /lambdas/update_log_table/Dockerfile.
	File: /lambdas/update_log_table/Dockerfile:1-9
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/docker-policies/docker-policy-index/ensure-that-healthcheck-instructions-have-been-added-to-container-images

		1 | FROM public.ecr.aws/lambda/python:3.11
		2 | 
		3 | COPY requirements.txt .
		4 | 
		5 | RUN pip install -r requirements.txt --target "${LAMBDA_TASK_ROOT}"
		6 | 
		7 | COPY update_log_table.py ${LAMBDA_TASK_ROOT}
		8 | 
		9 | CMD ["update_log_table.handler"]

Check: CKV_DOCKER_3: "Ensure that a user for the container has been created"
	FAILED for resource: /lambdas/update_log_table/Dockerfile.
	File: /lambdas/update_log_table/Dockerfile:1-9
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/docker-policies/docker-policy-index/ensure-that-a-user-for-the-container-has-been-created

		1 | FROM public.ecr.aws/lambda/python:3.11
		2 | 
		3 | COPY requirements.txt .
		4 | 
		5 | RUN pip install -r requirements.txt --target "${LAMBDA_TASK_ROOT}"
		6 | 
		7 | COPY update_log_table.py ${LAMBDA_TASK_ROOT}
		8 | 
		9 | CMD ["update_log_table.handler"]


checkov_exitcode=1

CTFLint Scan Failed

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
terraform/environments/electronic-monitoring-data

*****************************

Running tflint in terraform/environments/electronic-monitoring-data
Excluding the following checks: terraform_unused_declarations
3 issue(s) found:

Warning: Missing version constraint for provider "archive" in `required_providers` (terraform_required_providers)

  on terraform/environments/electronic-monitoring-data/data_store.tf line 151:
 151: data "archive_file" "summarise_zip_lambda" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

Warning: `s3_pylib_dir_path` variable has no type (terraform_typed_variables)

  on terraform/environments/electronic-monitoring-data/glue_variables.tf line 1:
   1: variable "s3_pylib_dir_path" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_typed_variables.md

Warning: Missing version constraint for provider "random" in `required_providers` (terraform_required_providers)

  on terraform/environments/electronic-monitoring-data/server_backups.tf line 13:
  13: resource "random_password" "random_password" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

tflint_exitcode=2

Trivy Scan Failed

Show Output

*****************************

Trivy will check the following folders:
terraform/environments/electronic-monitoring-data

*****************************

Running Trivy in terraform/environments/electronic-monitoring-data
2024-10-17T09:33:18Z	INFO	[vulndb] Need to update DB
2024-10-17T09:33:18Z	INFO	[vulndb] Downloading vulnerability DB...
2024-10-17T09:33:18Z	INFO	[vulndb] Downloading artifact...	repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-17T09:33:20Z	INFO	[vulndb] Artifact successfully downloaded	repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-17T09:33:20Z	INFO	[vuln] Vulnerability scanning is enabled
2024-10-17T09:33:20Z	INFO	[misconfig] Misconfiguration scanning is enabled
2024-10-17T09:33:20Z	INFO	[misconfig] Need to update the built-in checks
2024-10-17T09:33:20Z	INFO	[misconfig] Downloading the built-in checks...
2024-10-17T09:33:21Z	ERROR	[misconfig] Falling back to embedded checks	err="failed to download built-in policies: download error: oci download error: failed to fetch the layer: GET https://ghcr.io/v2/aquasecurity/trivy-checks/blobs/sha256:16957b935ef82529bc26f3ceeeb60d798c90ef142d25e3715ab4478b204ed1bb: TOOMANYREQUESTS: retry-after: 461.518µs, allowed: 44000/minute"
2024-10-17T09:33:21Z	INFO	[secret] Secret scanning is enabled
2024-10-17T09:33:21Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-17T09:33:21Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-10-17T09:33:22Z	INFO	[terraform scanner] Scanning root module	file_path="."
2024-10-17T09:33:22Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="networking"
2024-10-17T09:33:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T09:33:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T09:33:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T09:33:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T09:33:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T09:33:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T09:33:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T09:33:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T09:33:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T09:33:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T09:33:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.aws_s3_object.user_public_keys" value="cty.NilVal"
2024-10-17T09:33:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.data.aws_subnet.local_account" value="cty.NilVal"
2024-10-17T09:33:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-17T09:33:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T09:33:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T09:33:27Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T09:33:27Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T09:33:27Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T09:33:27Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T09:33:27Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T09:33:27Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T09:33:27Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T09:33:27Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T09:33:27Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T09:33:27Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T09:33:27Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T09:33:27Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T09:33:27Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T09:33:27Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T09:33:27Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T09:33:27Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T09:33:27Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T09:33:27Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T09:33:27Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T09:33:27Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T09:33:27Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T09:33:27Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T09:33:27Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T09:33:27Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T09:33:27Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T09:33:27Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T09:33:27Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T09:33:27Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T09:33:27Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T09:33:27Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T09:33:27Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T09:33:27Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T09:33:27Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T09:33:27Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T09:33:27Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T09:33:27Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T09:33:27Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T09:33:27Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T09:33:27Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T09:33:27Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T09:33:27Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T09:33:27Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T09:33:27Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T09:33:27Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T09:33:27Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T09:33:27Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T09:33:27Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T09:33:27Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T09:33:27Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T09:33:27Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T09:33:31Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-bucket-encryption" range="s3.tf:1061-1080"
2024-10-17T09:33:31Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-logging" range="s3.tf:1061-1080"
2024-10-17T09:33:31Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-versioning" range="s3.tf:1061-1080"
2024-10-17T09:33:31Z	INFO	[terraform executor] Ignore finding	rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:281-286"
2024-10-17T09:33:31Z	INFO	[terraform executor] Ignore finding	rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:407-411"
2024-10-17T09:33:31Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-17T09:33:31Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-17T09:33:31Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T09:33:31Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T09:33:31Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T09:33:31Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T09:33:31Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T09:33:31Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T09:33:31Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T09:33:31Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T09:33:31Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T09:33:31Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T09:33:31Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T09:33:31Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=95ed3c3/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=568694e50e03630d99cb569eafa06a0b879a1239/main.tf:171-179"
2024-10-17T09:33:31Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="s3.tf:1061-1080"
2024-10-17T09:33:32Z	WARN	[pip] Unable to find python `site-packages` directory. License detection is skipped.	err="site-packages directory not found"
2024-10-17T09:33:32Z	INFO	Number of language-specific files	num=1
2024-10-17T09:33:32Z	INFO	[pip] Detecting vulnerabilities...
2024-10-17T09:33:32Z	INFO	Detected config files	num=17

lambdas/update_log_table/Dockerfile (dockerfile)
================================================
Tests: 20 (SUCCESSES: 19, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Specify at least 1 USER command in Dockerfile with non-root user as argument
════════════════════════════════════════
Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

See https://avd.aquasec.com/misconfig/ds002
────────────────────────────────────────


trivy_exitcode=1

[github-actions]

Trivy Scan Failed

Show Output

```hcl

---

Trivy will check the following folders:
terraform/environments/electronic-monitoring-data

---

Running Trivy in terraform/environments/electronic-monitoring-data
2024-10-17T14:45:33Z INFO [vulndb] Need to update DB
2024-10-17T14:45:33Z INFO [vulndb] Downloading vulnerability DB...
2024-10-17T14:45:33Z INFO [vulndb] Downloading artifact... repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-17T14:45:35Z INFO [vulndb] Artifact successfully downloaded repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-17T14:45:35Z INFO [vuln] Vulnerability scanning is enabled
2024-10-17T14:45:35Z INFO [misconfig] Misconfiguration scanning is enabled
2024-10-17T14:45:35Z INFO [misconfig] Need to update the built-in checks
2024-10-17T14:45:35Z INFO [misconfig] Downloading the built-in checks...
156.02 KiB / 156.02 KiB [---------------------------------------------------------] 100.00% ? p/s 0s2024-10-17T14:45:35Z INFO [secret] Secret scanning is enabled
2024-10-17T14:45:35Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-17T14:45:35Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-10-17T14:45:37Z INFO [terraform scanner] Scanning root module file_path="."
2024-10-17T14:45:37Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="networking"
2024-10-17T14:45:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T14:45:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T14:45:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T14:45:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T14:45:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T14:45:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T14:45:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T14:45:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T14:45:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T14:45:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T14:45:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.aws_s3_object.user_public_keys" value="cty.NilVal"
2024-10-17T14:45:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.data.aws_subnet.local_account" value="cty.NilVal"
2024-10-17T14:45:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-17T14:45:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T14:45:39Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T14:45:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T14:45:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T14:45:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T14:45:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T14:45:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T14:45:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T14:45:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T14:45:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T14:45:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T14:45:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T14:45:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T14:45:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T14:45:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T14:45:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T14:45:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T14:45:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T14:45:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T14:45:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T14:45:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T14:45:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T14:45:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T14:45:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T14:45:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T14:45:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T14:45:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T14:45:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T14:45:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T14:45:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T14:45:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T14:45:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T14:45:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T14:45:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T14:45:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T14:45:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T14:45:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T14:45:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T14:45:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T14:45:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T14:45:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T14:45:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T14:45:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T14:45:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T14:45:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T14:45:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T14:45:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T14:45:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T14:45:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T14:45:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T14:45:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T14:45:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T14:45:44Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T14:45:44Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T14:45:44Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T14:45:44Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T14:45:44Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T14:45:44Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T14:45:44Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T14:45:44Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T14:45:44Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T14:45:44Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T14:45:44Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T14:45:44Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=95ed3c3/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=568694e50e03630d99cb569eafa06a0b879a1239/main.tf:171-179"
2024-10-17T14:45:44Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="s3.tf:1061-1080"
2024-10-17T14:45:44Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-versioning" range="s3.tf:1061-1080"
2024-10-17T14:45:44Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-bucket-encryption" range="s3.tf:1061-1080"
2024-10-17T14:45:44Z INFO [terraform executor] Ignore finding rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:281-286"
2024-10-17T14:45:44Z INFO [terraform executor] Ignore finding rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:407-411"
2024-10-17T14:45:44Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-17T14:45:44Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-17T14:45:44Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-logging" range="s3.tf:1061-1080"
2024-10-17T14:45:44Z WARN [pip] Unable to find python site-packages directory. License detection is skipped. err="site-packages directory not found"
2024-10-17T14:45:44Z INFO Number of language-specific files num=1
2024-10-17T14:45:44Z INFO [pip] Detecting vulnerabilities...
2024-10-17T14:45:44Z INFO Detected config files num=17

lambdas/update_log_table/Dockerfile (dockerfile)

Tests: 20 (SUCCESSES: 19, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Specify at least 1 USER command in Dockerfile with non-root user as argument
════════════════════════════════════════
Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

See https://avd.aquasec.com/misconfig/ds002
────────────────────────────────────────

trivy_exitcode=1

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/electronic-monitoring-data

*****************************

Running Checkov in terraform/environments/electronic-monitoring-data
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2024-10-17 14:45:47,430 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=95ed3c3:None (for external modules, the --download-external-modules flag is required)
2024-10-17 14:45:47,430 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060:None (for external modules, the --download-external-modules flag is required)
2024-10-17 14:45:47,430 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/secrets-manager/aws:1.3.0 (for external modules, the --download-external-modules flag is required)
2024-10-17 14:45:47,431 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=52a40b0:None (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 2272, Failed checks: 75, Skipped checks: 35

Check: CKV_AWS_26: "Ensure all data stored in the SNS topic is encrypted"
	FAILED for resource: aws_sns_topic.s3_events
	File: /data_store.tf:17-19
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-15

		17 | resource "aws_sns_topic" "s3_events" {
		18 |   name = "${module.s3-data-bucket.bucket.id}-object-created-topic"
		19 | }

Check: CKV_AWS_115: "Ensure that AWS Lambda function is configured for function-level concurrent execution limit"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-function-level-concurrent-execution-limit

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_173: "Check encryption settings for Lambda environmental variable"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-5

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_116: "Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-a-dead-letter-queue-dlq

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_272: "Ensure AWS Lambda function is configured to validate code-signing"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-272

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_117: "Ensure that AWS Lambda function is configured inside a VPC"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-inside-a-vpc-1

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_115: "Ensure that AWS Lambda function is configured for function-level concurrent execution limit"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-function-level-concurrent-execution-limit

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_116: "Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-a-dead-letter-queue-dlq

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_272: "Ensure AWS Lambda function is configured to validate code-signing"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-272

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_117: "Ensure that AWS Lambda function is configured inside a VPC"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-inside-a-vpc-1

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group
	File: /dms_data_validation_glue_job.tf:65-68
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		65 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group" {
		66 |   name              = "dms-dv-glue-job"
		67 |   retention_in_days = 14
		68 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group
	File: /dms_data_validation_glue_job.tf:65-68
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		65 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group" {
		66 |   name              = "dms-dv-glue-job"
		67 |   retention_in_days = 14
		68 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group_v2
	File: /dms_data_validation_glue_job.tf:70-73
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		70 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group_v2" {
		71 |   name              = "dms-dv-glue-job-v2"
		72 |   retention_in_days = 14
		73 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group_v2
	File: /dms_data_validation_glue_job.tf:70-73
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		70 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group_v2" {
		71 |   name              = "dms-dv-glue-job-v2"
		72 |   retention_in_days = 14
		73 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.rds_to_s3_parquet_migration
	File: /dms_data_validation_glue_job.tf:75-78
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		75 | resource "aws_cloudwatch_log_group" "rds_to_s3_parquet_migration" {
		76 |   name              = "rds-to-s3-parquet-migration"
		77 |   retention_in_days = 14
		78 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.rds_to_s3_parquet_migration
	File: /dms_data_validation_glue_job.tf:75-78
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		75 | resource "aws_cloudwatch_log_group" "rds_to_s3_parquet_migration" {
		76 |   name              = "rds-to-s3-parquet-migration"
		77 |   retention_in_days = 14
		78 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.resizing_parquet_files
	File: /dms_data_validation_glue_job.tf:80-83
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		80 | resource "aws_cloudwatch_log_group" "resizing_parquet_files" {
		81 |   name              = "resizing-parquet-files"
		82 |   retention_in_days = 14
		83 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.resizing_parquet_files
	File: /dms_data_validation_glue_job.tf:80-83
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		80 | resource "aws_cloudwatch_log_group" "resizing_parquet_files" {
		81 |   name              = "resizing-parquet-files"
		82 |   retention_in_days = 14
		83 | }

Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.dms_dv_glue_job_v2
	File: /dms_data_validation_glue_job.tf:86-140
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.dms_dv_glue_job_v4d
	File: /dms_data_validation_glue_job.tf:148-201
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.rds_to_s3_parquet_migration
	File: /dms_data_validation_glue_job.tf:204-268
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.rds_to_s3_parquet_migration_monthly
	File: /dms_data_validation_glue_job.tf:272-326
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.resizing_parquet_files
	File: /dms_data_validation_glue_job.tf:329-381
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.catalog_dv_table_glue_job
	File: /dms_data_validation_glue_job.tf:384-412
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		384 | resource "aws_glue_job" "catalog_dv_table_glue_job" {
		385 |   name              = "catalog-dv-table-glue-job"
		386 |   description       = "Python script uses Boto3-Athena-Client to run sql-statements"
		387 |   role_arn          = aws_iam_role.dms_dv_glue_job_iam_role.arn
		388 |   glue_version      = "4.0"
		389 |   worker_type       = "G.1X"
		390 |   number_of_workers = 2
		391 |   default_arguments = {
		392 |     "--parquet_output_bucket_name"       = module.s3-dms-data-validation-bucket.bucket.id
		393 |     "--glue_catalog_db_name"             = aws_glue_catalog_database.dms_dv_glue_catalog_db.name
		394 |     "--glue_catalog_tbl_name"            = "glue_df_output"
		395 |     "--continuous-log-logGroup"          = aws_cloudwatch_log_group.dms_dv_cw_log_group.name
		396 |     "--enable-continuous-cloudwatch-log" = "true"
		397 |     "--enable-continuous-log-filter"     = "true"
		398 |     "--enable-metrics"                   = ""
		399 |   }
		400 |   command {
		401 |     python_version  = "3"
		402 |     script_location = "s3://${module.s3-glue-job-script-bucket.bucket.id}/create_or_replace_dv_table.py"
		403 |   }
		404 | 
		405 |   tags = merge(
		406 |     local.tags,
		407 |     {
		408 |       Resource_Type = "Py script as glue-job that creates dv table / refreshes its partitions",
		409 |     }
		410 |   )
		411 | 
		412 | }

Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_crawler.rds_sqlserver_db_glue_crawler
	File: /dms_glue_crawler.tf:35-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		35 | resource "aws_glue_crawler" "rds_sqlserver_db_glue_crawler" {
		36 |   name          = "rds-sqlserver-${aws_db_instance.database_2022.identifier}-tf"
		37 |   role          = aws_iam_role.dms_dv_glue_job_iam_role.arn
		38 |   database_name = aws_glue_catalog_database.rds_sqlserver_glue_catalog_db.name
		39 |   description   = "Crawler to fetch database names"
		40 |   #   table_prefix  = "your_table_prefix"
		41 | 
		42 |   jdbc_target {
		43 |     connection_name = aws_glue_connection.glue_rds_sqlserver_db_connection.name
		44 |     path            = "%"
		45 |   }
		46 |   tags = merge(
		47 |     local.tags,
		48 |     {
		49 |       Resource_Type = "RDS-SQLServer Glue-Crawler for DMS",
		50 |     }
		51 |   )
		52 | 
		53 |   # provisioner "local-exec" {
		54 |   #   command = "aws glue start-crawler --name ${self.name}"
		55 |   # }
		56 | }

Check: CKV_AWS_212: "Ensure DMS replication instance is encrypted by KMS using a customer managed Key (CMK)"
	FAILED for resource: aws_dms_replication_instance.dms_replication_instance
	File: /dms_replication_instance.tf:24-55
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-ebs-volume-is-encrypted-by-key-management-service-kms-using-a-customer-managed-key-cmk

		24 | resource "aws_dms_replication_instance" "dms_replication_instance" {
		25 |   allocated_storage          = var.dms_allocated_storage_gib
		26 |   apply_immediately          = true
		27 |   auto_minor_version_upgrade = true
		28 |   availability_zone          = var.dms_availability_zone
		29 |   engine_version             = var.dms_engine_version
		30 |   #   kms_key_arn                  = "arn:aws:kms:eu-west-2:800964199911:key/b7f54acb-16a3-4958-9340-3bdf5f5842d8"
		31 |   multi_az = false
		32 |   #   preferred_maintenance_window = "sun:10:30-sun:14:30"
		33 |   publicly_accessible         = false
		34 |   replication_instance_class  = var.dms_replication_instance_class
		35 |   replication_instance_id     = "dms-replication-instance-tf"
		36 |   replication_subnet_group_id = aws_dms_replication_subnet_group.dms_replication_subnet_group.id
		37 | 
		38 |   tags = merge(
		39 |     local.tags,
		40 |     {
		41 |       Resource_Type = "DMS Replication Instance",
		42 |     }
		43 |   )
		44 | 
		45 |   vpc_security_group_ids = [
		46 |     aws_security_group.dms_ri_security_group.id,
		47 |   ]
		48 | 
		49 |   depends_on = [
		50 |     aws_iam_role.dms_vpc_role,
		51 |     aws_iam_role.dms_cloudwatch_logs_role,
		52 |     aws_iam_role.dms_endpoint_role
		53 |   ]
		54 | 
		55 | }

Check: CKV_AWS_260: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 80"
	FAILED for resource: aws_vpc_security_group_ingress_rule.glue_rds_conn_inbound
	File: /dms_security_groups.tf:95-103
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-aws-security-groups-do-not-allow-ingress-from-00000-to-port-80

		95  | resource "aws_vpc_security_group_ingress_rule" "glue_rds_conn_inbound" {
		96  |   security_group_id = aws_security_group.glue_rds_conn_security_group.id
		97  | 
		98  |   referenced_security_group_id = aws_security_group.glue_rds_conn_security_group.id
		99  |   ip_protocol                  = "tcp"
		100 |   from_port                    = 0
		101 |   to_port                      = 65535
		102 |   description                  = "Required ports open for Glue-RDS-Connection"
		103 | }

Check: CKV_AWS_24: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 22"
	FAILED for resource: aws_vpc_security_group_ingress_rule.glue_rds_conn_inbound
	File: /dms_security_groups.tf:95-103
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-1-port-security

		95  | resource "aws_vpc_security_group_ingress_rule" "glue_rds_conn_inbound" {
		96  |   security_group_id = aws_security_group.glue_rds_conn_security_group.id
		97  | 
		98  |   referenced_security_group_id = aws_security_group.glue_rds_conn_security_group.id
		99  |   ip_protocol                  = "tcp"
		100 |   from_port                    = 0
		101 |   to_port                      = 65535
		102 |   description                  = "Required ports open for Glue-RDS-Connection"
		103 | }

Check: CKV_AWS_25: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389"
	FAILED for resource: aws_vpc_security_group_ingress_rule.glue_rds_conn_inbound
	File: /dms_security_groups.tf:95-103
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-2

		95  | resource "aws_vpc_security_group_ingress_rule" "glue_rds_conn_inbound" {
		96  |   security_group_id = aws_security_group.glue_rds_conn_security_group.id
		97  | 
		98  |   referenced_security_group_id = aws_security_group.glue_rds_conn_security_group.id
		99  |   ip_protocol                  = "tcp"
		100 |   from_port                    = 0
		101 |   to_port                      = 65535
		102 |   description                  = "Required ports open for Glue-RDS-Connection"
		103 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.glue_notebook_ec2_iam_policy_document
	File: /glue_data.tf:103-118
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		103 | data "aws_iam_policy_document" "glue_notebook_ec2_iam_policy_document" {
		104 |   statement {
		105 |     effect = "Allow"
		106 |     actions = [
		107 |       "ec2:CreateNetworkInterface",
		108 |       "ec2:DescribeNetworkInterfaces",
		109 |       "ec2:DeleteNetworkInterface",
		110 |       "ec2:DescribeVpcEndpoints",
		111 |       "ec2:DescribeSubnets",
		112 |       "ec2:DescribeVpcAttribute",
		113 |       "ec2:DescribeRouteTables",
		114 |       "ec2:DescribeSecurityGroups"
		115 |     ]
		116 |     resources = ["*"]
		117 |   }
		118 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.glue_notebook_ec2_iam_policy_document
	File: /glue_data.tf:103-118
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		103 | data "aws_iam_policy_document" "glue_notebook_ec2_iam_policy_document" {
		104 |   statement {
		105 |     effect = "Allow"
		106 |     actions = [
		107 |       "ec2:CreateNetworkInterface",
		108 |       "ec2:DescribeNetworkInterfaces",
		109 |       "ec2:DeleteNetworkInterface",
		110 |       "ec2:DescribeVpcEndpoints",
		111 |       "ec2:DescribeSubnets",
		112 |       "ec2:DescribeVpcAttribute",
		113 |       "ec2:DescribeRouteTables",
		114 |       "ec2:DescribeSecurityGroups"
		115 |     ]
		116 |     resources = ["*"]
		117 |   }
		118 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.load_json_table_s3_policy_document
	File: /lambdas_iam.tf:430-487
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.load_json_table_s3_policy_document
	File: /lambdas_iam.tf:430-487
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.db_glue_connection
	File: /lambdas_secrets.tf:1-3
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		1 | resource "aws_secretsmanager_secret" "db_glue_connection" {
		2 |   name = "db_glue_connection"
		3 | }

Check: CKV_AWS_296: "Ensure DMS endpoint uses Customer Managed Key (CMK)"
	FAILED for resource: module.dms_task.aws_dms_endpoint.dms_rds_source
	File: /modules/dms/endpoints_rds_s3.tf:2-23
	Calling File: /dms_main.tf:1-39
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-296

		2  | resource "aws_dms_endpoint" "dms_rds_source" {
		3  | 
		4  |   #   certificate_arn             = ""
		5  |   database_name = var.database_name
		6  |   endpoint_id   = "rds-mssql-${replace(var.database_name, "_", "-")}-tf"
		7  |   endpoint_type = "source"
		8  |   engine_name   = "sqlserver"
		9  |   #   extra_connection_attributes = ""
		10 |   #   kms_key_arn                 = aws_db_instance.database_2022.kms_key_id
		11 |   password    = var.rds_db_instance_pasword
		12 |   port        = var.rds_db_instance_port
		13 |   server_name = var.rds_db_server_name
		14 |   ssl_mode    = "require"
		15 |   username    = var.rds_db_username
		16 | 
		17 |   tags = merge(
		18 |     var.local_tags,
		19 |     {
		20 |       Resource_Type = "DMS Source Endpoint - RDS MSSQL",
		21 |     },
		22 |   )
		23 | }

Check: CKV_AWS_298: "Ensure DMS S3 uses Customer Managed Key (CMK)"
	FAILED for resource: module.dms_task.aws_dms_s3_endpoint.dms_s3_parquet_target
	File: /modules/dms/endpoints_rds_s3.tf:28-84
	Calling File: /dms_main.tf:1-39
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-298

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: module.athena_layer.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-8
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: module.athena_layer.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-8
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.athena_layer.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:39-48
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		39 | data "aws_iam_policy_document" "step_function_base_permissions" {
		40 |   statement {
		41 |     effect = "Allow"
		42 |     actions = [
		43 |       "sns:Publish",
		44 |       "sqs:SendMessage"
		45 |     ]
		46 |     resources = ["*"]
		47 |   }
		48 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.athena_layer.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:39-48
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		39 | data "aws_iam_policy_document" "step_function_base_permissions" {
		40 |   statement {
		41 |     effect = "Allow"
		42 |     actions = [
		43 |       "sns:Publish",
		44 |       "sqs:SendMessage"
		45 |     ]
		46 |     resources = ["*"]
		47 |   }
		48 | }

Check: CKV_AWS_109: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: module.athena_layer.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:55-79
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-permissions-management-resource-exposure-without-constraint

		55 | data "aws_iam_policy_document" "this_log_key_document" {
		56 |   statement {
		57 |     sid    = "EnableIAMUserPermissions"
		58 |     effect = "Allow"
		59 |     principals {
		60 |       type        = "AWS"
		61 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		62 |     }
		63 |     actions   = ["kms:*"]
		64 |     resources = ["*"]
		65 |   }
		66 | 
		67 |   statement {
		68 |     sid    = "EnableLogServicePermissions"
		69 |     effect = "Allow"
		70 |     principals {
		71 |       type        = "Service"
		72 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		73 |     }
		74 |     actions = [
		75 |       "kms:*",
		76 |     ]
		77 |     resources = ["*"]
		78 |   }
		79 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.athena_layer.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:55-79
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		55 | data "aws_iam_policy_document" "this_log_key_document" {
		56 |   statement {
		57 |     sid    = "EnableIAMUserPermissions"
		58 |     effect = "Allow"
		59 |     principals {
		60 |       type        = "AWS"
		61 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		62 |     }
		63 |     actions   = ["kms:*"]
		64 |     resources = ["*"]
		65 |   }
		66 | 
		67 |   statement {
		68 |     sid    = "EnableLogServicePermissions"
		69 |     effect = "Allow"
		70 |     principals {
		71 |       type        = "Service"
		72 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		73 |     }
		74 |     actions = [
		75 |       "kms:*",
		76 |     ]
		77 |     resources = ["*"]
		78 |   }
		79 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.athena_layer.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:55-79
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		55 | data "aws_iam_policy_document" "this_log_key_document" {
		56 |   statement {
		57 |     sid    = "EnableIAMUserPermissions"
		58 |     effect = "Allow"
		59 |     principals {
		60 |       type        = "AWS"
		61 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		62 |     }
		63 |     actions   = ["kms:*"]
		64 |     resources = ["*"]
		65 |   }
		66 | 
		67 |   statement {
		68 |     sid    = "EnableLogServicePermissions"
		69 |     effect = "Allow"
		70 |     principals {
		71 |       type        = "Service"
		72 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		73 |     }
		74 |     actions = [
		75 |       "kms:*",
		76 |     ]
		77 |     resources = ["*"]
		78 |   }
		79 | }

Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: module.get_zipped_file.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-8
	Calling File: /step_functions_main.tf:38-48
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: module.get_zipped_file.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-8
	Calling File: /step_functions_main.tf:38-48
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:39-48
	Calling File: /step_functions_main.tf:38-48
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		39 | data "aws_iam_policy_document" "step_function_base_permissions" {
		40 |   statement {
		41 |     effect = "Allow"
		42 |     actions = [
		43 |       "sns:Publish",
		44 |       "sqs:SendMessage"
		45 |     ]
		46 |     resources = ["*"]
		47 |   }
		48 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:39-48
	Calling File: /step_functions_main.tf:38-48
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		39 | data "aws_iam_policy_document" "step_function_base_permissions" {
		40 |   statement {
		41 |     effect = "Allow"
		42 |     actions = [
		43 |       "sns:Publish",
		44 |       "sqs:SendMessage"
		45 |     ]
		46 |     resources = ["*"]
		47 |   }
		48 | }

Check: CKV_AWS_109: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:55-79
	Calling File: /step_functions_main.tf:38-48
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-permissions-management-resource-exposure-without-constraint

		55 | data "aws_iam_policy_document" "this_log_key_document" {
		56 |   statement {
		57 |     sid    = "EnableIAMUserPermissions"
		58 |     effect = "Allow"
		59 |     principals {
		60 |       type        = "AWS"
		61 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		62 |     }
		63 |     actions   = ["kms:*"]
		64 |     resources = ["*"]
		65 |   }
		66 | 
		67 |   statement {
		68 |     sid    = "EnableLogServicePermissions"
		69 |     effect = "Allow"
		70 |     principals {
		71 |       type        = "Service"
		72 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		73 |     }
		74 |     actions = [
		75 |       "kms:*",
		76 |     ]
		77 |     resources = ["*"]
		78 |   }
		79 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:55-79
	Calling File: /step_functions_main.tf:38-48
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		55 | data "aws_iam_policy_document" "this_log_key_document" {
		56 |   statement {
		57 |     sid    = "EnableIAMUserPermissions"
		58 |     effect = "Allow"
		59 |     principals {
		60 |       type        = "AWS"
		61 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		62 |     }
		63 |     actions   = ["kms:*"]
		64 |     resources = ["*"]
		65 |   }
		66 | 
		67 |   statement {
		68 |     sid    = "EnableLogServicePermissions"
		69 |     effect = "Allow"
		70 |     principals {
		71 |       type        = "Service"
		72 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		73 |     }
		74 |     actions = [
		75 |       "kms:*",
		76 |     ]
		77 |     resources = ["*"]
		78 |   }
		79 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:55-79
	Calling File: /step_functions_main.tf:38-48
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		55 | data "aws_iam_policy_document" "this_log_key_document" {
		56 |   statement {
		57 |     sid    = "EnableIAMUserPermissions"
		58 |     effect = "Allow"
		59 |     principals {
		60 |       type        = "AWS"
		61 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		62 |     }
		63 |     actions   = ["kms:*"]
		64 |     resources = ["*"]
		65 |   }
		66 | 
		67 |   statement {
		68 |     sid    = "EnableLogServicePermissions"
		69 |     effect = "Allow"
		70 |     principals {
		71 |       type        = "Service"
		72 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		73 |     }
		74 |     actions = [
		75 |       "kms:*",
		76 |     ]
		77 |     resources = ["*"]
		78 |   }
		79 | }

Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: module.send_database_to_ap.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-8
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: module.send_database_to_ap.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-8
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.send_database_to_ap.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:39-48
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		39 | data "aws_iam_policy_document" "step_function_base_permissions" {
		40 |   statement {
		41 |     effect = "Allow"
		42 |     actions = [
		43 |       "sns:Publish",
		44 |       "sqs:SendMessage"
		45 |     ]
		46 |     resources = ["*"]
		47 |   }
		48 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.send_database_to_ap.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:39-48
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		39 | data "aws_iam_policy_document" "step_function_base_permissions" {
		40 |   statement {
		41 |     effect = "Allow"
		42 |     actions = [
		43 |       "sns:Publish",
		44 |       "sqs:SendMessage"
		45 |     ]
		46 |     resources = ["*"]
		47 |   }
		48 | }

Check: CKV_AWS_109: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: module.send_database_to_ap.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:55-79
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-permissions-management-resource-exposure-without-constraint

		55 | data "aws_iam_policy_document" "this_log_key_document" {
		56 |   statement {
		57 |     sid    = "EnableIAMUserPermissions"
		58 |     effect = "Allow"
		59 |     principals {
		60 |       type        = "AWS"
		61 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		62 |     }
		63 |     actions   = ["kms:*"]
		64 |     resources = ["*"]
		65 |   }
		66 | 
		67 |   statement {
		68 |     sid    = "EnableLogServicePermissions"
		69 |     effect = "Allow"
		70 |     principals {
		71 |       type        = "Service"
		72 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		73 |     }
		74 |     actions = [
		75 |       "kms:*",
		76 |     ]
		77 |     resources = ["*"]
		78 |   }
		79 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.send_database_to_ap.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:55-79
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		55 | data "aws_iam_policy_document" "this_log_key_document" {
		56 |   statement {
		57 |     sid    = "EnableIAMUserPermissions"
		58 |     effect = "Allow"
		59 |     principals {
		60 |       type        = "AWS"
		61 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		62 |     }
		63 |     actions   = ["kms:*"]
		64 |     resources = ["*"]
		65 |   }
		66 | 
		67 |   statement {
		68 |     sid    = "EnableLogServicePermissions"
		69 |     effect = "Allow"
		70 |     principals {
		71 |       type        = "Service"
		72 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		73 |     }
		74 |     actions = [
		75 |       "kms:*",
		76 |     ]
		77 |     resources = ["*"]
		78 |   }
		79 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.send_database_to_ap.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:55-79
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		55 | data "aws_iam_policy_document" "this_log_key_document" {
		56 |   statement {
		57 |     sid    = "EnableIAMUserPermissions"
		58 |     effect = "Allow"
		59 |     principals {
		60 |       type        = "AWS"
		61 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		62 |     }
		63 |     actions   = ["kms:*"]
		64 |     resources = ["*"]
		65 |   }
		66 | 
		67 |   statement {
		68 |     sid    = "EnableLogServicePermissions"
		69 |     effect = "Allow"
		70 |     principals {
		71 |       type        = "Service"
		72 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		73 |     }
		74 |     actions = [
		75 |       "kms:*",
		76 |     ]
		77 |     resources = ["*"]
		78 |   }
		79 | }

Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.db_password
	File: /server_backups.tf:4-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		4 | resource "aws_secretsmanager_secret" "db_password" {
		5 |   name = "db_password"
		6 | }

Check: CKV_AWS_354: "Ensure RDS Performance Insights are encrypted using KMS CMKs"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-354

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_157: "Ensure that RDS instances have Multi-AZ enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-73

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_118: "Ensure that enhanced monitoring is enabled for Amazon RDS instances"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/ensure-that-enhanced-monitoring-is-enabled-for-amazon-rds-instances

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_353: "Ensure that RDS instances have performance insights enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-353

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_293: "Ensure that AWS database instances have deletion protection enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-293

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_129: "Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-that-respective-logs-of-amazon-relational-database-service-amazon-rds-are-enabled

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.send_database_to_ap
	File: /step_functions_iam.tf:44-118
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.send_database_to_ap
	File: /step_functions_iam.tf:44-118
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.db_glue_connection
	File: /lambdas_secrets.tf:1-3
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		1 | resource "aws_secretsmanager_secret" "db_glue_connection" {
		2 |   name = "db_glue_connection"
		3 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.db_password
	File: /server_backups.tf:4-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		4 | resource "aws_secretsmanager_secret" "db_password" {
		5 |   name = "db_password"
		6 | }

Check: CKV2_AWS_60: "Ensure RDS instance with copy tags to snapshots is enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-60

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: aws_security_group.glue_rds_conn_security_group
	File: /dms_security_groups.tf:71-82
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		71 | resource "aws_security_group" "glue_rds_conn_security_group" {
		72 |   name        = "glue-rds-sqlserver-connection-tf"
		73 |   description = "Secuity Group for Glue-RDS-Connection"
		74 |   vpc_id      = data.aws_vpc.shared.id
		75 | 
		76 |   tags = merge(
		77 |     local.tags,
		78 |     {
		79 |       Resource_Type = "Secuity Group for Glue-RDS-Connection",
		80 |     }
		81 |   )
		82 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: module.buddi.module.landing_zone_security_groups.aws_security_group.this
	File: /modules/landing_zone/server_security_group/main.tf:7-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		7  | resource "aws_security_group" "this" {
		8  |   name        = "${var.supplier}-${var.user_name}-inbound-ips"
		9  |   description = "Allowed IP addresses for ${var.user_name} on ${var.supplier} server"
		10 |   vpc_id      = var.vpc_id
		11 | 
		12 |   lifecycle {
		13 |     create_before_destroy = true
		14 |   }
		15 | 
		16 |   tags = merge(
		17 |     var.local_tags,
		18 |     {
		19 |       supplier = var.user_name,
		20 |     },
		21 |   )
		22 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: module.capita.module.landing_zone_security_groups.aws_security_group.this
	File: /modules/landing_zone/server_security_group/main.tf:7-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		7  | resource "aws_security_group" "this" {
		8  |   name        = "${var.supplier}-${var.user_name}-inbound-ips"
		9  |   description = "Allowed IP addresses for ${var.user_name} on ${var.supplier} server"
		10 |   vpc_id      = var.vpc_id
		11 | 
		12 |   lifecycle {
		13 |     create_before_destroy = true
		14 |   }
		15 | 
		16 |   tags = merge(
		17 |     var.local_tags,
		18 |     {
		19 |       supplier = var.user_name,
		20 |     },
		21 |   )
		22 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: module.g4s.module.landing_zone_security_groups.aws_security_group.this
	File: /modules/landing_zone/server_security_group/main.tf:7-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		7  | resource "aws_security_group" "this" {
		8  |   name        = "${var.supplier}-${var.user_name}-inbound-ips"
		9  |   description = "Allowed IP addresses for ${var.user_name} on ${var.supplier} server"
		10 |   vpc_id      = var.vpc_id
		11 | 
		12 |   lifecycle {
		13 |     create_before_destroy = true
		14 |   }
		15 | 
		16 |   tags = merge(
		17 |     var.local_tags,
		18 |     {
		19 |       supplier = var.user_name,
		20 |     },
		21 |   )
		22 | }

dockerfile scan results:

Passed checks: 21, Failed checks: 2, Skipped checks: 0

Check: CKV_DOCKER_2: "Ensure that HEALTHCHECK instructions have been added to container images"
	FAILED for resource: /lambdas/update_log_table/Dockerfile.
	File: /lambdas/update_log_table/Dockerfile:1-9
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/docker-policies/docker-policy-index/ensure-that-healthcheck-instructions-have-been-added-to-container-images

		1 | FROM public.ecr.aws/lambda/python:3.11
		2 | 
		3 | COPY requirements.txt .
		4 | 
		5 | RUN pip install -r requirements.txt --target "${LAMBDA_TASK_ROOT}"
		6 | 
		7 | COPY update_log_table.py ${LAMBDA_TASK_ROOT}
		8 | 
		9 | CMD ["update_log_table.handler"]

Check: CKV_DOCKER_3: "Ensure that a user for the container has been created"
	FAILED for resource: /lambdas/update_log_table/Dockerfile.
	File: /lambdas/update_log_table/Dockerfile:1-9
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/docker-policies/docker-policy-index/ensure-that-a-user-for-the-container-has-been-created

		1 | FROM public.ecr.aws/lambda/python:3.11
		2 | 
		3 | COPY requirements.txt .
		4 | 
		5 | RUN pip install -r requirements.txt --target "${LAMBDA_TASK_ROOT}"
		6 | 
		7 | COPY update_log_table.py ${LAMBDA_TASK_ROOT}
		8 | 
		9 | CMD ["update_log_table.handler"]


checkov_exitcode=1

CTFLint Scan Failed

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
terraform/environments/electronic-monitoring-data

*****************************

Running tflint in terraform/environments/electronic-monitoring-data
Excluding the following checks: terraform_unused_declarations
3 issue(s) found:

Warning: Missing version constraint for provider "archive" in `required_providers` (terraform_required_providers)

  on terraform/environments/electronic-monitoring-data/data_store.tf line 151:
 151: data "archive_file" "summarise_zip_lambda" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

Warning: `s3_pylib_dir_path` variable has no type (terraform_typed_variables)

  on terraform/environments/electronic-monitoring-data/glue_variables.tf line 1:
   1: variable "s3_pylib_dir_path" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_typed_variables.md

Warning: Missing version constraint for provider "random" in `required_providers` (terraform_required_providers)

  on terraform/environments/electronic-monitoring-data/server_backups.tf line 13:
  13: resource "random_password" "random_password" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

tflint_exitcode=2

Trivy Scan Failed

Show Output

*****************************

Trivy will check the following folders:
terraform/environments/electronic-monitoring-data

*****************************

Running Trivy in terraform/environments/electronic-monitoring-data
2024-10-17T14:45:33Z	INFO	[vulndb] Need to update DB
2024-10-17T14:45:33Z	INFO	[vulndb] Downloading vulnerability DB...
2024-10-17T14:45:33Z	INFO	[vulndb] Downloading artifact...	repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-17T14:45:35Z	INFO	[vulndb] Artifact successfully downloaded	repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-17T14:45:35Z	INFO	[vuln] Vulnerability scanning is enabled
2024-10-17T14:45:35Z	INFO	[misconfig] Misconfiguration scanning is enabled
2024-10-17T14:45:35Z	INFO	[misconfig] Need to update the built-in checks
2024-10-17T14:45:35Z	INFO	[misconfig] Downloading the built-in checks...
156.02 KiB / 156.02 KiB [---------------------------------------------------------] 100.00% ? p/s 0s2024-10-17T14:45:35Z	INFO	[secret] Secret scanning is enabled
2024-10-17T14:45:35Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-17T14:45:35Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-10-17T14:45:37Z	INFO	[terraform scanner] Scanning root module	file_path="."
2024-10-17T14:45:37Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="networking"
2024-10-17T14:45:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T14:45:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T14:45:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T14:45:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T14:45:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T14:45:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T14:45:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T14:45:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T14:45:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T14:45:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T14:45:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.aws_s3_object.user_public_keys" value="cty.NilVal"
2024-10-17T14:45:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.data.aws_subnet.local_account" value="cty.NilVal"
2024-10-17T14:45:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-17T14:45:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T14:45:39Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T14:45:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T14:45:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T14:45:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T14:45:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T14:45:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T14:45:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T14:45:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T14:45:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T14:45:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T14:45:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T14:45:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T14:45:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T14:45:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T14:45:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T14:45:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T14:45:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T14:45:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T14:45:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T14:45:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T14:45:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T14:45:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T14:45:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T14:45:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T14:45:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T14:45:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T14:45:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T14:45:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T14:45:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T14:45:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T14:45:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T14:45:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T14:45:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T14:45:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T14:45:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T14:45:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T14:45:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T14:45:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T14:45:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T14:45:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T14:45:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T14:45:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T14:45:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T14:45:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T14:45:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T14:45:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T14:45:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T14:45:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T14:45:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T14:45:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T14:45:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T14:45:44Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T14:45:44Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T14:45:44Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T14:45:44Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T14:45:44Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T14:45:44Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T14:45:44Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T14:45:44Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T14:45:44Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T14:45:44Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T14:45:44Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T14:45:44Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=95ed3c3/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=568694e50e03630d99cb569eafa06a0b879a1239/main.tf:171-179"
2024-10-17T14:45:44Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="s3.tf:1061-1080"
2024-10-17T14:45:44Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-versioning" range="s3.tf:1061-1080"
2024-10-17T14:45:44Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-bucket-encryption" range="s3.tf:1061-1080"
2024-10-17T14:45:44Z	INFO	[terraform executor] Ignore finding	rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:281-286"
2024-10-17T14:45:44Z	INFO	[terraform executor] Ignore finding	rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:407-411"
2024-10-17T14:45:44Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-17T14:45:44Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-17T14:45:44Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-logging" range="s3.tf:1061-1080"
2024-10-17T14:45:44Z	WARN	[pip] Unable to find python `site-packages` directory. License detection is skipped.	err="site-packages directory not found"
2024-10-17T14:45:44Z	INFO	Number of language-specific files	num=1
2024-10-17T14:45:44Z	INFO	[pip] Detecting vulnerabilities...
2024-10-17T14:45:44Z	INFO	Detected config files	num=17

lambdas/update_log_table/Dockerfile (dockerfile)
================================================
Tests: 20 (SUCCESSES: 19, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Specify at least 1 USER command in Dockerfile with non-root user as argument
════════════════════════════════════════
Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

See https://avd.aquasec.com/misconfig/ds002
────────────────────────────────────────


trivy_exitcode=1

[github-actions]

Trivy Scan Failed

Show Output

```hcl

---

Trivy will check the following folders:
terraform/environments/electronic-monitoring-data

---

Running Trivy in terraform/environments/electronic-monitoring-data
2024-10-17T16:14:49Z INFO [vulndb] Need to update DB
2024-10-17T16:14:49Z INFO [vulndb] Downloading vulnerability DB...
2024-10-17T16:14:49Z INFO [vulndb] Downloading artifact... repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-17T16:14:51Z INFO [vulndb] Artifact successfully downloaded repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-17T16:14:51Z INFO [vuln] Vulnerability scanning is enabled
2024-10-17T16:14:51Z INFO [misconfig] Misconfiguration scanning is enabled
2024-10-17T16:14:51Z INFO [misconfig] Need to update the built-in checks
2024-10-17T16:14:51Z INFO [misconfig] Downloading the built-in checks...
156.02 KiB / 156.02 KiB [---------------------------------------------------------] 100.00% ? p/s 0s2024-10-17T16:14:51Z INFO [secret] Secret scanning is enabled
2024-10-17T16:14:51Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-17T16:14:51Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-10-17T16:14:52Z INFO [terraform scanner] Scanning root module file_path="."
2024-10-17T16:14:53Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="networking"
2024-10-17T16:14:53Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T16:14:53Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T16:14:53Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T16:14:53Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T16:14:53Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T16:14:53Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T16:14:53Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T16:14:53Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.aws_s3_object.user_public_keys" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.data.aws_subnet.local_account" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T16:14:54Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T16:14:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T16:14:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T16:14:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T16:14:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T16:14:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T16:14:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T16:14:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T16:14:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T16:14:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T16:14:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T16:14:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T16:14:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T16:14:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T16:14:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T16:14:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T16:14:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T16:14:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T16:14:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T16:14:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T16:14:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T16:14:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T16:14:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T16:14:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T16:14:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T16:14:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T16:14:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T16:15:00Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-versioning" range="s3.tf:1061-1080"
2024-10-17T16:15:00Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-bucket-encryption" range="s3.tf:1061-1080"
2024-10-17T16:15:00Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T16:15:00Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T16:15:00Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T16:15:00Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T16:15:00Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T16:15:00Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T16:15:00Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T16:15:00Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T16:15:00Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T16:15:00Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T16:15:00Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T16:15:00Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=95ed3c3/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=568694e50e03630d99cb569eafa06a0b879a1239/main.tf:171-179"
2024-10-17T16:15:00Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="s3.tf:1061-1080"
2024-10-17T16:15:00Z INFO [terraform executor] Ignore finding rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:281-286"
2024-10-17T16:15:00Z INFO [terraform executor] Ignore finding rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:407-411"
2024-10-17T16:15:00Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-17T16:15:00Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-17T16:15:00Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-logging" range="s3.tf:1061-1080"
2024-10-17T16:15:00Z WARN [pip] Unable to find python site-packages directory. License detection is skipped. err="site-packages directory not found"
2024-10-17T16:15:00Z INFO Number of language-specific files num=1
2024-10-17T16:15:00Z INFO [pip] Detecting vulnerabilities...
2024-10-17T16:15:00Z INFO Detected config files num=17

lambdas/update_log_table/Dockerfile (dockerfile)

Tests: 20 (SUCCESSES: 19, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Specify at least 1 USER command in Dockerfile with non-root user as argument
════════════════════════════════════════
Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

See https://avd.aquasec.com/misconfig/ds002
────────────────────────────────────────

trivy_exitcode=1

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/electronic-monitoring-data

*****************************

Running Checkov in terraform/environments/electronic-monitoring-data
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2024-10-17 16:15:03,140 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=95ed3c3:None (for external modules, the --download-external-modules flag is required)
2024-10-17 16:15:03,140 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060:None (for external modules, the --download-external-modules flag is required)
2024-10-17 16:15:03,140 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/secrets-manager/aws:1.3.0 (for external modules, the --download-external-modules flag is required)
2024-10-17 16:15:03,140 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=52a40b0:None (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 2270, Failed checks: 75, Skipped checks: 37

Check: CKV_AWS_26: "Ensure all data stored in the SNS topic is encrypted"
	FAILED for resource: aws_sns_topic.s3_events
	File: /data_store.tf:17-19
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-15

		17 | resource "aws_sns_topic" "s3_events" {
		18 |   name = "${module.s3-data-bucket.bucket.id}-object-created-topic"
		19 | }

Check: CKV_AWS_115: "Ensure that AWS Lambda function is configured for function-level concurrent execution limit"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-function-level-concurrent-execution-limit

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_173: "Check encryption settings for Lambda environmental variable"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-5

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_116: "Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-a-dead-letter-queue-dlq

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_272: "Ensure AWS Lambda function is configured to validate code-signing"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-272

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_117: "Ensure that AWS Lambda function is configured inside a VPC"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-inside-a-vpc-1

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_115: "Ensure that AWS Lambda function is configured for function-level concurrent execution limit"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-function-level-concurrent-execution-limit

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_116: "Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-a-dead-letter-queue-dlq

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_272: "Ensure AWS Lambda function is configured to validate code-signing"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-272

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_117: "Ensure that AWS Lambda function is configured inside a VPC"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-inside-a-vpc-1

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group
	File: /dms_data_validation_glue_job.tf:65-68
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		65 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group" {
		66 |   name              = "dms-dv-glue-job"
		67 |   retention_in_days = 14
		68 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group
	File: /dms_data_validation_glue_job.tf:65-68
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		65 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group" {
		66 |   name              = "dms-dv-glue-job"
		67 |   retention_in_days = 14
		68 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group_v2
	File: /dms_data_validation_glue_job.tf:70-73
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		70 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group_v2" {
		71 |   name              = "dms-dv-glue-job-v2"
		72 |   retention_in_days = 14
		73 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group_v2
	File: /dms_data_validation_glue_job.tf:70-73
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		70 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group_v2" {
		71 |   name              = "dms-dv-glue-job-v2"
		72 |   retention_in_days = 14
		73 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.rds_to_s3_parquet_migration
	File: /dms_data_validation_glue_job.tf:75-78
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		75 | resource "aws_cloudwatch_log_group" "rds_to_s3_parquet_migration" {
		76 |   name              = "rds-to-s3-parquet-migration"
		77 |   retention_in_days = 14
		78 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.rds_to_s3_parquet_migration
	File: /dms_data_validation_glue_job.tf:75-78
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		75 | resource "aws_cloudwatch_log_group" "rds_to_s3_parquet_migration" {
		76 |   name              = "rds-to-s3-parquet-migration"
		77 |   retention_in_days = 14
		78 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.resizing_parquet_files
	File: /dms_data_validation_glue_job.tf:80-83
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		80 | resource "aws_cloudwatch_log_group" "resizing_parquet_files" {
		81 |   name              = "resizing-parquet-files"
		82 |   retention_in_days = 14
		83 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.resizing_parquet_files
	File: /dms_data_validation_glue_job.tf:80-83
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		80 | resource "aws_cloudwatch_log_group" "resizing_parquet_files" {
		81 |   name              = "resizing-parquet-files"
		82 |   retention_in_days = 14
		83 | }

Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.dms_dv_glue_job_v2
	File: /dms_data_validation_glue_job.tf:86-140
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.dms_dv_glue_job_v4d
	File: /dms_data_validation_glue_job.tf:148-201
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.rds_to_s3_parquet_migration
	File: /dms_data_validation_glue_job.tf:204-268
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.rds_to_s3_parquet_migration_monthly
	File: /dms_data_validation_glue_job.tf:272-326
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.resizing_parquet_files
	File: /dms_data_validation_glue_job.tf:329-381
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.catalog_dv_table_glue_job
	File: /dms_data_validation_glue_job.tf:384-412
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		384 | resource "aws_glue_job" "catalog_dv_table_glue_job" {
		385 |   name              = "catalog-dv-table-glue-job"
		386 |   description       = "Python script uses Boto3-Athena-Client to run sql-statements"
		387 |   role_arn          = aws_iam_role.dms_dv_glue_job_iam_role.arn
		388 |   glue_version      = "4.0"
		389 |   worker_type       = "G.1X"
		390 |   number_of_workers = 2
		391 |   default_arguments = {
		392 |     "--parquet_output_bucket_name"       = module.s3-dms-data-validation-bucket.bucket.id
		393 |     "--glue_catalog_db_name"             = aws_glue_catalog_database.dms_dv_glue_catalog_db.name
		394 |     "--glue_catalog_tbl_name"            = "glue_df_output"
		395 |     "--continuous-log-logGroup"          = aws_cloudwatch_log_group.dms_dv_cw_log_group.name
		396 |     "--enable-continuous-cloudwatch-log" = "true"
		397 |     "--enable-continuous-log-filter"     = "true"
		398 |     "--enable-metrics"                   = ""
		399 |   }
		400 |   command {
		401 |     python_version  = "3"
		402 |     script_location = "s3://${module.s3-glue-job-script-bucket.bucket.id}/create_or_replace_dv_table.py"
		403 |   }
		404 | 
		405 |   tags = merge(
		406 |     local.tags,
		407 |     {
		408 |       Resource_Type = "Py script as glue-job that creates dv table / refreshes its partitions",
		409 |     }
		410 |   )
		411 | 
		412 | }

Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_crawler.rds_sqlserver_db_glue_crawler
	File: /dms_glue_crawler.tf:35-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		35 | resource "aws_glue_crawler" "rds_sqlserver_db_glue_crawler" {
		36 |   name          = "rds-sqlserver-${aws_db_instance.database_2022.identifier}-tf"
		37 |   role          = aws_iam_role.dms_dv_glue_job_iam_role.arn
		38 |   database_name = aws_glue_catalog_database.rds_sqlserver_glue_catalog_db.name
		39 |   description   = "Crawler to fetch database names"
		40 |   #   table_prefix  = "your_table_prefix"
		41 | 
		42 |   jdbc_target {
		43 |     connection_name = aws_glue_connection.glue_rds_sqlserver_db_connection.name
		44 |     path            = "%"
		45 |   }
		46 |   tags = merge(
		47 |     local.tags,
		48 |     {
		49 |       Resource_Type = "RDS-SQLServer Glue-Crawler for DMS",
		50 |     }
		51 |   )
		52 | 
		53 |   # provisioner "local-exec" {
		54 |   #   command = "aws glue start-crawler --name ${self.name}"
		55 |   # }
		56 | }

Check: CKV_AWS_212: "Ensure DMS replication instance is encrypted by KMS using a customer managed Key (CMK)"
	FAILED for resource: aws_dms_replication_instance.dms_replication_instance
	File: /dms_replication_instance.tf:24-55
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-ebs-volume-is-encrypted-by-key-management-service-kms-using-a-customer-managed-key-cmk

		24 | resource "aws_dms_replication_instance" "dms_replication_instance" {
		25 |   allocated_storage          = var.dms_allocated_storage_gib
		26 |   apply_immediately          = true
		27 |   auto_minor_version_upgrade = true
		28 |   availability_zone          = var.dms_availability_zone
		29 |   engine_version             = var.dms_engine_version
		30 |   #   kms_key_arn                  = "arn:aws:kms:eu-west-2:800964199911:key/b7f54acb-16a3-4958-9340-3bdf5f5842d8"
		31 |   multi_az = false
		32 |   #   preferred_maintenance_window = "sun:10:30-sun:14:30"
		33 |   publicly_accessible         = false
		34 |   replication_instance_class  = var.dms_replication_instance_class
		35 |   replication_instance_id     = "dms-replication-instance-tf"
		36 |   replication_subnet_group_id = aws_dms_replication_subnet_group.dms_replication_subnet_group.id
		37 | 
		38 |   tags = merge(
		39 |     local.tags,
		40 |     {
		41 |       Resource_Type = "DMS Replication Instance",
		42 |     }
		43 |   )
		44 | 
		45 |   vpc_security_group_ids = [
		46 |     aws_security_group.dms_ri_security_group.id,
		47 |   ]
		48 | 
		49 |   depends_on = [
		50 |     aws_iam_role.dms_vpc_role,
		51 |     aws_iam_role.dms_cloudwatch_logs_role,
		52 |     aws_iam_role.dms_endpoint_role
		53 |   ]
		54 | 
		55 | }

Check: CKV_AWS_260: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 80"
	FAILED for resource: aws_vpc_security_group_ingress_rule.glue_rds_conn_inbound
	File: /dms_security_groups.tf:95-103
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-aws-security-groups-do-not-allow-ingress-from-00000-to-port-80

		95  | resource "aws_vpc_security_group_ingress_rule" "glue_rds_conn_inbound" {
		96  |   security_group_id = aws_security_group.glue_rds_conn_security_group.id
		97  | 
		98  |   referenced_security_group_id = aws_security_group.glue_rds_conn_security_group.id
		99  |   ip_protocol                  = "tcp"
		100 |   from_port                    = 0
		101 |   to_port                      = 65535
		102 |   description                  = "Required ports open for Glue-RDS-Connection"
		103 | }

Check: CKV_AWS_24: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 22"
	FAILED for resource: aws_vpc_security_group_ingress_rule.glue_rds_conn_inbound
	File: /dms_security_groups.tf:95-103
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-1-port-security

		95  | resource "aws_vpc_security_group_ingress_rule" "glue_rds_conn_inbound" {
		96  |   security_group_id = aws_security_group.glue_rds_conn_security_group.id
		97  | 
		98  |   referenced_security_group_id = aws_security_group.glue_rds_conn_security_group.id
		99  |   ip_protocol                  = "tcp"
		100 |   from_port                    = 0
		101 |   to_port                      = 65535
		102 |   description                  = "Required ports open for Glue-RDS-Connection"
		103 | }

Check: CKV_AWS_25: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389"
	FAILED for resource: aws_vpc_security_group_ingress_rule.glue_rds_conn_inbound
	File: /dms_security_groups.tf:95-103
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-2

		95  | resource "aws_vpc_security_group_ingress_rule" "glue_rds_conn_inbound" {
		96  |   security_group_id = aws_security_group.glue_rds_conn_security_group.id
		97  | 
		98  |   referenced_security_group_id = aws_security_group.glue_rds_conn_security_group.id
		99  |   ip_protocol                  = "tcp"
		100 |   from_port                    = 0
		101 |   to_port                      = 65535
		102 |   description                  = "Required ports open for Glue-RDS-Connection"
		103 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.glue_notebook_ec2_iam_policy_document
	File: /glue_data.tf:103-118
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		103 | data "aws_iam_policy_document" "glue_notebook_ec2_iam_policy_document" {
		104 |   statement {
		105 |     effect = "Allow"
		106 |     actions = [
		107 |       "ec2:CreateNetworkInterface",
		108 |       "ec2:DescribeNetworkInterfaces",
		109 |       "ec2:DeleteNetworkInterface",
		110 |       "ec2:DescribeVpcEndpoints",
		111 |       "ec2:DescribeSubnets",
		112 |       "ec2:DescribeVpcAttribute",
		113 |       "ec2:DescribeRouteTables",
		114 |       "ec2:DescribeSecurityGroups"
		115 |     ]
		116 |     resources = ["*"]
		117 |   }
		118 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.glue_notebook_ec2_iam_policy_document
	File: /glue_data.tf:103-118
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		103 | data "aws_iam_policy_document" "glue_notebook_ec2_iam_policy_document" {
		104 |   statement {
		105 |     effect = "Allow"
		106 |     actions = [
		107 |       "ec2:CreateNetworkInterface",
		108 |       "ec2:DescribeNetworkInterfaces",
		109 |       "ec2:DeleteNetworkInterface",
		110 |       "ec2:DescribeVpcEndpoints",
		111 |       "ec2:DescribeSubnets",
		112 |       "ec2:DescribeVpcAttribute",
		113 |       "ec2:DescribeRouteTables",
		114 |       "ec2:DescribeSecurityGroups"
		115 |     ]
		116 |     resources = ["*"]
		117 |   }
		118 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.load_json_table_s3_policy_document
	File: /lambdas_iam.tf:430-487
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.load_json_table_s3_policy_document
	File: /lambdas_iam.tf:430-487
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.db_glue_connection
	File: /lambdas_secrets.tf:1-3
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		1 | resource "aws_secretsmanager_secret" "db_glue_connection" {
		2 |   name = "db_glue_connection"
		3 | }

Check: CKV_AWS_296: "Ensure DMS endpoint uses Customer Managed Key (CMK)"
	FAILED for resource: module.dms_task.aws_dms_endpoint.dms_rds_source
	File: /modules/dms/endpoints_rds_s3.tf:2-23
	Calling File: /dms_main.tf:1-39
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-296

		2  | resource "aws_dms_endpoint" "dms_rds_source" {
		3  | 
		4  |   #   certificate_arn             = ""
		5  |   database_name = var.database_name
		6  |   endpoint_id   = "rds-mssql-${replace(var.database_name, "_", "-")}-tf"
		7  |   endpoint_type = "source"
		8  |   engine_name   = "sqlserver"
		9  |   #   extra_connection_attributes = ""
		10 |   #   kms_key_arn                 = aws_db_instance.database_2022.kms_key_id
		11 |   password    = var.rds_db_instance_pasword
		12 |   port        = var.rds_db_instance_port
		13 |   server_name = var.rds_db_server_name
		14 |   ssl_mode    = "require"
		15 |   username    = var.rds_db_username
		16 | 
		17 |   tags = merge(
		18 |     var.local_tags,
		19 |     {
		20 |       Resource_Type = "DMS Source Endpoint - RDS MSSQL",
		21 |     },
		22 |   )
		23 | }

Check: CKV_AWS_298: "Ensure DMS S3 uses Customer Managed Key (CMK)"
	FAILED for resource: module.dms_task.aws_dms_s3_endpoint.dms_s3_parquet_target
	File: /modules/dms/endpoints_rds_s3.tf:28-84
	Calling File: /dms_main.tf:1-39
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-298

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: module.athena_layer.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-8
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: module.athena_layer.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-8
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.athena_layer.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:39-48
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		39 | data "aws_iam_policy_document" "step_function_base_permissions" {
		40 |   statement {
		41 |     effect = "Allow"
		42 |     actions = [
		43 |       "sns:Publish",
		44 |       "sqs:SendMessage"
		45 |     ]
		46 |     resources = ["*"]
		47 |   }
		48 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.athena_layer.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:39-48
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		39 | data "aws_iam_policy_document" "step_function_base_permissions" {
		40 |   statement {
		41 |     effect = "Allow"
		42 |     actions = [
		43 |       "sns:Publish",
		44 |       "sqs:SendMessage"
		45 |     ]
		46 |     resources = ["*"]
		47 |   }
		48 | }

Check: CKV_AWS_109: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: module.athena_layer.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:55-79
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-permissions-management-resource-exposure-without-constraint

		55 | data "aws_iam_policy_document" "this_log_key_document" {
		56 |   statement {
		57 |     sid    = "EnableIAMUserPermissions"
		58 |     effect = "Allow"
		59 |     principals {
		60 |       type        = "AWS"
		61 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		62 |     }
		63 |     actions   = ["kms:*"]
		64 |     resources = ["*"]
		65 |   }
		66 | 
		67 |   statement {
		68 |     sid    = "EnableLogServicePermissions"
		69 |     effect = "Allow"
		70 |     principals {
		71 |       type        = "Service"
		72 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		73 |     }
		74 |     actions = [
		75 |       "kms:*",
		76 |     ]
		77 |     resources = ["*"]
		78 |   }
		79 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.athena_layer.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:55-79
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		55 | data "aws_iam_policy_document" "this_log_key_document" {
		56 |   statement {
		57 |     sid    = "EnableIAMUserPermissions"
		58 |     effect = "Allow"
		59 |     principals {
		60 |       type        = "AWS"
		61 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		62 |     }
		63 |     actions   = ["kms:*"]
		64 |     resources = ["*"]
		65 |   }
		66 | 
		67 |   statement {
		68 |     sid    = "EnableLogServicePermissions"
		69 |     effect = "Allow"
		70 |     principals {
		71 |       type        = "Service"
		72 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		73 |     }
		74 |     actions = [
		75 |       "kms:*",
		76 |     ]
		77 |     resources = ["*"]
		78 |   }
		79 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.athena_layer.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:55-79
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		55 | data "aws_iam_policy_document" "this_log_key_document" {
		56 |   statement {
		57 |     sid    = "EnableIAMUserPermissions"
		58 |     effect = "Allow"
		59 |     principals {
		60 |       type        = "AWS"
		61 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		62 |     }
		63 |     actions   = ["kms:*"]
		64 |     resources = ["*"]
		65 |   }
		66 | 
		67 |   statement {
		68 |     sid    = "EnableLogServicePermissions"
		69 |     effect = "Allow"
		70 |     principals {
		71 |       type        = "Service"
		72 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		73 |     }
		74 |     actions = [
		75 |       "kms:*",
		76 |     ]
		77 |     resources = ["*"]
		78 |   }
		79 | }

Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: module.get_zipped_file.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-8
	Calling File: /step_functions_main.tf:38-48
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: module.get_zipped_file.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-8
	Calling File: /step_functions_main.tf:38-48
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:39-48
	Calling File: /step_functions_main.tf:38-48
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		39 | data "aws_iam_policy_document" "step_function_base_permissions" {
		40 |   statement {
		41 |     effect = "Allow"
		42 |     actions = [
		43 |       "sns:Publish",
		44 |       "sqs:SendMessage"
		45 |     ]
		46 |     resources = ["*"]
		47 |   }
		48 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:39-48
	Calling File: /step_functions_main.tf:38-48
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		39 | data "aws_iam_policy_document" "step_function_base_permissions" {
		40 |   statement {
		41 |     effect = "Allow"
		42 |     actions = [
		43 |       "sns:Publish",
		44 |       "sqs:SendMessage"
		45 |     ]
		46 |     resources = ["*"]
		47 |   }
		48 | }

Check: CKV_AWS_109: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:55-79
	Calling File: /step_functions_main.tf:38-48
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-permissions-management-resource-exposure-without-constraint

		55 | data "aws_iam_policy_document" "this_log_key_document" {
		56 |   statement {
		57 |     sid    = "EnableIAMUserPermissions"
		58 |     effect = "Allow"
		59 |     principals {
		60 |       type        = "AWS"
		61 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		62 |     }
		63 |     actions   = ["kms:*"]
		64 |     resources = ["*"]
		65 |   }
		66 | 
		67 |   statement {
		68 |     sid    = "EnableLogServicePermissions"
		69 |     effect = "Allow"
		70 |     principals {
		71 |       type        = "Service"
		72 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		73 |     }
		74 |     actions = [
		75 |       "kms:*",
		76 |     ]
		77 |     resources = ["*"]
		78 |   }
		79 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:55-79
	Calling File: /step_functions_main.tf:38-48
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		55 | data "aws_iam_policy_document" "this_log_key_document" {
		56 |   statement {
		57 |     sid    = "EnableIAMUserPermissions"
		58 |     effect = "Allow"
		59 |     principals {
		60 |       type        = "AWS"
		61 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		62 |     }
		63 |     actions   = ["kms:*"]
		64 |     resources = ["*"]
		65 |   }
		66 | 
		67 |   statement {
		68 |     sid    = "EnableLogServicePermissions"
		69 |     effect = "Allow"
		70 |     principals {
		71 |       type        = "Service"
		72 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		73 |     }
		74 |     actions = [
		75 |       "kms:*",
		76 |     ]
		77 |     resources = ["*"]
		78 |   }
		79 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:55-79
	Calling File: /step_functions_main.tf:38-48
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		55 | data "aws_iam_policy_document" "this_log_key_document" {
		56 |   statement {
		57 |     sid    = "EnableIAMUserPermissions"
		58 |     effect = "Allow"
		59 |     principals {
		60 |       type        = "AWS"
		61 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		62 |     }
		63 |     actions   = ["kms:*"]
		64 |     resources = ["*"]
		65 |   }
		66 | 
		67 |   statement {
		68 |     sid    = "EnableLogServicePermissions"
		69 |     effect = "Allow"
		70 |     principals {
		71 |       type        = "Service"
		72 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		73 |     }
		74 |     actions = [
		75 |       "kms:*",
		76 |     ]
		77 |     resources = ["*"]
		78 |   }
		79 | }

Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: module.send_database_to_ap.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-8
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: module.send_database_to_ap.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-8
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.send_database_to_ap.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:39-48
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		39 | data "aws_iam_policy_document" "step_function_base_permissions" {
		40 |   statement {
		41 |     effect = "Allow"
		42 |     actions = [
		43 |       "sns:Publish",
		44 |       "sqs:SendMessage"
		45 |     ]
		46 |     resources = ["*"]
		47 |   }
		48 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.send_database_to_ap.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:39-48
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		39 | data "aws_iam_policy_document" "step_function_base_permissions" {
		40 |   statement {
		41 |     effect = "Allow"
		42 |     actions = [
		43 |       "sns:Publish",
		44 |       "sqs:SendMessage"
		45 |     ]
		46 |     resources = ["*"]
		47 |   }
		48 | }

Check: CKV_AWS_109: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: module.send_database_to_ap.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:55-79
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-permissions-management-resource-exposure-without-constraint

		55 | data "aws_iam_policy_document" "this_log_key_document" {
		56 |   statement {
		57 |     sid    = "EnableIAMUserPermissions"
		58 |     effect = "Allow"
		59 |     principals {
		60 |       type        = "AWS"
		61 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		62 |     }
		63 |     actions   = ["kms:*"]
		64 |     resources = ["*"]
		65 |   }
		66 | 
		67 |   statement {
		68 |     sid    = "EnableLogServicePermissions"
		69 |     effect = "Allow"
		70 |     principals {
		71 |       type        = "Service"
		72 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		73 |     }
		74 |     actions = [
		75 |       "kms:*",
		76 |     ]
		77 |     resources = ["*"]
		78 |   }
		79 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.send_database_to_ap.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:55-79
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		55 | data "aws_iam_policy_document" "this_log_key_document" {
		56 |   statement {
		57 |     sid    = "EnableIAMUserPermissions"
		58 |     effect = "Allow"
		59 |     principals {
		60 |       type        = "AWS"
		61 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		62 |     }
		63 |     actions   = ["kms:*"]
		64 |     resources = ["*"]
		65 |   }
		66 | 
		67 |   statement {
		68 |     sid    = "EnableLogServicePermissions"
		69 |     effect = "Allow"
		70 |     principals {
		71 |       type        = "Service"
		72 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		73 |     }
		74 |     actions = [
		75 |       "kms:*",
		76 |     ]
		77 |     resources = ["*"]
		78 |   }
		79 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.send_database_to_ap.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:55-79
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		55 | data "aws_iam_policy_document" "this_log_key_document" {
		56 |   statement {
		57 |     sid    = "EnableIAMUserPermissions"
		58 |     effect = "Allow"
		59 |     principals {
		60 |       type        = "AWS"
		61 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		62 |     }
		63 |     actions   = ["kms:*"]
		64 |     resources = ["*"]
		65 |   }
		66 | 
		67 |   statement {
		68 |     sid    = "EnableLogServicePermissions"
		69 |     effect = "Allow"
		70 |     principals {
		71 |       type        = "Service"
		72 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		73 |     }
		74 |     actions = [
		75 |       "kms:*",
		76 |     ]
		77 |     resources = ["*"]
		78 |   }
		79 | }

Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.db_password
	File: /server_backups.tf:4-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		4 | resource "aws_secretsmanager_secret" "db_password" {
		5 |   name = "db_password"
		6 | }

Check: CKV_AWS_354: "Ensure RDS Performance Insights are encrypted using KMS CMKs"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-354

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_157: "Ensure that RDS instances have Multi-AZ enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-73

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_118: "Ensure that enhanced monitoring is enabled for Amazon RDS instances"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/ensure-that-enhanced-monitoring-is-enabled-for-amazon-rds-instances

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_353: "Ensure that RDS instances have performance insights enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-353

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_293: "Ensure that AWS database instances have deletion protection enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-293

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_129: "Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-that-respective-logs-of-amazon-relational-database-service-amazon-rds-are-enabled

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.send_database_to_ap
	File: /step_functions_iam.tf:44-118
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.send_database_to_ap
	File: /step_functions_iam.tf:44-118
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.db_glue_connection
	File: /lambdas_secrets.tf:1-3
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		1 | resource "aws_secretsmanager_secret" "db_glue_connection" {
		2 |   name = "db_glue_connection"
		3 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.db_password
	File: /server_backups.tf:4-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		4 | resource "aws_secretsmanager_secret" "db_password" {
		5 |   name = "db_password"
		6 | }

Check: CKV2_AWS_60: "Ensure RDS instance with copy tags to snapshots is enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-60

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: aws_security_group.glue_rds_conn_security_group
	File: /dms_security_groups.tf:71-82
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		71 | resource "aws_security_group" "glue_rds_conn_security_group" {
		72 |   name        = "glue-rds-sqlserver-connection-tf"
		73 |   description = "Secuity Group for Glue-RDS-Connection"
		74 |   vpc_id      = data.aws_vpc.shared.id
		75 | 
		76 |   tags = merge(
		77 |     local.tags,
		78 |     {
		79 |       Resource_Type = "Secuity Group for Glue-RDS-Connection",
		80 |     }
		81 |   )
		82 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: module.buddi.module.landing_zone_security_groups.aws_security_group.this
	File: /modules/landing_zone/server_security_group/main.tf:7-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		7  | resource "aws_security_group" "this" {
		8  |   name        = "${var.supplier}-${var.user_name}-inbound-ips"
		9  |   description = "Allowed IP addresses for ${var.user_name} on ${var.supplier} server"
		10 |   vpc_id      = var.vpc_id
		11 | 
		12 |   lifecycle {
		13 |     create_before_destroy = true
		14 |   }
		15 | 
		16 |   tags = merge(
		17 |     var.local_tags,
		18 |     {
		19 |       supplier = var.user_name,
		20 |     },
		21 |   )
		22 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: module.capita.module.landing_zone_security_groups.aws_security_group.this
	File: /modules/landing_zone/server_security_group/main.tf:7-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		7  | resource "aws_security_group" "this" {
		8  |   name        = "${var.supplier}-${var.user_name}-inbound-ips"
		9  |   description = "Allowed IP addresses for ${var.user_name} on ${var.supplier} server"
		10 |   vpc_id      = var.vpc_id
		11 | 
		12 |   lifecycle {
		13 |     create_before_destroy = true
		14 |   }
		15 | 
		16 |   tags = merge(
		17 |     var.local_tags,
		18 |     {
		19 |       supplier = var.user_name,
		20 |     },
		21 |   )
		22 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: module.g4s.module.landing_zone_security_groups.aws_security_group.this
	File: /modules/landing_zone/server_security_group/main.tf:7-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		7  | resource "aws_security_group" "this" {
		8  |   name        = "${var.supplier}-${var.user_name}-inbound-ips"
		9  |   description = "Allowed IP addresses for ${var.user_name} on ${var.supplier} server"
		10 |   vpc_id      = var.vpc_id
		11 | 
		12 |   lifecycle {
		13 |     create_before_destroy = true
		14 |   }
		15 | 
		16 |   tags = merge(
		17 |     var.local_tags,
		18 |     {
		19 |       supplier = var.user_name,
		20 |     },
		21 |   )
		22 | }

dockerfile scan results:

Passed checks: 21, Failed checks: 2, Skipped checks: 0

Check: CKV_DOCKER_2: "Ensure that HEALTHCHECK instructions have been added to container images"
	FAILED for resource: /lambdas/update_log_table/Dockerfile.
	File: /lambdas/update_log_table/Dockerfile:1-9
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/docker-policies/docker-policy-index/ensure-that-healthcheck-instructions-have-been-added-to-container-images

		1 | FROM public.ecr.aws/lambda/python:3.11
		2 | 
		3 | COPY requirements.txt .
		4 | 
		5 | RUN pip install -r requirements.txt --target "${LAMBDA_TASK_ROOT}"
		6 | 
		7 | COPY update_log_table.py ${LAMBDA_TASK_ROOT}
		8 | 
		9 | CMD ["update_log_table.handler"]

Check: CKV_DOCKER_3: "Ensure that a user for the container has been created"
	FAILED for resource: /lambdas/update_log_table/Dockerfile.
	File: /lambdas/update_log_table/Dockerfile:1-9
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/docker-policies/docker-policy-index/ensure-that-a-user-for-the-container-has-been-created

		1 | FROM public.ecr.aws/lambda/python:3.11
		2 | 
		3 | COPY requirements.txt .
		4 | 
		5 | RUN pip install -r requirements.txt --target "${LAMBDA_TASK_ROOT}"
		6 | 
		7 | COPY update_log_table.py ${LAMBDA_TASK_ROOT}
		8 | 
		9 | CMD ["update_log_table.handler"]


checkov_exitcode=1

CTFLint Scan Failed

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
terraform/environments/electronic-monitoring-data

*****************************

Running tflint in terraform/environments/electronic-monitoring-data
Excluding the following checks: terraform_unused_declarations
3 issue(s) found:

Warning: Missing version constraint for provider "archive" in `required_providers` (terraform_required_providers)

  on terraform/environments/electronic-monitoring-data/glue_data.tf line 1:
   1: data "archive_file" "archive_file_zip_py_files" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

Warning: `s3_pylib_dir_path` variable has no type (terraform_typed_variables)

  on terraform/environments/electronic-monitoring-data/glue_variables.tf line 1:
   1: variable "s3_pylib_dir_path" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_typed_variables.md

Warning: Missing version constraint for provider "random" in `required_providers` (terraform_required_providers)

  on terraform/environments/electronic-monitoring-data/server_backups.tf line 13:
  13: resource "random_password" "random_password" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

tflint_exitcode=2

Trivy Scan Failed

Show Output

*****************************

Trivy will check the following folders:
terraform/environments/electronic-monitoring-data

*****************************

Running Trivy in terraform/environments/electronic-monitoring-data
2024-10-17T16:14:49Z	INFO	[vulndb] Need to update DB
2024-10-17T16:14:49Z	INFO	[vulndb] Downloading vulnerability DB...
2024-10-17T16:14:49Z	INFO	[vulndb] Downloading artifact...	repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-17T16:14:51Z	INFO	[vulndb] Artifact successfully downloaded	repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-17T16:14:51Z	INFO	[vuln] Vulnerability scanning is enabled
2024-10-17T16:14:51Z	INFO	[misconfig] Misconfiguration scanning is enabled
2024-10-17T16:14:51Z	INFO	[misconfig] Need to update the built-in checks
2024-10-17T16:14:51Z	INFO	[misconfig] Downloading the built-in checks...
156.02 KiB / 156.02 KiB [---------------------------------------------------------] 100.00% ? p/s 0s2024-10-17T16:14:51Z	INFO	[secret] Secret scanning is enabled
2024-10-17T16:14:51Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-17T16:14:51Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-10-17T16:14:52Z	INFO	[terraform scanner] Scanning root module	file_path="."
2024-10-17T16:14:53Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="networking"
2024-10-17T16:14:53Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T16:14:53Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T16:14:53Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T16:14:53Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T16:14:53Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T16:14:53Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T16:14:53Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T16:14:53Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.aws_s3_object.user_public_keys" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.data.aws_subnet.local_account" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T16:14:54Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T16:14:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T16:14:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T16:14:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T16:14:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T16:14:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T16:14:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T16:14:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T16:14:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T16:14:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T16:14:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T16:14:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T16:14:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T16:14:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T16:14:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-17T16:14:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T16:14:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T16:14:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T16:14:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T16:14:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T16:14:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T16:14:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-17T16:14:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.transition" value="cty.NilVal"
2024-10-17T16:14:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-17T16:14:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-17T16:14:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.principals" value="cty.NilVal"
2024-10-17T16:14:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.condition" value="cty.NilVal"
2024-10-17T16:15:00Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-versioning" range="s3.tf:1061-1080"
2024-10-17T16:15:00Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-bucket-encryption" range="s3.tf:1061-1080"
2024-10-17T16:15:00Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T16:15:00Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T16:15:00Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T16:15:00Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T16:15:00Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T16:15:00Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T16:15:00Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T16:15:00Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T16:15:00Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T16:15:00Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T16:15:00Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-17T16:15:00Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=95ed3c3/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=568694e50e03630d99cb569eafa06a0b879a1239/main.tf:171-179"
2024-10-17T16:15:00Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="s3.tf:1061-1080"
2024-10-17T16:15:00Z	INFO	[terraform executor] Ignore finding	rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:281-286"
2024-10-17T16:15:00Z	INFO	[terraform executor] Ignore finding	rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:407-411"
2024-10-17T16:15:00Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-17T16:15:00Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-17T16:15:00Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-logging" range="s3.tf:1061-1080"
2024-10-17T16:15:00Z	WARN	[pip] Unable to find python `site-packages` directory. License detection is skipped.	err="site-packages directory not found"
2024-10-17T16:15:00Z	INFO	Number of language-specific files	num=1
2024-10-17T16:15:00Z	INFO	[pip] Detecting vulnerabilities...
2024-10-17T16:15:00Z	INFO	Detected config files	num=17

lambdas/update_log_table/Dockerfile (dockerfile)
================================================
Tests: 20 (SUCCESSES: 19, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Specify at least 1 USER command in Dockerfile with non-root user as argument
════════════════════════════════════════
Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

See https://avd.aquasec.com/misconfig/ds002
────────────────────────────────────────


trivy_exitcode=1

[modernisation-platform-ci]

Terraform plan evaluation detected changes to resources that require approval from @ministryofjustice/modernsation-platform - please contact #ask-modernisation-platform for assistance

[modernisation-platform-ci]

@madhu-k-sr2 Terraform plan evaluation detected changes to resources that require approval from a member of @ministryofjustice/modernisation-platform - please contact #ask-modernisation-platform for assistance

Guidance on approving these PRs is available at https://user-guide.modernisation-platform.service.justice.gov.uk/runbooks/reviewing-mp-environments-prs.html#process-for-approving-prs

[modernisation-platform-ci]

Terraform plan evaluation detected changes to resources that require approval from @ministryofjustice/modernsation-platform - please contact #ask-modernisation-platform for assistance

[modernisation-platform-ci]

@madhu-k-sr2 Terraform plan evaluation detected changes to resources that require approval from a member of @ministryofjustice/modernisation-platform - please contact #ask-modernisation-platform for assistance

Guidance on approving these PRs is available at https://user-guide.modernisation-platform.service.justice.gov.uk/runbooks/reviewing-mp-environments-prs.html#process-for-approving-prs

[modernisation-platform-ci]

Terraform plan evaluation detected changes to resources that require approval from @ministryofjustice/modernsation-platform - please contact #ask-modernisation-platform for assistance

[modernisation-platform-ci]

@madhu-k-sr2 Terraform plan evaluation detected changes to resources that require approval from a member of @ministryofjustice/modernisation-platform - please contact #ask-modernisation-platform for assistance

Guidance on approving these PRs is available at https://user-guide.modernisation-platform.service.justice.gov.uk/runbooks/reviewing-mp-environments-prs.html#process-for-approving-prs

[github-actions]

Trivy Scan Failed

Show Output

```hcl

---

Trivy will check the following folders:
terraform/environments/electronic-monitoring-data

---

Running Trivy in terraform/environments/electronic-monitoring-data
2024-10-21T15:36:04Z INFO [vulndb] Need to update DB
2024-10-21T15:36:04Z INFO [vulndb] Downloading vulnerability DB...
2024-10-21T15:36:04Z INFO [vulndb] Downloading artifact... repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-21T15:36:04Z ERROR [vulndb] Failed to download artifact repo="ghcr.io/aquasecurity/trivy-db:2" err="oci download error: failed to fetch the layer: GET https://ghcr.io/v2/aquasecurity/trivy-db/blobs/sha256:07994604d8e647483cf5193669d01210524ae223c43ca96364d63f59bd64d9bf: TOOMANYREQUESTS: retry-after: 26.136µs, allowed: 44000/minute"
2024-10-21T15:36:04Z FATAL Fatal error init error: DB error: failed to download vulnerability DB: OCI artifact error: failed to download vulnerability DB: failed to download artifact from any source
trivy_exitcode=1

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/electronic-monitoring-data

*****************************

Running Checkov in terraform/environments/electronic-monitoring-data
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2024-10-21 15:36:07,233 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=95ed3c3:None (for external modules, the --download-external-modules flag is required)
2024-10-21 15:36:07,233 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060:None (for external modules, the --download-external-modules flag is required)
2024-10-21 15:36:07,233 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/secrets-manager/aws:1.3.0 (for external modules, the --download-external-modules flag is required)
2024-10-21 15:36:07,234 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=52a40b0:None (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 2270, Failed checks: 75, Skipped checks: 37

Check: CKV_AWS_26: "Ensure all data stored in the SNS topic is encrypted"
	FAILED for resource: aws_sns_topic.s3_events
	File: /data_store.tf:17-19
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-15

		17 | resource "aws_sns_topic" "s3_events" {
		18 |   name = "${module.s3-data-bucket.bucket.id}-object-created-topic"
		19 | }

Check: CKV_AWS_115: "Ensure that AWS Lambda function is configured for function-level concurrent execution limit"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-function-level-concurrent-execution-limit

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_173: "Check encryption settings for Lambda environmental variable"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-5

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_116: "Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-a-dead-letter-queue-dlq

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_272: "Ensure AWS Lambda function is configured to validate code-signing"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-272

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_117: "Ensure that AWS Lambda function is configured inside a VPC"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-inside-a-vpc-1

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_115: "Ensure that AWS Lambda function is configured for function-level concurrent execution limit"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-function-level-concurrent-execution-limit

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_116: "Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-a-dead-letter-queue-dlq

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_272: "Ensure AWS Lambda function is configured to validate code-signing"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-272

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_117: "Ensure that AWS Lambda function is configured inside a VPC"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-inside-a-vpc-1

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group
	File: /dms_data_validation_glue_job.tf:65-68
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		65 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group" {
		66 |   name              = "dms-dv-glue-job"
		67 |   retention_in_days = 14
		68 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group
	File: /dms_data_validation_glue_job.tf:65-68
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		65 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group" {
		66 |   name              = "dms-dv-glue-job"
		67 |   retention_in_days = 14
		68 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group_v2
	File: /dms_data_validation_glue_job.tf:70-73
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		70 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group_v2" {
		71 |   name              = "dms-dv-glue-job-v2"
		72 |   retention_in_days = 14
		73 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group_v2
	File: /dms_data_validation_glue_job.tf:70-73
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		70 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group_v2" {
		71 |   name              = "dms-dv-glue-job-v2"
		72 |   retention_in_days = 14
		73 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.rds_to_s3_parquet_migration
	File: /dms_data_validation_glue_job.tf:75-78
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		75 | resource "aws_cloudwatch_log_group" "rds_to_s3_parquet_migration" {
		76 |   name              = "rds-to-s3-parquet-migration"
		77 |   retention_in_days = 14
		78 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.rds_to_s3_parquet_migration
	File: /dms_data_validation_glue_job.tf:75-78
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		75 | resource "aws_cloudwatch_log_group" "rds_to_s3_parquet_migration" {
		76 |   name              = "rds-to-s3-parquet-migration"
		77 |   retention_in_days = 14
		78 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.resizing_parquet_files
	File: /dms_data_validation_glue_job.tf:80-83
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		80 | resource "aws_cloudwatch_log_group" "resizing_parquet_files" {
		81 |   name              = "resizing-parquet-files"
		82 |   retention_in_days = 14
		83 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.resizing_parquet_files
	File: /dms_data_validation_glue_job.tf:80-83
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		80 | resource "aws_cloudwatch_log_group" "resizing_parquet_files" {
		81 |   name              = "resizing-parquet-files"
		82 |   retention_in_days = 14
		83 | }

Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.dms_dv_glue_job_v2
	File: /dms_data_validation_glue_job.tf:86-140
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.dms_dv_glue_job_v4d
	File: /dms_data_validation_glue_job.tf:148-201
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.rds_to_s3_parquet_migration
	File: /dms_data_validation_glue_job.tf:204-268
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.rds_to_s3_parquet_migration_monthly
	File: /dms_data_validation_glue_job.tf:272-326
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.resizing_parquet_files
	File: /dms_data_validation_glue_job.tf:329-381
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.catalog_dv_table_glue_job
	File: /dms_data_validation_glue_job.tf:384-412
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		384 | resource "aws_glue_job" "catalog_dv_table_glue_job" {
		385 |   name              = "catalog-dv-table-glue-job"
		386 |   description       = "Python script uses Boto3-Athena-Client to run sql-statements"
		387 |   role_arn          = aws_iam_role.dms_dv_glue_job_iam_role.arn
		388 |   glue_version      = "4.0"
		389 |   worker_type       = "G.1X"
		390 |   number_of_workers = 2
		391 |   default_arguments = {
		392 |     "--parquet_output_bucket_name"       = module.s3-dms-data-validation-bucket.bucket.id
		393 |     "--glue_catalog_db_name"             = aws_glue_catalog_database.dms_dv_glue_catalog_db.name
		394 |     "--glue_catalog_tbl_name"            = "glue_df_output"
		395 |     "--continuous-log-logGroup"          = aws_cloudwatch_log_group.dms_dv_cw_log_group.name
		396 |     "--enable-continuous-cloudwatch-log" = "true"
		397 |     "--enable-continuous-log-filter"     = "true"
		398 |     "--enable-metrics"                   = ""
		399 |   }
		400 |   command {
		401 |     python_version  = "3"
		402 |     script_location = "s3://${module.s3-glue-job-script-bucket.bucket.id}/create_or_replace_dv_table.py"
		403 |   }
		404 | 
		405 |   tags = merge(
		406 |     local.tags,
		407 |     {
		408 |       Resource_Type = "Py script as glue-job that creates dv table / refreshes its partitions",
		409 |     }
		410 |   )
		411 | 
		412 | }

Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_crawler.rds_sqlserver_db_glue_crawler
	File: /dms_glue_crawler.tf:35-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		35 | resource "aws_glue_crawler" "rds_sqlserver_db_glue_crawler" {
		36 |   name          = "rds-sqlserver-${aws_db_instance.database_2022.identifier}-tf"
		37 |   role          = aws_iam_role.dms_dv_glue_job_iam_role.arn
		38 |   database_name = aws_glue_catalog_database.rds_sqlserver_glue_catalog_db.name
		39 |   description   = "Crawler to fetch database names"
		40 |   #   table_prefix  = "your_table_prefix"
		41 | 
		42 |   jdbc_target {
		43 |     connection_name = aws_glue_connection.glue_rds_sqlserver_db_connection.name
		44 |     path            = "%"
		45 |   }
		46 |   tags = merge(
		47 |     local.tags,
		48 |     {
		49 |       Resource_Type = "RDS-SQLServer Glue-Crawler for DMS",
		50 |     }
		51 |   )
		52 | 
		53 |   # provisioner "local-exec" {
		54 |   #   command = "aws glue start-crawler --name ${self.name}"
		55 |   # }
		56 | }

Check: CKV_AWS_212: "Ensure DMS replication instance is encrypted by KMS using a customer managed Key (CMK)"
	FAILED for resource: aws_dms_replication_instance.dms_replication_instance
	File: /dms_replication_instance.tf:24-55
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-ebs-volume-is-encrypted-by-key-management-service-kms-using-a-customer-managed-key-cmk

		24 | resource "aws_dms_replication_instance" "dms_replication_instance" {
		25 |   allocated_storage          = var.dms_allocated_storage_gib
		26 |   apply_immediately          = true
		27 |   auto_minor_version_upgrade = true
		28 |   availability_zone          = var.dms_availability_zone
		29 |   engine_version             = var.dms_engine_version
		30 |   #   kms_key_arn                  = "arn:aws:kms:eu-west-2:800964199911:key/b7f54acb-16a3-4958-9340-3bdf5f5842d8"
		31 |   multi_az = false
		32 |   #   preferred_maintenance_window = "sun:10:30-sun:14:30"
		33 |   publicly_accessible         = false
		34 |   replication_instance_class  = var.dms_replication_instance_class
		35 |   replication_instance_id     = "dms-replication-instance-tf"
		36 |   replication_subnet_group_id = aws_dms_replication_subnet_group.dms_replication_subnet_group.id
		37 | 
		38 |   tags = merge(
		39 |     local.tags,
		40 |     {
		41 |       Resource_Type = "DMS Replication Instance",
		42 |     }
		43 |   )
		44 | 
		45 |   vpc_security_group_ids = [
		46 |     aws_security_group.dms_ri_security_group.id,
		47 |   ]
		48 | 
		49 |   depends_on = [
		50 |     aws_iam_role.dms_vpc_role,
		51 |     aws_iam_role.dms_cloudwatch_logs_role,
		52 |     aws_iam_role.dms_endpoint_role
		53 |   ]
		54 | 
		55 | }

Check: CKV_AWS_260: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 80"
	FAILED for resource: aws_vpc_security_group_ingress_rule.glue_rds_conn_inbound
	File: /dms_security_groups.tf:95-103
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-aws-security-groups-do-not-allow-ingress-from-00000-to-port-80

		95  | resource "aws_vpc_security_group_ingress_rule" "glue_rds_conn_inbound" {
		96  |   security_group_id = aws_security_group.glue_rds_conn_security_group.id
		97  | 
		98  |   referenced_security_group_id = aws_security_group.glue_rds_conn_security_group.id
		99  |   ip_protocol                  = "tcp"
		100 |   from_port                    = 0
		101 |   to_port                      = 65535
		102 |   description                  = "Required ports open for Glue-RDS-Connection"
		103 | }

Check: CKV_AWS_24: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 22"
	FAILED for resource: aws_vpc_security_group_ingress_rule.glue_rds_conn_inbound
	File: /dms_security_groups.tf:95-103
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-1-port-security

		95  | resource "aws_vpc_security_group_ingress_rule" "glue_rds_conn_inbound" {
		96  |   security_group_id = aws_security_group.glue_rds_conn_security_group.id
		97  | 
		98  |   referenced_security_group_id = aws_security_group.glue_rds_conn_security_group.id
		99  |   ip_protocol                  = "tcp"
		100 |   from_port                    = 0
		101 |   to_port                      = 65535
		102 |   description                  = "Required ports open for Glue-RDS-Connection"
		103 | }

Check: CKV_AWS_25: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389"
	FAILED for resource: aws_vpc_security_group_ingress_rule.glue_rds_conn_inbound
	File: /dms_security_groups.tf:95-103
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-2

		95  | resource "aws_vpc_security_group_ingress_rule" "glue_rds_conn_inbound" {
		96  |   security_group_id = aws_security_group.glue_rds_conn_security_group.id
		97  | 
		98  |   referenced_security_group_id = aws_security_group.glue_rds_conn_security_group.id
		99  |   ip_protocol                  = "tcp"
		100 |   from_port                    = 0
		101 |   to_port                      = 65535
		102 |   description                  = "Required ports open for Glue-RDS-Connection"
		103 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.glue_notebook_ec2_iam_policy_document
	File: /glue_data.tf:103-118
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		103 | data "aws_iam_policy_document" "glue_notebook_ec2_iam_policy_document" {
		104 |   statement {
		105 |     effect = "Allow"
		106 |     actions = [
		107 |       "ec2:CreateNetworkInterface",
		108 |       "ec2:DescribeNetworkInterfaces",
		109 |       "ec2:DeleteNetworkInterface",
		110 |       "ec2:DescribeVpcEndpoints",
		111 |       "ec2:DescribeSubnets",
		112 |       "ec2:DescribeVpcAttribute",
		113 |       "ec2:DescribeRouteTables",
		114 |       "ec2:DescribeSecurityGroups"
		115 |     ]
		116 |     resources = ["*"]
		117 |   }
		118 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.glue_notebook_ec2_iam_policy_document
	File: /glue_data.tf:103-118
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		103 | data "aws_iam_policy_document" "glue_notebook_ec2_iam_policy_document" {
		104 |   statement {
		105 |     effect = "Allow"
		106 |     actions = [
		107 |       "ec2:CreateNetworkInterface",
		108 |       "ec2:DescribeNetworkInterfaces",
		109 |       "ec2:DeleteNetworkInterface",
		110 |       "ec2:DescribeVpcEndpoints",
		111 |       "ec2:DescribeSubnets",
		112 |       "ec2:DescribeVpcAttribute",
		113 |       "ec2:DescribeRouteTables",
		114 |       "ec2:DescribeSecurityGroups"
		115 |     ]
		116 |     resources = ["*"]
		117 |   }
		118 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.load_json_table_s3_policy_document
	File: /lambdas_iam.tf:430-487
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.load_json_table_s3_policy_document
	File: /lambdas_iam.tf:430-487
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.db_glue_connection
	File: /lambdas_secrets.tf:1-3
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		1 | resource "aws_secretsmanager_secret" "db_glue_connection" {
		2 |   name = "db_glue_connection"
		3 | }

Check: CKV_AWS_296: "Ensure DMS endpoint uses Customer Managed Key (CMK)"
	FAILED for resource: module.dms_task.aws_dms_endpoint.dms_rds_source
	File: /modules/dms/endpoints_rds_s3.tf:2-23
	Calling File: /dms_main.tf:1-39
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-296

		2  | resource "aws_dms_endpoint" "dms_rds_source" {
		3  | 
		4  |   #   certificate_arn             = ""
		5  |   database_name = var.database_name
		6  |   endpoint_id   = "rds-mssql-${replace(var.database_name, "_", "-")}-tf"
		7  |   endpoint_type = "source"
		8  |   engine_name   = "sqlserver"
		9  |   #   extra_connection_attributes = ""
		10 |   #   kms_key_arn                 = aws_db_instance.database_2022.kms_key_id
		11 |   password    = var.rds_db_instance_pasword
		12 |   port        = var.rds_db_instance_port
		13 |   server_name = var.rds_db_server_name
		14 |   ssl_mode    = "require"
		15 |   username    = var.rds_db_username
		16 | 
		17 |   tags = merge(
		18 |     var.local_tags,
		19 |     {
		20 |       Resource_Type = "DMS Source Endpoint - RDS MSSQL",
		21 |     },
		22 |   )
		23 | }

Check: CKV_AWS_298: "Ensure DMS S3 uses Customer Managed Key (CMK)"
	FAILED for resource: module.dms_task.aws_dms_s3_endpoint.dms_s3_parquet_target
	File: /modules/dms/endpoints_rds_s3.tf:28-84
	Calling File: /dms_main.tf:1-39
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-298

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.athena_layer.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:39-48
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		39 | data "aws_iam_policy_document" "step_function_base_permissions" {
		40 |   statement {
		41 |     effect = "Allow"
		42 |     actions = [
		43 |       "sns:Publish",
		44 |       "sqs:SendMessage"
		45 |     ]
		46 |     resources = ["*"]
		47 |   }
		48 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.athena_layer.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:39-48
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		39 | data "aws_iam_policy_document" "step_function_base_permissions" {
		40 |   statement {
		41 |     effect = "Allow"
		42 |     actions = [
		43 |       "sns:Publish",
		44 |       "sqs:SendMessage"
		45 |     ]
		46 |     resources = ["*"]
		47 |   }
		48 | }

Check: CKV_AWS_109: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: module.athena_layer.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:55-79
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-permissions-management-resource-exposure-without-constraint

		55 | data "aws_iam_policy_document" "this_log_key_document" {
		56 |   statement {
		57 |     sid    = "EnableIAMUserPermissions"
		58 |     effect = "Allow"
		59 |     principals {
		60 |       type        = "AWS"
		61 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		62 |     }
		63 |     actions   = ["kms:*"]
		64 |     resources = ["*"]
		65 |   }
		66 | 
		67 |   statement {
		68 |     sid    = "EnableLogServicePermissions"
		69 |     effect = "Allow"
		70 |     principals {
		71 |       type        = "Service"
		72 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		73 |     }
		74 |     actions = [
		75 |       "kms:*",
		76 |     ]
		77 |     resources = ["*"]
		78 |   }
		79 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.athena_layer.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:55-79
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		55 | data "aws_iam_policy_document" "this_log_key_document" {
		56 |   statement {
		57 |     sid    = "EnableIAMUserPermissions"
		58 |     effect = "Allow"
		59 |     principals {
		60 |       type        = "AWS"
		61 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		62 |     }
		63 |     actions   = ["kms:*"]
		64 |     resources = ["*"]
		65 |   }
		66 | 
		67 |   statement {
		68 |     sid    = "EnableLogServicePermissions"
		69 |     effect = "Allow"
		70 |     principals {
		71 |       type        = "Service"
		72 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		73 |     }
		74 |     actions = [
		75 |       "kms:*",
		76 |     ]
		77 |     resources = ["*"]
		78 |   }
		79 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.athena_layer.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:55-79
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		55 | data "aws_iam_policy_document" "this_log_key_document" {
		56 |   statement {
		57 |     sid    = "EnableIAMUserPermissions"
		58 |     effect = "Allow"
		59 |     principals {
		60 |       type        = "AWS"
		61 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		62 |     }
		63 |     actions   = ["kms:*"]
		64 |     resources = ["*"]
		65 |   }
		66 | 
		67 |   statement {
		68 |     sid    = "EnableLogServicePermissions"
		69 |     effect = "Allow"
		70 |     principals {
		71 |       type        = "Service"
		72 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		73 |     }
		74 |     actions = [
		75 |       "kms:*",
		76 |     ]
		77 |     resources = ["*"]
		78 |   }
		79 | }

Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: module.athena_layer.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-8
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: module.athena_layer.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-8
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:39-48
	Calling File: /step_functions_main.tf:38-48
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		39 | data "aws_iam_policy_document" "step_function_base_permissions" {
		40 |   statement {
		41 |     effect = "Allow"
		42 |     actions = [
		43 |       "sns:Publish",
		44 |       "sqs:SendMessage"
		45 |     ]
		46 |     resources = ["*"]
		47 |   }
		48 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:39-48
	Calling File: /step_functions_main.tf:38-48
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		39 | data "aws_iam_policy_document" "step_function_base_permissions" {
		40 |   statement {
		41 |     effect = "Allow"
		42 |     actions = [
		43 |       "sns:Publish",
		44 |       "sqs:SendMessage"
		45 |     ]
		46 |     resources = ["*"]
		47 |   }
		48 | }

Check: CKV_AWS_109: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:55-79
	Calling File: /step_functions_main.tf:38-48
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-permissions-management-resource-exposure-without-constraint

		55 | data "aws_iam_policy_document" "this_log_key_document" {
		56 |   statement {
		57 |     sid    = "EnableIAMUserPermissions"
		58 |     effect = "Allow"
		59 |     principals {
		60 |       type        = "AWS"
		61 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		62 |     }
		63 |     actions   = ["kms:*"]
		64 |     resources = ["*"]
		65 |   }
		66 | 
		67 |   statement {
		68 |     sid    = "EnableLogServicePermissions"
		69 |     effect = "Allow"
		70 |     principals {
		71 |       type        = "Service"
		72 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		73 |     }
		74 |     actions = [
		75 |       "kms:*",
		76 |     ]
		77 |     resources = ["*"]
		78 |   }
		79 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:55-79
	Calling File: /step_functions_main.tf:38-48
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		55 | data "aws_iam_policy_document" "this_log_key_document" {
		56 |   statement {
		57 |     sid    = "EnableIAMUserPermissions"
		58 |     effect = "Allow"
		59 |     principals {
		60 |       type        = "AWS"
		61 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		62 |     }
		63 |     actions   = ["kms:*"]
		64 |     resources = ["*"]
		65 |   }
		66 | 
		67 |   statement {
		68 |     sid    = "EnableLogServicePermissions"
		69 |     effect = "Allow"
		70 |     principals {
		71 |       type        = "Service"
		72 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		73 |     }
		74 |     actions = [
		75 |       "kms:*",
		76 |     ]
		77 |     resources = ["*"]
		78 |   }
		79 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:55-79
	Calling File: /step_functions_main.tf:38-48
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		55 | data "aws_iam_policy_document" "this_log_key_document" {
		56 |   statement {
		57 |     sid    = "EnableIAMUserPermissions"
		58 |     effect = "Allow"
		59 |     principals {
		60 |       type        = "AWS"
		61 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		62 |     }
		63 |     actions   = ["kms:*"]
		64 |     resources = ["*"]
		65 |   }
		66 | 
		67 |   statement {
		68 |     sid    = "EnableLogServicePermissions"
		69 |     effect = "Allow"
		70 |     principals {
		71 |       type        = "Service"
		72 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		73 |     }
		74 |     actions = [
		75 |       "kms:*",
		76 |     ]
		77 |     resources = ["*"]
		78 |   }
		79 | }

Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: module.get_zipped_file.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-8
	Calling File: /step_functions_main.tf:38-48
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: module.get_zipped_file.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-8
	Calling File: /step_functions_main.tf:38-48
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.send_database_to_ap.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:39-48
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		39 | data "aws_iam_policy_document" "step_function_base_permissions" {
		40 |   statement {
		41 |     effect = "Allow"
		42 |     actions = [
		43 |       "sns:Publish",
		44 |       "sqs:SendMessage"
		45 |     ]
		46 |     resources = ["*"]
		47 |   }
		48 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.send_database_to_ap.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:39-48
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		39 | data "aws_iam_policy_document" "step_function_base_permissions" {
		40 |   statement {
		41 |     effect = "Allow"
		42 |     actions = [
		43 |       "sns:Publish",
		44 |       "sqs:SendMessage"
		45 |     ]
		46 |     resources = ["*"]
		47 |   }
		48 | }

Check: CKV_AWS_109: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: module.send_database_to_ap.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:55-79
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-permissions-management-resource-exposure-without-constraint

		55 | data "aws_iam_policy_document" "this_log_key_document" {
		56 |   statement {
		57 |     sid    = "EnableIAMUserPermissions"
		58 |     effect = "Allow"
		59 |     principals {
		60 |       type        = "AWS"
		61 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		62 |     }
		63 |     actions   = ["kms:*"]
		64 |     resources = ["*"]
		65 |   }
		66 | 
		67 |   statement {
		68 |     sid    = "EnableLogServicePermissions"
		69 |     effect = "Allow"
		70 |     principals {
		71 |       type        = "Service"
		72 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		73 |     }
		74 |     actions = [
		75 |       "kms:*",
		76 |     ]
		77 |     resources = ["*"]
		78 |   }
		79 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.send_database_to_ap.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:55-79
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		55 | data "aws_iam_policy_document" "this_log_key_document" {
		56 |   statement {
		57 |     sid    = "EnableIAMUserPermissions"
		58 |     effect = "Allow"
		59 |     principals {
		60 |       type        = "AWS"
		61 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		62 |     }
		63 |     actions   = ["kms:*"]
		64 |     resources = ["*"]
		65 |   }
		66 | 
		67 |   statement {
		68 |     sid    = "EnableLogServicePermissions"
		69 |     effect = "Allow"
		70 |     principals {
		71 |       type        = "Service"
		72 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		73 |     }
		74 |     actions = [
		75 |       "kms:*",
		76 |     ]
		77 |     resources = ["*"]
		78 |   }
		79 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.send_database_to_ap.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:55-79
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		55 | data "aws_iam_policy_document" "this_log_key_document" {
		56 |   statement {
		57 |     sid    = "EnableIAMUserPermissions"
		58 |     effect = "Allow"
		59 |     principals {
		60 |       type        = "AWS"
		61 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		62 |     }
		63 |     actions   = ["kms:*"]
		64 |     resources = ["*"]
		65 |   }
		66 | 
		67 |   statement {
		68 |     sid    = "EnableLogServicePermissions"
		69 |     effect = "Allow"
		70 |     principals {
		71 |       type        = "Service"
		72 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		73 |     }
		74 |     actions = [
		75 |       "kms:*",
		76 |     ]
		77 |     resources = ["*"]
		78 |   }
		79 | }

Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: module.send_database_to_ap.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-8
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: module.send_database_to_ap.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-8
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 | }

Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.db_password
	File: /server_backups.tf:4-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		4 | resource "aws_secretsmanager_secret" "db_password" {
		5 |   name = "db_password"
		6 | }

Check: CKV_AWS_354: "Ensure RDS Performance Insights are encrypted using KMS CMKs"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-354

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_157: "Ensure that RDS instances have Multi-AZ enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-73

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_118: "Ensure that enhanced monitoring is enabled for Amazon RDS instances"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/ensure-that-enhanced-monitoring-is-enabled-for-amazon-rds-instances

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_353: "Ensure that RDS instances have performance insights enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-353

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_293: "Ensure that AWS database instances have deletion protection enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-293

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_129: "Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-that-respective-logs-of-amazon-relational-database-service-amazon-rds-are-enabled

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.send_database_to_ap
	File: /step_functions_iam.tf:44-118
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.send_database_to_ap
	File: /step_functions_iam.tf:44-118
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.db_glue_connection
	File: /lambdas_secrets.tf:1-3
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		1 | resource "aws_secretsmanager_secret" "db_glue_connection" {
		2 |   name = "db_glue_connection"
		3 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.db_password
	File: /server_backups.tf:4-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		4 | resource "aws_secretsmanager_secret" "db_password" {
		5 |   name = "db_password"
		6 | }

Check: CKV2_AWS_60: "Ensure RDS instance with copy tags to snapshots is enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-60

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: aws_security_group.glue_rds_conn_security_group
	File: /dms_security_groups.tf:71-82
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		71 | resource "aws_security_group" "glue_rds_conn_security_group" {
		72 |   name        = "glue-rds-sqlserver-connection-tf"
		73 |   description = "Secuity Group for Glue-RDS-Connection"
		74 |   vpc_id      = data.aws_vpc.shared.id
		75 | 
		76 |   tags = merge(
		77 |     local.tags,
		78 |     {
		79 |       Resource_Type = "Secuity Group for Glue-RDS-Connection",
		80 |     }
		81 |   )
		82 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: module.buddi.module.landing_zone_security_groups.aws_security_group.this
	File: /modules/landing_zone/server_security_group/main.tf:7-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		7  | resource "aws_security_group" "this" {
		8  |   name        = "${var.supplier}-${var.user_name}-inbound-ips"
		9  |   description = "Allowed IP addresses for ${var.user_name} on ${var.supplier} server"
		10 |   vpc_id      = var.vpc_id
		11 | 
		12 |   lifecycle {
		13 |     create_before_destroy = true
		14 |   }
		15 | 
		16 |   tags = merge(
		17 |     var.local_tags,
		18 |     {
		19 |       supplier = var.user_name,
		20 |     },
		21 |   )
		22 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: module.capita.module.landing_zone_security_groups.aws_security_group.this
	File: /modules/landing_zone/server_security_group/main.tf:7-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		7  | resource "aws_security_group" "this" {
		8  |   name        = "${var.supplier}-${var.user_name}-inbound-ips"
		9  |   description = "Allowed IP addresses for ${var.user_name} on ${var.supplier} server"
		10 |   vpc_id      = var.vpc_id
		11 | 
		12 |   lifecycle {
		13 |     create_before_destroy = true
		14 |   }
		15 | 
		16 |   tags = merge(
		17 |     var.local_tags,
		18 |     {
		19 |       supplier = var.user_name,
		20 |     },
		21 |   )
		22 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: module.g4s.module.landing_zone_security_groups.aws_security_group.this
	File: /modules/landing_zone/server_security_group/main.tf:7-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		7  | resource "aws_security_group" "this" {
		8  |   name        = "${var.supplier}-${var.user_name}-inbound-ips"
		9  |   description = "Allowed IP addresses for ${var.user_name} on ${var.supplier} server"
		10 |   vpc_id      = var.vpc_id
		11 | 
		12 |   lifecycle {
		13 |     create_before_destroy = true
		14 |   }
		15 | 
		16 |   tags = merge(
		17 |     var.local_tags,
		18 |     {
		19 |       supplier = var.user_name,
		20 |     },
		21 |   )
		22 | }

dockerfile scan results:

Passed checks: 21, Failed checks: 2, Skipped checks: 0

Check: CKV_DOCKER_2: "Ensure that HEALTHCHECK instructions have been added to container images"
	FAILED for resource: /lambdas/update_log_table/Dockerfile.
	File: /lambdas/update_log_table/Dockerfile:1-9
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/docker-policies/docker-policy-index/ensure-that-healthcheck-instructions-have-been-added-to-container-images

		1 | FROM public.ecr.aws/lambda/python:3.11
		2 | 
		3 | COPY requirements.txt .
		4 | 
		5 | RUN pip install -r requirements.txt --target "${LAMBDA_TASK_ROOT}"
		6 | 
		7 | COPY update_log_table.py ${LAMBDA_TASK_ROOT}
		8 | 
		9 | CMD ["update_log_table.handler"]

Check: CKV_DOCKER_3: "Ensure that a user for the container has been created"
	FAILED for resource: /lambdas/update_log_table/Dockerfile.
	File: /lambdas/update_log_table/Dockerfile:1-9
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/docker-policies/docker-policy-index/ensure-that-a-user-for-the-container-has-been-created

		1 | FROM public.ecr.aws/lambda/python:3.11
		2 | 
		3 | COPY requirements.txt .
		4 | 
		5 | RUN pip install -r requirements.txt --target "${LAMBDA_TASK_ROOT}"
		6 | 
		7 | COPY update_log_table.py ${LAMBDA_TASK_ROOT}
		8 | 
		9 | CMD ["update_log_table.handler"]


checkov_exitcode=1

CTFLint Scan Failed

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
terraform/environments/electronic-monitoring-data

*****************************

Running tflint in terraform/environments/electronic-monitoring-data
Excluding the following checks: terraform_unused_declarations
3 issue(s) found:

Warning: Missing version constraint for provider "archive" in `required_providers` (terraform_required_providers)

  on terraform/environments/electronic-monitoring-data/data_store.tf line 151:
 151: data "archive_file" "summarise_zip_lambda" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

Warning: `s3_pylib_dir_path` variable has no type (terraform_typed_variables)

  on terraform/environments/electronic-monitoring-data/glue_variables.tf line 1:
   1: variable "s3_pylib_dir_path" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_typed_variables.md

Warning: Missing version constraint for provider "random" in `required_providers` (terraform_required_providers)

  on terraform/environments/electronic-monitoring-data/server_backups.tf line 13:
  13: resource "random_password" "random_password" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

tflint_exitcode=2

Trivy Scan Failed

Show Output

*****************************

Trivy will check the following folders:
terraform/environments/electronic-monitoring-data

*****************************

Running Trivy in terraform/environments/electronic-monitoring-data
2024-10-21T15:36:04Z	INFO	[vulndb] Need to update DB
2024-10-21T15:36:04Z	INFO	[vulndb] Downloading vulnerability DB...
2024-10-21T15:36:04Z	INFO	[vulndb] Downloading artifact...	repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-21T15:36:04Z	ERROR	[vulndb] Failed to download artifact	repo="ghcr.io/aquasecurity/trivy-db:2" err="oci download error: failed to fetch the layer: GET https://ghcr.io/v2/aquasecurity/trivy-db/blobs/sha256:07994604d8e647483cf5193669d01210524ae223c43ca96364d63f59bd64d9bf: TOOMANYREQUESTS: retry-after: 26.136µs, allowed: 44000/minute"
2024-10-21T15:36:04Z	FATAL	Fatal error	init error: DB error: failed to download vulnerability DB: OCI artifact error: failed to download vulnerability DB: failed to download artifact from any source
trivy_exitcode=1

reviews by MP team