step function express #8351

matt-heery · 2024-10-21T20:03:54Z

No description provided.

github-actions · 2024-10-21T20:06:31Z

`Trivy Scan` Failed

Show Output

```hcl

Trivy will check the following folders:
terraform/environments/electronic-monitoring-data/modules/step_function
terraform/environments/electronic-monitoring-data

Running Trivy in terraform/environments/electronic-monitoring-data/modules/step_function
2024-10-21T20:06:06Z INFO [vulndb] Need to update DB
2024-10-21T20:06:06Z INFO [vulndb] Downloading vulnerability DB...
2024-10-21T20:06:06Z INFO [vulndb] Downloading artifact... repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-21T20:06:06Z ERROR [vulndb] Failed to download artifact repo="ghcr.io/aquasecurity/trivy-db:2" err="OCI repository error: 1 error occurred:\n\t* GET https://ghcr.io/v2/aquasecurity/trivy-db/manifests/2: TOOMANYREQUESTS: retry-after: 541.627µs, allowed: 44000/minute\n\n"
2024-10-21T20:06:06Z FATAL Fatal error init error: DB error: failed to download vulnerability DB: OCI artifact error: failed to download vulnerability DB: failed to download artifact from any source
trivy_exitcode=1

Running Trivy in terraform/environments/electronic-monitoring-data
2024-10-21T20:06:06Z INFO [vulndb] Need to update DB
2024-10-21T20:06:06Z INFO [vulndb] Downloading vulnerability DB...
2024-10-21T20:06:06Z INFO [vulndb] Downloading artifact... repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-21T20:06:09Z INFO [vulndb] Artifact successfully downloaded repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-21T20:06:09Z INFO [vuln] Vulnerability scanning is enabled
2024-10-21T20:06:09Z INFO [misconfig] Misconfiguration scanning is enabled
2024-10-21T20:06:09Z INFO [misconfig] Need to update the built-in checks
2024-10-21T20:06:09Z INFO [misconfig] Downloading the built-in checks...
2024-10-21T20:06:09Z ERROR [misconfig] Falling back to embedded checks err="failed to download built-in policies: download error: oci download error: failed to fetch the layer: GET https://ghcr.io/v2/aquasecurity/trivy-checks/blobs/sha256:16957b935ef82529bc26f3ceeeb60d798c90ef142d25e3715ab4478b204ed1bb: TOOMANYREQUESTS: retry-after: 862.121µs, allowed: 44000/minute"
2024-10-21T20:06:09Z INFO [secret] Secret scanning is enabled
2024-10-21T20:06:09Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-21T20:06:09Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-10-21T20:06:09Z WARN [pip] Unable to find python site-packages directory. License detection is skipped. err="site-packages directory not found"
2024-10-21T20:06:10Z INFO [terraform scanner] Scanning root module file_path="."
2024-10-21T20:06:10Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="networking"
2024-10-21T20:06:11Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:06:11Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:06:11Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:06:11Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:06:11Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:06:11Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.aws_s3_object.user_public_keys" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.data.aws_subnet.local_account" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:06:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:06:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:06:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:06:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:06:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:06:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:06:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:06:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:06:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:06:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:06:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:06:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:06:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:06:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:06:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:06:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:06:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:06:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:06:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:06:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:06:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:06:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:06:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:06:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:06:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:06:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:06:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:06:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:06:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:06:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:06:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:06:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:06:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:06:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:06:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:06:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:06:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:06:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:06:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:06:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:06:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:06:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:06:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:06:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:06:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:06:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:06:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:06:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:06:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:06:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:06:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:06:18Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-21T20:06:18Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-21T20:06:18Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-bucket-encryption" range="s3.tf:1061-1080"
2024-10-21T20:06:18Z INFO [terraform executor] Ignore finding rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:281-286"
2024-10-21T20:06:18Z INFO [terraform executor] Ignore finding rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:407-411"
2024-10-21T20:06:18Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-versioning" range="s3.tf:1061-1080"
2024-10-21T20:06:18Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:06:18Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:06:18Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:06:18Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:06:18Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:06:18Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:06:18Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:06:18Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:06:18Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:06:18Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:06:18Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:06:18Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=95ed3c3/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=568694e50e03630d99cb569eafa06a0b879a1239/main.tf:171-179"
2024-10-21T20:06:18Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="s3.tf:1061-1080"
2024-10-21T20:06:18Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-logging" range="s3.tf:1061-1080"
2024-10-21T20:06:18Z INFO Number of language-specific files num=1
2024-10-21T20:06:18Z INFO [pip] Detecting vulnerabilities...
2024-10-21T20:06:18Z INFO Detected config files num=17

lambdas/update_log_table/Dockerfile (dockerfile)

Tests: 20 (SUCCESSES: 19, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Specify at least 1 USER command in Dockerfile with non-root user as argument
════════════════════════════════════════
Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

See https://avd.aquasec.com/misconfig/ds002
────────────────────────────────────────

trivy_exitcode=2

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/electronic-monitoring-data/modules/step_function
terraform/environments/electronic-monitoring-data

*****************************

Running Checkov in terraform/environments/electronic-monitoring-data/modules/step_function
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
terraform scan results:

Passed checks: 43, Failed checks: 7, Skipped checks: 0

Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: aws_sfn_state_machine.this
	File: /main.tf:4-9
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 |   type       = var.type
		9 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: aws_sfn_state_machine.this
	File: /main.tf:4-9
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 |   type       = var.type
		9 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.step_function_base_permissions
	File: /main.tf:40-49
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		40 | data "aws_iam_policy_document" "step_function_base_permissions" {
		41 |   statement {
		42 |     effect = "Allow"
		43 |     actions = [
		44 |       "sns:Publish",
		45 |       "sqs:SendMessage"
		46 |     ]
		47 |     resources = ["*"]
		48 |   }
		49 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.step_function_base_permissions
	File: /main.tf:40-49
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		40 | data "aws_iam_policy_document" "step_function_base_permissions" {
		41 |   statement {
		42 |     effect = "Allow"
		43 |     actions = [
		44 |       "sns:Publish",
		45 |       "sqs:SendMessage"
		46 |     ]
		47 |     resources = ["*"]
		48 |   }
		49 | }

Check: CKV_AWS_109: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: aws_iam_policy_document.this_log_key_document
	File: /main.tf:56-80
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-permissions-management-resource-exposure-without-constraint

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.this_log_key_document
	File: /main.tf:56-80
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.this_log_key_document
	File: /main.tf:56-80
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }


checkov_exitcode=1

*****************************

Running Checkov in terraform/environments/electronic-monitoring-data
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2024-10-21 20:06:23,970 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=95ed3c3:None (for external modules, the --download-external-modules flag is required)
2024-10-21 20:06:23,970 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060:None (for external modules, the --download-external-modules flag is required)
2024-10-21 20:06:23,970 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/secrets-manager/aws:1.3.0 (for external modules, the --download-external-modules flag is required)
2024-10-21 20:06:23,971 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=52a40b0:None (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 2270, Failed checks: 75, Skipped checks: 37

Check: CKV_AWS_26: "Ensure all data stored in the SNS topic is encrypted"
	FAILED for resource: aws_sns_topic.s3_events
	File: /data_store.tf:17-19
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-15

		17 | resource "aws_sns_topic" "s3_events" {
		18 |   name = "${module.s3-data-bucket.bucket.id}-object-created-topic"
		19 | }

Check: CKV_AWS_115: "Ensure that AWS Lambda function is configured for function-level concurrent execution limit"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-function-level-concurrent-execution-limit

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_173: "Check encryption settings for Lambda environmental variable"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-5

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_116: "Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-a-dead-letter-queue-dlq

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_272: "Ensure AWS Lambda function is configured to validate code-signing"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-272

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_117: "Ensure that AWS Lambda function is configured inside a VPC"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-inside-a-vpc-1

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_115: "Ensure that AWS Lambda function is configured for function-level concurrent execution limit"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-function-level-concurrent-execution-limit

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_116: "Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-a-dead-letter-queue-dlq

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_272: "Ensure AWS Lambda function is configured to validate code-signing"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-272

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_117: "Ensure that AWS Lambda function is configured inside a VPC"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-inside-a-vpc-1

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group
	File: /dms_data_validation_glue_job.tf:58-61
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		58 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group" {
		59 |   name              = "dms-dv-glue-job"
		60 |   retention_in_days = 14
		61 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group
	File: /dms_data_validation_glue_job.tf:58-61
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		58 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group" {
		59 |   name              = "dms-dv-glue-job"
		60 |   retention_in_days = 14
		61 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group_v2
	File: /dms_data_validation_glue_job.tf:63-66
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		63 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group_v2" {
		64 |   name              = "dms-dv-glue-job-v2"
		65 |   retention_in_days = 14
		66 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group_v2
	File: /dms_data_validation_glue_job.tf:63-66
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		63 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group_v2" {
		64 |   name              = "dms-dv-glue-job-v2"
		65 |   retention_in_days = 14
		66 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.rds_to_s3_parquet_migration
	File: /dms_data_validation_glue_job.tf:68-71
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		68 | resource "aws_cloudwatch_log_group" "rds_to_s3_parquet_migration" {
		69 |   name              = "rds-to-s3-parquet-migration"
		70 |   retention_in_days = 14
		71 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.rds_to_s3_parquet_migration
	File: /dms_data_validation_glue_job.tf:68-71
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		68 | resource "aws_cloudwatch_log_group" "rds_to_s3_parquet_migration" {
		69 |   name              = "rds-to-s3-parquet-migration"
		70 |   retention_in_days = 14
		71 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.resizing_parquet_files
	File: /dms_data_validation_glue_job.tf:73-76
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		73 | resource "aws_cloudwatch_log_group" "resizing_parquet_files" {
		74 |   name              = "resizing-parquet-files"
		75 |   retention_in_days = 14
		76 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.resizing_parquet_files
	File: /dms_data_validation_glue_job.tf:73-76
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		73 | resource "aws_cloudwatch_log_group" "resizing_parquet_files" {
		74 |   name              = "resizing-parquet-files"
		75 |   retention_in_days = 14
		76 | }

Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.dms_dv_glue_job_v2
	File: /dms_data_validation_glue_job.tf:79-132
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.dms_dv_glue_job_v4d
	File: /dms_data_validation_glue_job.tf:140-193
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.rds_to_s3_parquet_migration
	File: /dms_data_validation_glue_job.tf:196-260
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.rds_to_s3_parquet_migration_monthly
	File: /dms_data_validation_glue_job.tf:264-315
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.resizing_parquet_files
	File: /dms_data_validation_glue_job.tf:318-370
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.catalog_dv_table_glue_job
	File: /dms_data_validation_glue_job.tf:373-401
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		373 | resource "aws_glue_job" "catalog_dv_table_glue_job" {
		374 |   name              = "catalog-dv-table-glue-job"
		375 |   description       = "Python script uses Boto3-Athena-Client to run sql-statements"
		376 |   role_arn          = aws_iam_role.dms_dv_glue_job_iam_role.arn
		377 |   glue_version      = "4.0"
		378 |   worker_type       = "G.1X"
		379 |   number_of_workers = 2
		380 |   default_arguments = {
		381 |     "--parquet_output_bucket_name"       = module.s3-dms-data-validation-bucket.bucket.id
		382 |     "--glue_catalog_db_name"             = aws_glue_catalog_database.dms_dv_glue_catalog_db.name
		383 |     "--glue_catalog_tbl_name"            = "glue_df_output"
		384 |     "--continuous-log-logGroup"          = aws_cloudwatch_log_group.dms_dv_cw_log_group.name
		385 |     "--enable-continuous-cloudwatch-log" = "true"
		386 |     "--enable-continuous-log-filter"     = "true"
		387 |     "--enable-metrics"                   = ""
		388 |   }
		389 |   command {
		390 |     python_version  = "3"
		391 |     script_location = "s3://${module.s3-glue-job-script-bucket.bucket.id}/create_or_replace_dv_table.py"
		392 |   }
		393 | 
		394 |   tags = merge(
		395 |     local.tags,
		396 |     {
		397 |       Resource_Type = "Py script as glue-job that creates dv table / refreshes its partitions",
		398 |     }
		399 |   )
		400 | 
		401 | }

Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_crawler.rds_sqlserver_db_glue_crawler
	File: /dms_glue_crawler.tf:35-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		35 | resource "aws_glue_crawler" "rds_sqlserver_db_glue_crawler" {
		36 |   name          = "rds-sqlserver-${aws_db_instance.database_2022.identifier}-tf"
		37 |   role          = aws_iam_role.dms_dv_glue_job_iam_role.arn
		38 |   database_name = aws_glue_catalog_database.rds_sqlserver_glue_catalog_db.name
		39 |   description   = "Crawler to fetch database names"
		40 |   #   table_prefix  = "your_table_prefix"
		41 | 
		42 |   jdbc_target {
		43 |     connection_name = aws_glue_connection.glue_rds_sqlserver_db_connection.name
		44 |     path            = "%"
		45 |   }
		46 |   tags = merge(
		47 |     local.tags,
		48 |     {
		49 |       Resource_Type = "RDS-SQLServer Glue-Crawler for DMS",
		50 |     }
		51 |   )
		52 | 
		53 |   # provisioner "local-exec" {
		54 |   #   command = "aws glue start-crawler --name ${self.name}"
		55 |   # }
		56 | }

Check: CKV_AWS_212: "Ensure DMS replication instance is encrypted by KMS using a customer managed Key (CMK)"
	FAILED for resource: aws_dms_replication_instance.dms_replication_instance
	File: /dms_replication_instance.tf:24-55
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-ebs-volume-is-encrypted-by-key-management-service-kms-using-a-customer-managed-key-cmk

		24 | resource "aws_dms_replication_instance" "dms_replication_instance" {
		25 |   allocated_storage          = var.dms_allocated_storage_gib
		26 |   apply_immediately          = true
		27 |   auto_minor_version_upgrade = true
		28 |   availability_zone          = var.dms_availability_zone
		29 |   engine_version             = var.dms_engine_version
		30 |   #   kms_key_arn                  = "arn:aws:kms:eu-west-2:800964199911:key/b7f54acb-16a3-4958-9340-3bdf5f5842d8"
		31 |   multi_az = false
		32 |   #   preferred_maintenance_window = "sun:10:30-sun:14:30"
		33 |   publicly_accessible         = false
		34 |   replication_instance_class  = var.dms_replication_instance_class
		35 |   replication_instance_id     = "dms-replication-instance-tf"
		36 |   replication_subnet_group_id = aws_dms_replication_subnet_group.dms_replication_subnet_group.id
		37 | 
		38 |   tags = merge(
		39 |     local.tags,
		40 |     {
		41 |       Resource_Type = "DMS Replication Instance",
		42 |     }
		43 |   )
		44 | 
		45 |   vpc_security_group_ids = [
		46 |     aws_security_group.dms_ri_security_group.id,
		47 |   ]
		48 | 
		49 |   depends_on = [
		50 |     aws_iam_role.dms_vpc_role,
		51 |     aws_iam_role.dms_cloudwatch_logs_role,
		52 |     aws_iam_role.dms_endpoint_role
		53 |   ]
		54 | 
		55 | }

Check: CKV_AWS_260: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 80"
	FAILED for resource: aws_vpc_security_group_ingress_rule.glue_rds_conn_inbound
	File: /dms_security_groups.tf:95-103
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-aws-security-groups-do-not-allow-ingress-from-00000-to-port-80

		95  | resource "aws_vpc_security_group_ingress_rule" "glue_rds_conn_inbound" {
		96  |   security_group_id = aws_security_group.glue_rds_conn_security_group.id
		97  | 
		98  |   referenced_security_group_id = aws_security_group.glue_rds_conn_security_group.id
		99  |   ip_protocol                  = "tcp"
		100 |   from_port                    = 0
		101 |   to_port                      = 65535
		102 |   description                  = "Required ports open for Glue-RDS-Connection"
		103 | }

Check: CKV_AWS_24: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 22"
	FAILED for resource: aws_vpc_security_group_ingress_rule.glue_rds_conn_inbound
	File: /dms_security_groups.tf:95-103
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-1-port-security

		95  | resource "aws_vpc_security_group_ingress_rule" "glue_rds_conn_inbound" {
		96  |   security_group_id = aws_security_group.glue_rds_conn_security_group.id
		97  | 
		98  |   referenced_security_group_id = aws_security_group.glue_rds_conn_security_group.id
		99  |   ip_protocol                  = "tcp"
		100 |   from_port                    = 0
		101 |   to_port                      = 65535
		102 |   description                  = "Required ports open for Glue-RDS-Connection"
		103 | }

Check: CKV_AWS_25: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389"
	FAILED for resource: aws_vpc_security_group_ingress_rule.glue_rds_conn_inbound
	File: /dms_security_groups.tf:95-103
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-2

		95  | resource "aws_vpc_security_group_ingress_rule" "glue_rds_conn_inbound" {
		96  |   security_group_id = aws_security_group.glue_rds_conn_security_group.id
		97  | 
		98  |   referenced_security_group_id = aws_security_group.glue_rds_conn_security_group.id
		99  |   ip_protocol                  = "tcp"
		100 |   from_port                    = 0
		101 |   to_port                      = 65535
		102 |   description                  = "Required ports open for Glue-RDS-Connection"
		103 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.glue_notebook_ec2_iam_policy_document
	File: /glue_data.tf:96-111
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		96  | data "aws_iam_policy_document" "glue_notebook_ec2_iam_policy_document" {
		97  |   statement {
		98  |     effect = "Allow"
		99  |     actions = [
		100 |       "ec2:CreateNetworkInterface",
		101 |       "ec2:DescribeNetworkInterfaces",
		102 |       "ec2:DeleteNetworkInterface",
		103 |       "ec2:DescribeVpcEndpoints",
		104 |       "ec2:DescribeSubnets",
		105 |       "ec2:DescribeVpcAttribute",
		106 |       "ec2:DescribeRouteTables",
		107 |       "ec2:DescribeSecurityGroups"
		108 |     ]
		109 |     resources = ["*"]
		110 |   }
		111 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.glue_notebook_ec2_iam_policy_document
	File: /glue_data.tf:96-111
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		96  | data "aws_iam_policy_document" "glue_notebook_ec2_iam_policy_document" {
		97  |   statement {
		98  |     effect = "Allow"
		99  |     actions = [
		100 |       "ec2:CreateNetworkInterface",
		101 |       "ec2:DescribeNetworkInterfaces",
		102 |       "ec2:DeleteNetworkInterface",
		103 |       "ec2:DescribeVpcEndpoints",
		104 |       "ec2:DescribeSubnets",
		105 |       "ec2:DescribeVpcAttribute",
		106 |       "ec2:DescribeRouteTables",
		107 |       "ec2:DescribeSecurityGroups"
		108 |     ]
		109 |     resources = ["*"]
		110 |   }
		111 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.load_json_table_s3_policy_document
	File: /lambdas_iam.tf:430-487
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.load_json_table_s3_policy_document
	File: /lambdas_iam.tf:430-487
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.db_glue_connection
	File: /lambdas_secrets.tf:1-3
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		1 | resource "aws_secretsmanager_secret" "db_glue_connection" {
		2 |   name = "db_glue_connection"
		3 | }

Check: CKV_AWS_296: "Ensure DMS endpoint uses Customer Managed Key (CMK)"
	FAILED for resource: module.dms_task.aws_dms_endpoint.dms_rds_source
	File: /modules/dms/endpoints_rds_s3.tf:2-23
	Calling File: /dms_main.tf:1-39
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-296

		2  | resource "aws_dms_endpoint" "dms_rds_source" {
		3  | 
		4  |   #   certificate_arn             = ""
		5  |   database_name = var.database_name
		6  |   endpoint_id   = "rds-mssql-${replace(var.database_name, "_", "-")}-tf"
		7  |   endpoint_type = "source"
		8  |   engine_name   = "sqlserver"
		9  |   #   extra_connection_attributes = ""
		10 |   #   kms_key_arn                 = aws_db_instance.database_2022.kms_key_id
		11 |   password    = var.rds_db_instance_pasword
		12 |   port        = var.rds_db_instance_port
		13 |   server_name = var.rds_db_server_name
		14 |   ssl_mode    = "require"
		15 |   username    = var.rds_db_username
		16 | 
		17 |   tags = merge(
		18 |     var.local_tags,
		19 |     {
		20 |       Resource_Type = "DMS Source Endpoint - RDS MSSQL",
		21 |     },
		22 |   )
		23 | }

Check: CKV_AWS_298: "Ensure DMS S3 uses Customer Managed Key (CMK)"
	FAILED for resource: module.dms_task.aws_dms_s3_endpoint.dms_s3_parquet_target
	File: /modules/dms/endpoints_rds_s3.tf:28-84
	Calling File: /dms_main.tf:1-39
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-298

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.athena_layer.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:40-49
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		40 | data "aws_iam_policy_document" "step_function_base_permissions" {
		41 |   statement {
		42 |     effect = "Allow"
		43 |     actions = [
		44 |       "sns:Publish",
		45 |       "sqs:SendMessage"
		46 |     ]
		47 |     resources = ["*"]
		48 |   }
		49 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.athena_layer.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:40-49
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		40 | data "aws_iam_policy_document" "step_function_base_permissions" {
		41 |   statement {
		42 |     effect = "Allow"
		43 |     actions = [
		44 |       "sns:Publish",
		45 |       "sqs:SendMessage"
		46 |     ]
		47 |     resources = ["*"]
		48 |   }
		49 | }

Check: CKV_AWS_109: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: module.athena_layer.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-permissions-management-resource-exposure-without-constraint

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.athena_layer.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.athena_layer.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: module.athena_layer.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-9
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 |   type       = var.type
		9 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: module.athena_layer.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-9
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 |   type       = var.type
		9 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:40-49
	Calling File: /step_functions_main.tf:38-49
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		40 | data "aws_iam_policy_document" "step_function_base_permissions" {
		41 |   statement {
		42 |     effect = "Allow"
		43 |     actions = [
		44 |       "sns:Publish",
		45 |       "sqs:SendMessage"
		46 |     ]
		47 |     resources = ["*"]
		48 |   }
		49 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:40-49
	Calling File: /step_functions_main.tf:38-49
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		40 | data "aws_iam_policy_document" "step_function_base_permissions" {
		41 |   statement {
		42 |     effect = "Allow"
		43 |     actions = [
		44 |       "sns:Publish",
		45 |       "sqs:SendMessage"
		46 |     ]
		47 |     resources = ["*"]
		48 |   }
		49 | }

Check: CKV_AWS_109: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:38-49
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-permissions-management-resource-exposure-without-constraint

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:38-49
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:38-49
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: module.get_zipped_file.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-9
	Calling File: /step_functions_main.tf:38-49
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 |   type       = var.type
		9 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: module.get_zipped_file.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-9
	Calling File: /step_functions_main.tf:38-49
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 |   type       = var.type
		9 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.send_database_to_ap.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:40-49
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		40 | data "aws_iam_policy_document" "step_function_base_permissions" {
		41 |   statement {
		42 |     effect = "Allow"
		43 |     actions = [
		44 |       "sns:Publish",
		45 |       "sqs:SendMessage"
		46 |     ]
		47 |     resources = ["*"]
		48 |   }
		49 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.send_database_to_ap.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:40-49
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		40 | data "aws_iam_policy_document" "step_function_base_permissions" {
		41 |   statement {
		42 |     effect = "Allow"
		43 |     actions = [
		44 |       "sns:Publish",
		45 |       "sqs:SendMessage"
		46 |     ]
		47 |     resources = ["*"]
		48 |   }
		49 | }

Check: CKV_AWS_109: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: module.send_database_to_ap.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-permissions-management-resource-exposure-without-constraint

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.send_database_to_ap.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.send_database_to_ap.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: module.send_database_to_ap.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-9
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 |   type       = var.type
		9 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: module.send_database_to_ap.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-9
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 |   type       = var.type
		9 | }

Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.db_password
	File: /server_backups.tf:4-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		4 | resource "aws_secretsmanager_secret" "db_password" {
		5 |   name = "db_password"
		6 | }

Check: CKV_AWS_354: "Ensure RDS Performance Insights are encrypted using KMS CMKs"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-354

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_157: "Ensure that RDS instances have Multi-AZ enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-73

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_118: "Ensure that enhanced monitoring is enabled for Amazon RDS instances"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/ensure-that-enhanced-monitoring-is-enabled-for-amazon-rds-instances

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_353: "Ensure that RDS instances have performance insights enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-353

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_293: "Ensure that AWS database instances have deletion protection enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-293

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_129: "Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-that-respective-logs-of-amazon-relational-database-service-amazon-rds-are-enabled

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.send_database_to_ap
	File: /step_functions_iam.tf:44-118
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.send_database_to_ap
	File: /step_functions_iam.tf:44-118
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.db_glue_connection
	File: /lambdas_secrets.tf:1-3
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		1 | resource "aws_secretsmanager_secret" "db_glue_connection" {
		2 |   name = "db_glue_connection"
		3 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.db_password
	File: /server_backups.tf:4-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		4 | resource "aws_secretsmanager_secret" "db_password" {
		5 |   name = "db_password"
		6 | }

Check: CKV2_AWS_60: "Ensure RDS instance with copy tags to snapshots is enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-60

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: aws_security_group.glue_rds_conn_security_group
	File: /dms_security_groups.tf:71-82
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		71 | resource "aws_security_group" "glue_rds_conn_security_group" {
		72 |   name        = "glue-rds-sqlserver-connection-tf"
		73 |   description = "Secuity Group for Glue-RDS-Connection"
		74 |   vpc_id      = data.aws_vpc.shared.id
		75 | 
		76 |   tags = merge(
		77 |     local.tags,
		78 |     {
		79 |       Resource_Type = "Secuity Group for Glue-RDS-Connection",
		80 |     }
		81 |   )
		82 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: module.buddi.module.landing_zone_security_groups.aws_security_group.this
	File: /modules/landing_zone/server_security_group/main.tf:7-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		7  | resource "aws_security_group" "this" {
		8  |   name        = "${var.supplier}-${var.user_name}-inbound-ips"
		9  |   description = "Allowed IP addresses for ${var.user_name} on ${var.supplier} server"
		10 |   vpc_id      = var.vpc_id
		11 | 
		12 |   lifecycle {
		13 |     create_before_destroy = true
		14 |   }
		15 | 
		16 |   tags = merge(
		17 |     var.local_tags,
		18 |     {
		19 |       supplier = var.user_name,
		20 |     },
		21 |   )
		22 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: module.capita.module.landing_zone_security_groups.aws_security_group.this
	File: /modules/landing_zone/server_security_group/main.tf:7-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		7  | resource "aws_security_group" "this" {
		8  |   name        = "${var.supplier}-${var.user_name}-inbound-ips"
		9  |   description = "Allowed IP addresses for ${var.user_name} on ${var.supplier} server"
		10 |   vpc_id      = var.vpc_id
		11 | 
		12 |   lifecycle {
		13 |     create_before_destroy = true
		14 |   }
		15 | 
		16 |   tags = merge(
		17 |     var.local_tags,
		18 |     {
		19 |       supplier = var.user_name,
		20 |     },
		21 |   )
		22 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: module.g4s.module.landing_zone_security_groups.aws_security_group.this
	File: /modules/landing_zone/server_security_group/main.tf:7-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		7  | resource "aws_security_group" "this" {
		8  |   name        = "${var.supplier}-${var.user_name}-inbound-ips"
		9  |   description = "Allowed IP addresses for ${var.user_name} on ${var.supplier} server"
		10 |   vpc_id      = var.vpc_id
		11 | 
		12 |   lifecycle {
		13 |     create_before_destroy = true
		14 |   }
		15 | 
		16 |   tags = merge(
		17 |     var.local_tags,
		18 |     {
		19 |       supplier = var.user_name,
		20 |     },
		21 |   )
		22 | }

dockerfile scan results:

Passed checks: 21, Failed checks: 2, Skipped checks: 0

Check: CKV_DOCKER_2: "Ensure that HEALTHCHECK instructions have been added to container images"
	FAILED for resource: /lambdas/update_log_table/Dockerfile.
	File: /lambdas/update_log_table/Dockerfile:1-9
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/docker-policies/docker-policy-index/ensure-that-healthcheck-instructions-have-been-added-to-container-images

		1 | FROM public.ecr.aws/lambda/python:3.11
		2 | 
		3 | COPY requirements.txt .
		4 | 
		5 | RUN pip install -r requirements.txt --target "${LAMBDA_TASK_ROOT}"
		6 | 
		7 | COPY update_log_table.py ${LAMBDA_TASK_ROOT}
		8 | 
		9 | CMD ["update_log_table.handler"]

Check: CKV_DOCKER_3: "Ensure that a user for the container has been created"
	FAILED for resource: /lambdas/update_log_table/Dockerfile.
	File: /lambdas/update_log_table/Dockerfile:1-9
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/docker-policies/docker-policy-index/ensure-that-a-user-for-the-container-has-been-created

		1 | FROM public.ecr.aws/lambda/python:3.11
		2 | 
		3 | COPY requirements.txt .
		4 | 
		5 | RUN pip install -r requirements.txt --target "${LAMBDA_TASK_ROOT}"
		6 | 
		7 | COPY update_log_table.py ${LAMBDA_TASK_ROOT}
		8 | 
		9 | CMD ["update_log_table.handler"]


checkov_exitcode=2

`CTFLint Scan` Failed

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
terraform/environments/electronic-monitoring-data/modules/step_function
terraform/environments/electronic-monitoring-data

*****************************

Running tflint in terraform/environments/electronic-monitoring-data/modules/step_function
Excluding the following checks: terraform_unused_declarations
2 issue(s) found:

Warning: terraform "required_version" attribute is required (terraform_required_version)

  on terraform/environments/electronic-monitoring-data/modules/step_function/main.tf line 1:

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_version.md

Warning: Missing version constraint for provider "aws" in `required_providers` (terraform_required_providers)

  on terraform/environments/electronic-monitoring-data/modules/step_function/main.tf line 93:
  93: resource "aws_cloudwatch_log_group" "this_log_group" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

tflint_exitcode=2

*****************************

Running tflint in terraform/environments/electronic-monitoring-data
Excluding the following checks: terraform_unused_declarations
2 issue(s) found:

Warning: Missing version constraint for provider "archive" in `required_providers` (terraform_required_providers)

  on terraform/environments/electronic-monitoring-data/lambdas_main.tf line 189:
 189: data "archive_file" "query_output_to_list" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

Warning: Missing version constraint for provider "random" in `required_providers` (terraform_required_providers)

  on terraform/environments/electronic-monitoring-data/server_backups.tf line 13:
  13: resource "random_password" "random_password" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

tflint_exitcode=4

`Trivy Scan` Failed

Show Output

*****************************

Trivy will check the following folders:
terraform/environments/electronic-monitoring-data/modules/step_function
terraform/environments/electronic-monitoring-data

*****************************

Running Trivy in terraform/environments/electronic-monitoring-data/modules/step_function
2024-10-21T20:06:06Z	INFO	[vulndb] Need to update DB
2024-10-21T20:06:06Z	INFO	[vulndb] Downloading vulnerability DB...
2024-10-21T20:06:06Z	INFO	[vulndb] Downloading artifact...	repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-21T20:06:06Z	ERROR	[vulndb] Failed to download artifact	repo="ghcr.io/aquasecurity/trivy-db:2" err="OCI repository error: 1 error occurred:\n\t* GET https://ghcr.io/v2/aquasecurity/trivy-db/manifests/2: TOOMANYREQUESTS: retry-after: 541.627µs, allowed: 44000/minute\n\n"
2024-10-21T20:06:06Z	FATAL	Fatal error	init error: DB error: failed to download vulnerability DB: OCI artifact error: failed to download vulnerability DB: failed to download artifact from any source
trivy_exitcode=1

*****************************

Running Trivy in terraform/environments/electronic-monitoring-data
2024-10-21T20:06:06Z	INFO	[vulndb] Need to update DB
2024-10-21T20:06:06Z	INFO	[vulndb] Downloading vulnerability DB...
2024-10-21T20:06:06Z	INFO	[vulndb] Downloading artifact...	repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-21T20:06:09Z	INFO	[vulndb] Artifact successfully downloaded	repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-21T20:06:09Z	INFO	[vuln] Vulnerability scanning is enabled
2024-10-21T20:06:09Z	INFO	[misconfig] Misconfiguration scanning is enabled
2024-10-21T20:06:09Z	INFO	[misconfig] Need to update the built-in checks
2024-10-21T20:06:09Z	INFO	[misconfig] Downloading the built-in checks...
2024-10-21T20:06:09Z	ERROR	[misconfig] Falling back to embedded checks	err="failed to download built-in policies: download error: oci download error: failed to fetch the layer: GET https://ghcr.io/v2/aquasecurity/trivy-checks/blobs/sha256:16957b935ef82529bc26f3ceeeb60d798c90ef142d25e3715ab4478b204ed1bb: TOOMANYREQUESTS: retry-after: 862.121µs, allowed: 44000/minute"
2024-10-21T20:06:09Z	INFO	[secret] Secret scanning is enabled
2024-10-21T20:06:09Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-21T20:06:09Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-10-21T20:06:09Z	WARN	[pip] Unable to find python `site-packages` directory. License detection is skipped.	err="site-packages directory not found"
2024-10-21T20:06:10Z	INFO	[terraform scanner] Scanning root module	file_path="."
2024-10-21T20:06:10Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="networking"
2024-10-21T20:06:11Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:06:11Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:06:11Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:06:11Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:06:11Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:06:11Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.aws_s3_object.user_public_keys" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.data.aws_subnet.local_account" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:06:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:06:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:06:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:06:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:06:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:06:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:06:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:06:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:06:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:06:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:06:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:06:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:06:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:06:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:06:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:06:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:06:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:06:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:06:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:06:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:06:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:06:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:06:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:06:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:06:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:06:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:06:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:06:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:06:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:06:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:06:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:06:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:06:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:06:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:06:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:06:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:06:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:06:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:06:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:06:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:06:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:06:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:06:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:06:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:06:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:06:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:06:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:06:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:06:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:06:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:06:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:06:18Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-21T20:06:18Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-21T20:06:18Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-bucket-encryption" range="s3.tf:1061-1080"
2024-10-21T20:06:18Z	INFO	[terraform executor] Ignore finding	rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:281-286"
2024-10-21T20:06:18Z	INFO	[terraform executor] Ignore finding	rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:407-411"
2024-10-21T20:06:18Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-versioning" range="s3.tf:1061-1080"
2024-10-21T20:06:18Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:06:18Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:06:18Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:06:18Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:06:18Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:06:18Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:06:18Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:06:18Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:06:18Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:06:18Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:06:18Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:06:18Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=95ed3c3/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=568694e50e03630d99cb569eafa06a0b879a1239/main.tf:171-179"
2024-10-21T20:06:18Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="s3.tf:1061-1080"
2024-10-21T20:06:18Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-logging" range="s3.tf:1061-1080"
2024-10-21T20:06:18Z	INFO	Number of language-specific files	num=1
2024-10-21T20:06:18Z	INFO	[pip] Detecting vulnerabilities...
2024-10-21T20:06:18Z	INFO	Detected config files	num=17

lambdas/update_log_table/Dockerfile (dockerfile)
================================================
Tests: 20 (SUCCESSES: 19, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Specify at least 1 USER command in Dockerfile with non-root user as argument
════════════════════════════════════════
Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

See https://avd.aquasec.com/misconfig/ds002
────────────────────────────────────────


trivy_exitcode=2

pricemg

choo choo

github-actions · 2024-10-21T20:18:47Z

`Trivy Scan` Failed

Show Output

```hcl

Trivy will check the following folders:
terraform/environments/electronic-monitoring-data/modules/step_function
terraform/environments/electronic-monitoring-data

Running Trivy in terraform/environments/electronic-monitoring-data/modules/step_function
2024-10-21T20:18:23Z INFO [vulndb] Need to update DB
2024-10-21T20:18:23Z INFO [vulndb] Downloading vulnerability DB...
2024-10-21T20:18:23Z INFO [vulndb] Downloading artifact... repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-21T20:18:25Z INFO [vulndb] Artifact successfully downloaded repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-21T20:18:25Z INFO [vuln] Vulnerability scanning is enabled
2024-10-21T20:18:25Z INFO [misconfig] Misconfiguration scanning is enabled
2024-10-21T20:18:25Z INFO [misconfig] Need to update the built-in checks
2024-10-21T20:18:25Z INFO [misconfig] Downloading the built-in checks...
156.02 KiB / 156.02 KiB [---------------------------------------------------------] 100.00% ? p/s 0s2024-10-21T20:18:25Z INFO [secret] Secret scanning is enabled
2024-10-21T20:18:25Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-21T20:18:25Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-10-21T20:18:26Z INFO [terraform scanner] Scanning root module file_path="."
2024-10-21T20:18:26Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="iam_policies, name, variable_dictionary"
2024-10-21T20:18:26Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_iam_role_policy_attachment.this_attachment" value="cty.NilVal"
2024-10-21T20:18:26Z INFO Number of language-specific files num=0
2024-10-21T20:18:26Z INFO Detected config files num=1
trivy_exitcode=0

Running Trivy in terraform/environments/electronic-monitoring-data
2024-10-21T20:18:26Z INFO [vuln] Vulnerability scanning is enabled
2024-10-21T20:18:26Z INFO [misconfig] Misconfiguration scanning is enabled
2024-10-21T20:18:26Z INFO [secret] Secret scanning is enabled
2024-10-21T20:18:26Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-21T20:18:26Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-10-21T20:18:27Z INFO [terraform scanner] Scanning root module file_path="."
2024-10-21T20:18:27Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="networking"
2024-10-21T20:18:28Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:18:28Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:18:28Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:18:28Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:18:28Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:18:28Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:18:28Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:18:28Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:18:28Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:18:28Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.aws_s3_object.user_public_keys" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.data.aws_subnet.local_account" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:18:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:18:30Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:18:30Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:18:30Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:18:30Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:18:30Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:18:30Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:18:30Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:18:30Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:18:30Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:18:30Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:18:30Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:18:30Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:18:30Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:18:30Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:18:30Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:18:30Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:18:30Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:18:30Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:18:30Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:18:30Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:18:30Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:18:30Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:18:30Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:18:30Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:18:30Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:18:30Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:18:34Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-21T20:18:34Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-21T20:18:34Z INFO [terraform executor] Ignore finding rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:281-286"
2024-10-21T20:18:34Z INFO [terraform executor] Ignore finding rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:407-411"
2024-10-21T20:18:34Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-bucket-encryption" range="s3.tf:1081-1100"
2024-10-21T20:18:34Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-logging" range="s3.tf:1081-1100"
2024-10-21T20:18:34Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:18:34Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:18:34Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:18:34Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:18:34Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:18:34Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:18:34Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:18:34Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:18:34Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:18:34Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:18:34Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=95ed3c3/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=568694e50e03630d99cb569eafa06a0b879a1239/main.tf:171-179"
2024-10-21T20:18:34Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="s3.tf:1081-1100"
2024-10-21T20:18:34Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-versioning" range="s3.tf:1081-1100"
2024-10-21T20:18:34Z WARN [pip] Unable to find python site-packages directory. License detection is skipped. err="site-packages directory not found"
2024-10-21T20:18:34Z INFO Number of language-specific files num=1
2024-10-21T20:18:34Z INFO [pip] Detecting vulnerabilities...
2024-10-21T20:18:34Z INFO Detected config files num=17

lambdas/update_log_table/Dockerfile (dockerfile)

Tests: 20 (SUCCESSES: 19, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Specify at least 1 USER command in Dockerfile with non-root user as argument
════════════════════════════════════════
Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

See https://avd.aquasec.com/misconfig/ds002
────────────────────────────────────────

trivy_exitcode=1

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/electronic-monitoring-data/modules/step_function
terraform/environments/electronic-monitoring-data

*****************************

Running Checkov in terraform/environments/electronic-monitoring-data/modules/step_function
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
terraform scan results:

Passed checks: 43, Failed checks: 7, Skipped checks: 0

Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: aws_sfn_state_machine.this
	File: /main.tf:4-9
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 |   type       = var.type
		9 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: aws_sfn_state_machine.this
	File: /main.tf:4-9
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 |   type       = var.type
		9 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.step_function_base_permissions
	File: /main.tf:40-49
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		40 | data "aws_iam_policy_document" "step_function_base_permissions" {
		41 |   statement {
		42 |     effect = "Allow"
		43 |     actions = [
		44 |       "sns:Publish",
		45 |       "sqs:SendMessage"
		46 |     ]
		47 |     resources = ["*"]
		48 |   }
		49 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.step_function_base_permissions
	File: /main.tf:40-49
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		40 | data "aws_iam_policy_document" "step_function_base_permissions" {
		41 |   statement {
		42 |     effect = "Allow"
		43 |     actions = [
		44 |       "sns:Publish",
		45 |       "sqs:SendMessage"
		46 |     ]
		47 |     resources = ["*"]
		48 |   }
		49 | }

Check: CKV_AWS_109: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: aws_iam_policy_document.this_log_key_document
	File: /main.tf:56-80
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-permissions-management-resource-exposure-without-constraint

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.this_log_key_document
	File: /main.tf:56-80
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.this_log_key_document
	File: /main.tf:56-80
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }


checkov_exitcode=1

*****************************

Running Checkov in terraform/environments/electronic-monitoring-data
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2024-10-21 20:18:39,639 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=95ed3c3:None (for external modules, the --download-external-modules flag is required)
2024-10-21 20:18:39,640 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060:None (for external modules, the --download-external-modules flag is required)
2024-10-21 20:18:39,640 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/secrets-manager/aws:1.3.0 (for external modules, the --download-external-modules flag is required)
2024-10-21 20:18:39,640 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=52a40b0:None (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 2409, Failed checks: 82, Skipped checks: 38

Check: CKV_AWS_26: "Ensure all data stored in the SNS topic is encrypted"
	FAILED for resource: aws_sns_topic.s3_events
	File: /data_store.tf:17-19
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-15

		17 | resource "aws_sns_topic" "s3_events" {
		18 |   name = "${module.s3-data-bucket.bucket.id}-object-created-topic"
		19 | }

Check: CKV_AWS_115: "Ensure that AWS Lambda function is configured for function-level concurrent execution limit"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-function-level-concurrent-execution-limit

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_173: "Check encryption settings for Lambda environmental variable"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-5

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_116: "Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-a-dead-letter-queue-dlq

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_272: "Ensure AWS Lambda function is configured to validate code-signing"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-272

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_117: "Ensure that AWS Lambda function is configured inside a VPC"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-inside-a-vpc-1

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_115: "Ensure that AWS Lambda function is configured for function-level concurrent execution limit"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-function-level-concurrent-execution-limit

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_116: "Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-a-dead-letter-queue-dlq

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_272: "Ensure AWS Lambda function is configured to validate code-signing"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-272

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_117: "Ensure that AWS Lambda function is configured inside a VPC"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-inside-a-vpc-1

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group
	File: /dms_data_validation_glue_job.tf:58-61
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		58 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group" {
		59 |   name              = "dms-dv-glue-job"
		60 |   retention_in_days = 14
		61 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group
	File: /dms_data_validation_glue_job.tf:58-61
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		58 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group" {
		59 |   name              = "dms-dv-glue-job"
		60 |   retention_in_days = 14
		61 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group_v2
	File: /dms_data_validation_glue_job.tf:63-66
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		63 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group_v2" {
		64 |   name              = "dms-dv-glue-job-v2"
		65 |   retention_in_days = 14
		66 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group_v2
	File: /dms_data_validation_glue_job.tf:63-66
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		63 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group_v2" {
		64 |   name              = "dms-dv-glue-job-v2"
		65 |   retention_in_days = 14
		66 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.rds_to_s3_parquet_migration
	File: /dms_data_validation_glue_job.tf:68-71
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		68 | resource "aws_cloudwatch_log_group" "rds_to_s3_parquet_migration" {
		69 |   name              = "rds-to-s3-parquet-migration"
		70 |   retention_in_days = 14
		71 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.rds_to_s3_parquet_migration
	File: /dms_data_validation_glue_job.tf:68-71
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		68 | resource "aws_cloudwatch_log_group" "rds_to_s3_parquet_migration" {
		69 |   name              = "rds-to-s3-parquet-migration"
		70 |   retention_in_days = 14
		71 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.resizing_parquet_files
	File: /dms_data_validation_glue_job.tf:73-76
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		73 | resource "aws_cloudwatch_log_group" "resizing_parquet_files" {
		74 |   name              = "resizing-parquet-files"
		75 |   retention_in_days = 14
		76 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.resizing_parquet_files
	File: /dms_data_validation_glue_job.tf:73-76
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		73 | resource "aws_cloudwatch_log_group" "resizing_parquet_files" {
		74 |   name              = "resizing-parquet-files"
		75 |   retention_in_days = 14
		76 | }

Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.dms_dv_glue_job_v2
	File: /dms_data_validation_glue_job.tf:79-132
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.dms_dv_glue_job_v4d
	File: /dms_data_validation_glue_job.tf:140-193
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.rds_to_s3_parquet_migration
	File: /dms_data_validation_glue_job.tf:196-260
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.rds_to_s3_parquet_migration_monthly
	File: /dms_data_validation_glue_job.tf:264-315
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.resizing_parquet_files
	File: /dms_data_validation_glue_job.tf:318-370
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.catalog_dv_table_glue_job
	File: /dms_data_validation_glue_job.tf:373-401
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		373 | resource "aws_glue_job" "catalog_dv_table_glue_job" {
		374 |   name              = "catalog-dv-table-glue-job"
		375 |   description       = "Python script uses Boto3-Athena-Client to run sql-statements"
		376 |   role_arn          = aws_iam_role.dms_dv_glue_job_iam_role.arn
		377 |   glue_version      = "4.0"
		378 |   worker_type       = "G.1X"
		379 |   number_of_workers = 2
		380 |   default_arguments = {
		381 |     "--parquet_output_bucket_name"       = module.s3-dms-data-validation-bucket.bucket.id
		382 |     "--glue_catalog_db_name"             = aws_glue_catalog_database.dms_dv_glue_catalog_db.name
		383 |     "--glue_catalog_tbl_name"            = "glue_df_output"
		384 |     "--continuous-log-logGroup"          = aws_cloudwatch_log_group.dms_dv_cw_log_group.name
		385 |     "--enable-continuous-cloudwatch-log" = "true"
		386 |     "--enable-continuous-log-filter"     = "true"
		387 |     "--enable-metrics"                   = ""
		388 |   }
		389 |   command {
		390 |     python_version  = "3"
		391 |     script_location = "s3://${module.s3-glue-job-script-bucket.bucket.id}/create_or_replace_dv_table.py"
		392 |   }
		393 | 
		394 |   tags = merge(
		395 |     local.tags,
		396 |     {
		397 |       Resource_Type = "Py script as glue-job that creates dv table / refreshes its partitions",
		398 |     }
		399 |   )
		400 | 
		401 | }

Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_crawler.rds_sqlserver_db_glue_crawler
	File: /dms_glue_crawler.tf:35-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		35 | resource "aws_glue_crawler" "rds_sqlserver_db_glue_crawler" {
		36 |   name          = "rds-sqlserver-${aws_db_instance.database_2022.identifier}-tf"
		37 |   role          = aws_iam_role.dms_dv_glue_job_iam_role.arn
		38 |   database_name = aws_glue_catalog_database.rds_sqlserver_glue_catalog_db.name
		39 |   description   = "Crawler to fetch database names"
		40 |   #   table_prefix  = "your_table_prefix"
		41 | 
		42 |   jdbc_target {
		43 |     connection_name = aws_glue_connection.glue_rds_sqlserver_db_connection.name
		44 |     path            = "%"
		45 |   }
		46 |   tags = merge(
		47 |     local.tags,
		48 |     {
		49 |       Resource_Type = "RDS-SQLServer Glue-Crawler for DMS",
		50 |     }
		51 |   )
		52 | 
		53 |   # provisioner "local-exec" {
		54 |   #   command = "aws glue start-crawler --name ${self.name}"
		55 |   # }
		56 | }

Check: CKV_AWS_212: "Ensure DMS replication instance is encrypted by KMS using a customer managed Key (CMK)"
	FAILED for resource: aws_dms_replication_instance.dms_replication_instance
	File: /dms_replication_instance.tf:24-55
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-ebs-volume-is-encrypted-by-key-management-service-kms-using-a-customer-managed-key-cmk

		24 | resource "aws_dms_replication_instance" "dms_replication_instance" {
		25 |   allocated_storage          = var.dms_allocated_storage_gib
		26 |   apply_immediately          = true
		27 |   auto_minor_version_upgrade = true
		28 |   availability_zone          = var.dms_availability_zone
		29 |   engine_version             = var.dms_engine_version
		30 |   #   kms_key_arn                  = "arn:aws:kms:eu-west-2:800964199911:key/b7f54acb-16a3-4958-9340-3bdf5f5842d8"
		31 |   multi_az = false
		32 |   #   preferred_maintenance_window = "sun:10:30-sun:14:30"
		33 |   publicly_accessible         = false
		34 |   replication_instance_class  = var.dms_replication_instance_class
		35 |   replication_instance_id     = "dms-replication-instance-tf"
		36 |   replication_subnet_group_id = aws_dms_replication_subnet_group.dms_replication_subnet_group.id
		37 | 
		38 |   tags = merge(
		39 |     local.tags,
		40 |     {
		41 |       Resource_Type = "DMS Replication Instance",
		42 |     }
		43 |   )
		44 | 
		45 |   vpc_security_group_ids = [
		46 |     aws_security_group.dms_ri_security_group.id,
		47 |   ]
		48 | 
		49 |   depends_on = [
		50 |     aws_iam_role.dms_vpc_role,
		51 |     aws_iam_role.dms_cloudwatch_logs_role,
		52 |     aws_iam_role.dms_endpoint_role
		53 |   ]
		54 | 
		55 | }

Check: CKV_AWS_260: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 80"
	FAILED for resource: aws_vpc_security_group_ingress_rule.glue_rds_conn_inbound
	File: /dms_security_groups.tf:95-103
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-aws-security-groups-do-not-allow-ingress-from-00000-to-port-80

		95  | resource "aws_vpc_security_group_ingress_rule" "glue_rds_conn_inbound" {
		96  |   security_group_id = aws_security_group.glue_rds_conn_security_group.id
		97  | 
		98  |   referenced_security_group_id = aws_security_group.glue_rds_conn_security_group.id
		99  |   ip_protocol                  = "tcp"
		100 |   from_port                    = 0
		101 |   to_port                      = 65535
		102 |   description                  = "Required ports open for Glue-RDS-Connection"
		103 | }

Check: CKV_AWS_24: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 22"
	FAILED for resource: aws_vpc_security_group_ingress_rule.glue_rds_conn_inbound
	File: /dms_security_groups.tf:95-103
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-1-port-security

		95  | resource "aws_vpc_security_group_ingress_rule" "glue_rds_conn_inbound" {
		96  |   security_group_id = aws_security_group.glue_rds_conn_security_group.id
		97  | 
		98  |   referenced_security_group_id = aws_security_group.glue_rds_conn_security_group.id
		99  |   ip_protocol                  = "tcp"
		100 |   from_port                    = 0
		101 |   to_port                      = 65535
		102 |   description                  = "Required ports open for Glue-RDS-Connection"
		103 | }

Check: CKV_AWS_25: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389"
	FAILED for resource: aws_vpc_security_group_ingress_rule.glue_rds_conn_inbound
	File: /dms_security_groups.tf:95-103
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-2

		95  | resource "aws_vpc_security_group_ingress_rule" "glue_rds_conn_inbound" {
		96  |   security_group_id = aws_security_group.glue_rds_conn_security_group.id
		97  | 
		98  |   referenced_security_group_id = aws_security_group.glue_rds_conn_security_group.id
		99  |   ip_protocol                  = "tcp"
		100 |   from_port                    = 0
		101 |   to_port                      = 65535
		102 |   description                  = "Required ports open for Glue-RDS-Connection"
		103 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.glue_notebook_ec2_iam_policy_document
	File: /glue_data.tf:96-111
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		96  | data "aws_iam_policy_document" "glue_notebook_ec2_iam_policy_document" {
		97  |   statement {
		98  |     effect = "Allow"
		99  |     actions = [
		100 |       "ec2:CreateNetworkInterface",
		101 |       "ec2:DescribeNetworkInterfaces",
		102 |       "ec2:DeleteNetworkInterface",
		103 |       "ec2:DescribeVpcEndpoints",
		104 |       "ec2:DescribeSubnets",
		105 |       "ec2:DescribeVpcAttribute",
		106 |       "ec2:DescribeRouteTables",
		107 |       "ec2:DescribeSecurityGroups"
		108 |     ]
		109 |     resources = ["*"]
		110 |   }
		111 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.glue_notebook_ec2_iam_policy_document
	File: /glue_data.tf:96-111
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		96  | data "aws_iam_policy_document" "glue_notebook_ec2_iam_policy_document" {
		97  |   statement {
		98  |     effect = "Allow"
		99  |     actions = [
		100 |       "ec2:CreateNetworkInterface",
		101 |       "ec2:DescribeNetworkInterfaces",
		102 |       "ec2:DeleteNetworkInterface",
		103 |       "ec2:DescribeVpcEndpoints",
		104 |       "ec2:DescribeSubnets",
		105 |       "ec2:DescribeVpcAttribute",
		106 |       "ec2:DescribeRouteTables",
		107 |       "ec2:DescribeSecurityGroups"
		108 |     ]
		109 |     resources = ["*"]
		110 |   }
		111 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.load_json_table_s3_policy_document
	File: /lambdas_iam.tf:430-487
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.load_json_table_s3_policy_document
	File: /lambdas_iam.tf:430-487
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.db_glue_connection
	File: /lambdas_secrets.tf:1-3
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		1 | resource "aws_secretsmanager_secret" "db_glue_connection" {
		2 |   name = "db_glue_connection"
		3 | }

Check: CKV_AWS_296: "Ensure DMS endpoint uses Customer Managed Key (CMK)"
	FAILED for resource: module.dms_task.aws_dms_endpoint.dms_rds_source
	File: /modules/dms/endpoints_rds_s3.tf:2-23
	Calling File: /dms_main.tf:1-39
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-296

		2  | resource "aws_dms_endpoint" "dms_rds_source" {
		3  | 
		4  |   #   certificate_arn             = ""
		5  |   database_name = var.database_name
		6  |   endpoint_id   = "rds-mssql-${replace(var.database_name, "_", "-")}-tf"
		7  |   endpoint_type = "source"
		8  |   engine_name   = "sqlserver"
		9  |   #   extra_connection_attributes = ""
		10 |   #   kms_key_arn                 = aws_db_instance.database_2022.kms_key_id
		11 |   password    = var.rds_db_instance_pasword
		12 |   port        = var.rds_db_instance_port
		13 |   server_name = var.rds_db_server_name
		14 |   ssl_mode    = "require"
		15 |   username    = var.rds_db_username
		16 | 
		17 |   tags = merge(
		18 |     var.local_tags,
		19 |     {
		20 |       Resource_Type = "DMS Source Endpoint - RDS MSSQL",
		21 |     },
		22 |   )
		23 | }

Check: CKV_AWS_298: "Ensure DMS S3 uses Customer Managed Key (CMK)"
	FAILED for resource: module.dms_task.aws_dms_s3_endpoint.dms_s3_parquet_target
	File: /modules/dms/endpoints_rds_s3.tf:28-84
	Calling File: /dms_main.tf:1-39
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-298

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: module.athena_layer.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-9
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 |   type       = var.type
		9 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: module.athena_layer.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-9
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 |   type       = var.type
		9 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.athena_layer.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:40-49
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		40 | data "aws_iam_policy_document" "step_function_base_permissions" {
		41 |   statement {
		42 |     effect = "Allow"
		43 |     actions = [
		44 |       "sns:Publish",
		45 |       "sqs:SendMessage"
		46 |     ]
		47 |     resources = ["*"]
		48 |   }
		49 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.athena_layer.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:40-49
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		40 | data "aws_iam_policy_document" "step_function_base_permissions" {
		41 |   statement {
		42 |     effect = "Allow"
		43 |     actions = [
		44 |       "sns:Publish",
		45 |       "sqs:SendMessage"
		46 |     ]
		47 |     resources = ["*"]
		48 |   }
		49 | }

Check: CKV_AWS_109: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: module.athena_layer.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-permissions-management-resource-exposure-without-constraint

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.athena_layer.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.athena_layer.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: module.get_zipped_file.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-9
	Calling File: /step_functions_main.tf:38-49
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 |   type       = var.type
		9 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: module.get_zipped_file.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-9
	Calling File: /step_functions_main.tf:38-49
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 |   type       = var.type
		9 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:40-49
	Calling File: /step_functions_main.tf:38-49
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		40 | data "aws_iam_policy_document" "step_function_base_permissions" {
		41 |   statement {
		42 |     effect = "Allow"
		43 |     actions = [
		44 |       "sns:Publish",
		45 |       "sqs:SendMessage"
		46 |     ]
		47 |     resources = ["*"]
		48 |   }
		49 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:40-49
	Calling File: /step_functions_main.tf:38-49
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		40 | data "aws_iam_policy_document" "step_function_base_permissions" {
		41 |   statement {
		42 |     effect = "Allow"
		43 |     actions = [
		44 |       "sns:Publish",
		45 |       "sqs:SendMessage"
		46 |     ]
		47 |     resources = ["*"]
		48 |   }
		49 | }

Check: CKV_AWS_109: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:38-49
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-permissions-management-resource-exposure-without-constraint

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:38-49
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:38-49
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: module.get_zipped_file_non_express.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-9
	Calling File: /step_functions_main.tf:52-62
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 |   type       = var.type
		9 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: module.get_zipped_file_non_express.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-9
	Calling File: /step_functions_main.tf:52-62
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 |   type       = var.type
		9 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.get_zipped_file_non_express.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:40-49
	Calling File: /step_functions_main.tf:52-62
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		40 | data "aws_iam_policy_document" "step_function_base_permissions" {
		41 |   statement {
		42 |     effect = "Allow"
		43 |     actions = [
		44 |       "sns:Publish",
		45 |       "sqs:SendMessage"
		46 |     ]
		47 |     resources = ["*"]
		48 |   }
		49 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.get_zipped_file_non_express.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:40-49
	Calling File: /step_functions_main.tf:52-62
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		40 | data "aws_iam_policy_document" "step_function_base_permissions" {
		41 |   statement {
		42 |     effect = "Allow"
		43 |     actions = [
		44 |       "sns:Publish",
		45 |       "sqs:SendMessage"
		46 |     ]
		47 |     resources = ["*"]
		48 |   }
		49 | }

Check: CKV_AWS_109: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: module.get_zipped_file_non_express.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:52-62
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-permissions-management-resource-exposure-without-constraint

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.get_zipped_file_non_express.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:52-62
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.get_zipped_file_non_express.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:52-62
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: module.send_database_to_ap.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-9
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 |   type       = var.type
		9 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: module.send_database_to_ap.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-9
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 |   type       = var.type
		9 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.send_database_to_ap.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:40-49
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		40 | data "aws_iam_policy_document" "step_function_base_permissions" {
		41 |   statement {
		42 |     effect = "Allow"
		43 |     actions = [
		44 |       "sns:Publish",
		45 |       "sqs:SendMessage"
		46 |     ]
		47 |     resources = ["*"]
		48 |   }
		49 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.send_database_to_ap.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:40-49
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		40 | data "aws_iam_policy_document" "step_function_base_permissions" {
		41 |   statement {
		42 |     effect = "Allow"
		43 |     actions = [
		44 |       "sns:Publish",
		45 |       "sqs:SendMessage"
		46 |     ]
		47 |     resources = ["*"]
		48 |   }
		49 | }

Check: CKV_AWS_109: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: module.send_database_to_ap.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-permissions-management-resource-exposure-without-constraint

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.send_database_to_ap.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.send_database_to_ap.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.db_password
	File: /server_backups.tf:4-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		4 | resource "aws_secretsmanager_secret" "db_password" {
		5 |   name = "db_password"
		6 | }

Check: CKV_AWS_354: "Ensure RDS Performance Insights are encrypted using KMS CMKs"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-354

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_157: "Ensure that RDS instances have Multi-AZ enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-73

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_118: "Ensure that enhanced monitoring is enabled for Amazon RDS instances"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/ensure-that-enhanced-monitoring-is-enabled-for-amazon-rds-instances

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_353: "Ensure that RDS instances have performance insights enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-353

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_293: "Ensure that AWS database instances have deletion protection enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-293

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_129: "Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-that-respective-logs-of-amazon-relational-database-service-amazon-rds-are-enabled

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.send_database_to_ap
	File: /step_functions_iam.tf:44-118
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.send_database_to_ap
	File: /step_functions_iam.tf:44-118
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.db_glue_connection
	File: /lambdas_secrets.tf:1-3
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		1 | resource "aws_secretsmanager_secret" "db_glue_connection" {
		2 |   name = "db_glue_connection"
		3 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.db_password
	File: /server_backups.tf:4-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		4 | resource "aws_secretsmanager_secret" "db_password" {
		5 |   name = "db_password"
		6 | }

Check: CKV2_AWS_60: "Ensure RDS instance with copy tags to snapshots is enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-60

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: aws_security_group.glue_rds_conn_security_group
	File: /dms_security_groups.tf:71-82
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		71 | resource "aws_security_group" "glue_rds_conn_security_group" {
		72 |   name        = "glue-rds-sqlserver-connection-tf"
		73 |   description = "Secuity Group for Glue-RDS-Connection"
		74 |   vpc_id      = data.aws_vpc.shared.id
		75 | 
		76 |   tags = merge(
		77 |     local.tags,
		78 |     {
		79 |       Resource_Type = "Secuity Group for Glue-RDS-Connection",
		80 |     }
		81 |   )
		82 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: module.buddi.module.landing_zone_security_groups.aws_security_group.this
	File: /modules/landing_zone/server_security_group/main.tf:7-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		7  | resource "aws_security_group" "this" {
		8  |   name        = "${var.supplier}-${var.user_name}-inbound-ips"
		9  |   description = "Allowed IP addresses for ${var.user_name} on ${var.supplier} server"
		10 |   vpc_id      = var.vpc_id
		11 | 
		12 |   lifecycle {
		13 |     create_before_destroy = true
		14 |   }
		15 | 
		16 |   tags = merge(
		17 |     var.local_tags,
		18 |     {
		19 |       supplier = var.user_name,
		20 |     },
		21 |   )
		22 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: module.capita.module.landing_zone_security_groups.aws_security_group.this
	File: /modules/landing_zone/server_security_group/main.tf:7-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		7  | resource "aws_security_group" "this" {
		8  |   name        = "${var.supplier}-${var.user_name}-inbound-ips"
		9  |   description = "Allowed IP addresses for ${var.user_name} on ${var.supplier} server"
		10 |   vpc_id      = var.vpc_id
		11 | 
		12 |   lifecycle {
		13 |     create_before_destroy = true
		14 |   }
		15 | 
		16 |   tags = merge(
		17 |     var.local_tags,
		18 |     {
		19 |       supplier = var.user_name,
		20 |     },
		21 |   )
		22 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: module.g4s.module.landing_zone_security_groups.aws_security_group.this
	File: /modules/landing_zone/server_security_group/main.tf:7-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		7  | resource "aws_security_group" "this" {
		8  |   name        = "${var.supplier}-${var.user_name}-inbound-ips"
		9  |   description = "Allowed IP addresses for ${var.user_name} on ${var.supplier} server"
		10 |   vpc_id      = var.vpc_id
		11 | 
		12 |   lifecycle {
		13 |     create_before_destroy = true
		14 |   }
		15 | 
		16 |   tags = merge(
		17 |     var.local_tags,
		18 |     {
		19 |       supplier = var.user_name,
		20 |     },
		21 |   )
		22 | }

dockerfile scan results:

Passed checks: 21, Failed checks: 2, Skipped checks: 0

Check: CKV_DOCKER_2: "Ensure that HEALTHCHECK instructions have been added to container images"
	FAILED for resource: /lambdas/update_log_table/Dockerfile.
	File: /lambdas/update_log_table/Dockerfile:1-9
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/docker-policies/docker-policy-index/ensure-that-healthcheck-instructions-have-been-added-to-container-images

		1 | FROM public.ecr.aws/lambda/python:3.11
		2 | 
		3 | COPY requirements.txt .
		4 | 
		5 | RUN pip install -r requirements.txt --target "${LAMBDA_TASK_ROOT}"
		6 | 
		7 | COPY update_log_table.py ${LAMBDA_TASK_ROOT}
		8 | 
		9 | CMD ["update_log_table.handler"]

Check: CKV_DOCKER_3: "Ensure that a user for the container has been created"
	FAILED for resource: /lambdas/update_log_table/Dockerfile.
	File: /lambdas/update_log_table/Dockerfile:1-9
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/docker-policies/docker-policy-index/ensure-that-a-user-for-the-container-has-been-created

		1 | FROM public.ecr.aws/lambda/python:3.11
		2 | 
		3 | COPY requirements.txt .
		4 | 
		5 | RUN pip install -r requirements.txt --target "${LAMBDA_TASK_ROOT}"
		6 | 
		7 | COPY update_log_table.py ${LAMBDA_TASK_ROOT}
		8 | 
		9 | CMD ["update_log_table.handler"]


checkov_exitcode=2

`CTFLint Scan` Failed

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
terraform/environments/electronic-monitoring-data/modules/step_function
terraform/environments/electronic-monitoring-data

*****************************

Running tflint in terraform/environments/electronic-monitoring-data/modules/step_function
Excluding the following checks: terraform_unused_declarations
2 issue(s) found:

Warning: terraform "required_version" attribute is required (terraform_required_version)

  on terraform/environments/electronic-monitoring-data/modules/step_function/main.tf line 1:

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_version.md

Warning: Missing version constraint for provider "aws" in `required_providers` (terraform_required_providers)

  on terraform/environments/electronic-monitoring-data/modules/step_function/main.tf line 93:
  93: resource "aws_cloudwatch_log_group" "this_log_group" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

tflint_exitcode=2

*****************************

Running tflint in terraform/environments/electronic-monitoring-data
Excluding the following checks: terraform_unused_declarations
2 issue(s) found:

Warning: Missing version constraint for provider "archive" in `required_providers` (terraform_required_providers)

  on terraform/environments/electronic-monitoring-data/lambdas_main.tf line 189:
 189: data "archive_file" "query_output_to_list" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

Warning: Missing version constraint for provider "random" in `required_providers` (terraform_required_providers)

  on terraform/environments/electronic-monitoring-data/server_backups.tf line 13:
  13: resource "random_password" "random_password" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

tflint_exitcode=4

`Trivy Scan` Failed

Show Output

*****************************

Trivy will check the following folders:
terraform/environments/electronic-monitoring-data/modules/step_function
terraform/environments/electronic-monitoring-data

*****************************

Running Trivy in terraform/environments/electronic-monitoring-data/modules/step_function
2024-10-21T20:18:23Z	INFO	[vulndb] Need to update DB
2024-10-21T20:18:23Z	INFO	[vulndb] Downloading vulnerability DB...
2024-10-21T20:18:23Z	INFO	[vulndb] Downloading artifact...	repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-21T20:18:25Z	INFO	[vulndb] Artifact successfully downloaded	repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-21T20:18:25Z	INFO	[vuln] Vulnerability scanning is enabled
2024-10-21T20:18:25Z	INFO	[misconfig] Misconfiguration scanning is enabled
2024-10-21T20:18:25Z	INFO	[misconfig] Need to update the built-in checks
2024-10-21T20:18:25Z	INFO	[misconfig] Downloading the built-in checks...
156.02 KiB / 156.02 KiB [---------------------------------------------------------] 100.00% ? p/s 0s2024-10-21T20:18:25Z	INFO	[secret] Secret scanning is enabled
2024-10-21T20:18:25Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-21T20:18:25Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-10-21T20:18:26Z	INFO	[terraform scanner] Scanning root module	file_path="."
2024-10-21T20:18:26Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="iam_policies, name, variable_dictionary"
2024-10-21T20:18:26Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_iam_role_policy_attachment.this_attachment" value="cty.NilVal"
2024-10-21T20:18:26Z	INFO	Number of language-specific files	num=0
2024-10-21T20:18:26Z	INFO	Detected config files	num=1
trivy_exitcode=0

*****************************

Running Trivy in terraform/environments/electronic-monitoring-data
2024-10-21T20:18:26Z	INFO	[vuln] Vulnerability scanning is enabled
2024-10-21T20:18:26Z	INFO	[misconfig] Misconfiguration scanning is enabled
2024-10-21T20:18:26Z	INFO	[secret] Secret scanning is enabled
2024-10-21T20:18:26Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-21T20:18:26Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-10-21T20:18:27Z	INFO	[terraform scanner] Scanning root module	file_path="."
2024-10-21T20:18:27Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="networking"
2024-10-21T20:18:28Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:18:28Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:18:28Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:18:28Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:18:28Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:18:28Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:18:28Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:18:28Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:18:28Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:18:28Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.aws_s3_object.user_public_keys" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.data.aws_subnet.local_account" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:18:29Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:18:30Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:18:30Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:18:30Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:18:30Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:18:30Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:18:30Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:18:30Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:18:30Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:18:30Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:18:30Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:18:30Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:18:30Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:18:30Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:18:30Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:18:30Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:18:30Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:18:30Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:18:30Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:18:30Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:18:30Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:18:30Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:18:30Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:18:30Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:18:30Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:18:30Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:18:30Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:18:34Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-21T20:18:34Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-21T20:18:34Z	INFO	[terraform executor] Ignore finding	rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:281-286"
2024-10-21T20:18:34Z	INFO	[terraform executor] Ignore finding	rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:407-411"
2024-10-21T20:18:34Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-bucket-encryption" range="s3.tf:1081-1100"
2024-10-21T20:18:34Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-logging" range="s3.tf:1081-1100"
2024-10-21T20:18:34Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:18:34Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:18:34Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:18:34Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:18:34Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:18:34Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:18:34Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:18:34Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:18:34Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:18:34Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:18:34Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=95ed3c3/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=568694e50e03630d99cb569eafa06a0b879a1239/main.tf:171-179"
2024-10-21T20:18:34Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="s3.tf:1081-1100"
2024-10-21T20:18:34Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-versioning" range="s3.tf:1081-1100"
2024-10-21T20:18:34Z	WARN	[pip] Unable to find python `site-packages` directory. License detection is skipped.	err="site-packages directory not found"
2024-10-21T20:18:34Z	INFO	Number of language-specific files	num=1
2024-10-21T20:18:34Z	INFO	[pip] Detecting vulnerabilities...
2024-10-21T20:18:34Z	INFO	Detected config files	num=17

lambdas/update_log_table/Dockerfile (dockerfile)
================================================
Tests: 20 (SUCCESSES: 19, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Specify at least 1 USER command in Dockerfile with non-root user as argument
════════════════════════════════════════
Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

See https://avd.aquasec.com/misconfig/ds002
────────────────────────────────────────


trivy_exitcode=1

github-actions · 2024-10-21T20:25:39Z

`Trivy Scan` Failed

Show Output

```hcl

Trivy will check the following folders:
terraform/environments/electronic-monitoring-data/modules/step_function
terraform/environments/electronic-monitoring-data

Running Trivy in terraform/environments/electronic-monitoring-data/modules/step_function
2024-10-21T20:25:13Z INFO [vulndb] Need to update DB
2024-10-21T20:25:13Z INFO [vulndb] Downloading vulnerability DB...
2024-10-21T20:25:13Z INFO [vulndb] Downloading artifact... repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-21T20:25:15Z INFO [vulndb] Artifact successfully downloaded repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-21T20:25:15Z INFO [vuln] Vulnerability scanning is enabled
2024-10-21T20:25:15Z INFO [misconfig] Misconfiguration scanning is enabled
2024-10-21T20:25:15Z INFO [misconfig] Need to update the built-in checks
2024-10-21T20:25:15Z INFO [misconfig] Downloading the built-in checks...
156.02 KiB / 156.02 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2024-10-21T20:25:15Z INFO [secret] Secret scanning is enabled
2024-10-21T20:25:15Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-21T20:25:15Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-10-21T20:25:16Z INFO [terraform scanner] Scanning root module file_path="."
2024-10-21T20:25:16Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="iam_policies, name, variable_dictionary"
2024-10-21T20:25:16Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_iam_role_policy_attachment.this_attachment" value="cty.NilVal"
2024-10-21T20:25:16Z INFO Number of language-specific files num=0
2024-10-21T20:25:16Z INFO Detected config files num=1
trivy_exitcode=0

Running Trivy in terraform/environments/electronic-monitoring-data
2024-10-21T20:25:16Z INFO [vuln] Vulnerability scanning is enabled
2024-10-21T20:25:16Z INFO [misconfig] Misconfiguration scanning is enabled
2024-10-21T20:25:16Z INFO [secret] Secret scanning is enabled
2024-10-21T20:25:16Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-21T20:25:16Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-10-21T20:25:18Z INFO [terraform scanner] Scanning root module file_path="."
2024-10-21T20:25:18Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="networking"
2024-10-21T20:25:18Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:25:18Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.aws_s3_object.user_public_keys" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.data.aws_subnet.local_account" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:25:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:25:20Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:25:25Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-versioning" range="s3.tf:1081-1100"
2024-10-21T20:25:25Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-bucket-encryption" range="s3.tf:1081-1100"
2024-10-21T20:25:25Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:25:25Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:25:25Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:25:25Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:25:25Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:25:25Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:25:25Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:25:25Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:25:25Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:25:25Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:25:25Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=95ed3c3/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=568694e50e03630d99cb569eafa06a0b879a1239/main.tf:171-179"
2024-10-21T20:25:25Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="s3.tf:1081-1100"
2024-10-21T20:25:25Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-21T20:25:25Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-21T20:25:25Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-logging" range="s3.tf:1081-1100"
2024-10-21T20:25:25Z INFO [terraform executor] Ignore finding rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:281-286"
2024-10-21T20:25:25Z INFO [terraform executor] Ignore finding rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:407-411"
2024-10-21T20:25:25Z WARN [pip] Unable to find python site-packages directory. License detection is skipped. err="site-packages directory not found"
2024-10-21T20:25:25Z INFO Number of language-specific files num=1
2024-10-21T20:25:25Z INFO [pip] Detecting vulnerabilities...
2024-10-21T20:25:25Z INFO Detected config files num=17

lambdas/update_log_table/Dockerfile (dockerfile)

Tests: 20 (SUCCESSES: 19, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Specify at least 1 USER command in Dockerfile with non-root user as argument
════════════════════════════════════════
Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

See https://avd.aquasec.com/misconfig/ds002
────────────────────────────────────────

trivy_exitcode=1

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/electronic-monitoring-data/modules/step_function
terraform/environments/electronic-monitoring-data

*****************************

Running Checkov in terraform/environments/electronic-monitoring-data/modules/step_function
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
terraform scan results:

Passed checks: 43, Failed checks: 7, Skipped checks: 0

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.step_function_base_permissions
	File: /main.tf:40-49
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		40 | data "aws_iam_policy_document" "step_function_base_permissions" {
		41 |   statement {
		42 |     effect = "Allow"
		43 |     actions = [
		44 |       "sns:Publish",
		45 |       "sqs:SendMessage"
		46 |     ]
		47 |     resources = ["*"]
		48 |   }
		49 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.step_function_base_permissions
	File: /main.tf:40-49
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		40 | data "aws_iam_policy_document" "step_function_base_permissions" {
		41 |   statement {
		42 |     effect = "Allow"
		43 |     actions = [
		44 |       "sns:Publish",
		45 |       "sqs:SendMessage"
		46 |     ]
		47 |     resources = ["*"]
		48 |   }
		49 | }

Check: CKV_AWS_109: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: aws_iam_policy_document.this_log_key_document
	File: /main.tf:56-80
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-permissions-management-resource-exposure-without-constraint

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.this_log_key_document
	File: /main.tf:56-80
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.this_log_key_document
	File: /main.tf:56-80
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: aws_sfn_state_machine.this
	File: /main.tf:4-9
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 |   type       = var.type
		9 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: aws_sfn_state_machine.this
	File: /main.tf:4-9
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 |   type       = var.type
		9 | }


checkov_exitcode=1

*****************************

Running Checkov in terraform/environments/electronic-monitoring-data
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2024-10-21 20:25:31,456 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=95ed3c3:None (for external modules, the --download-external-modules flag is required)
2024-10-21 20:25:31,456 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060:None (for external modules, the --download-external-modules flag is required)
2024-10-21 20:25:31,456 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/secrets-manager/aws:1.3.0 (for external modules, the --download-external-modules flag is required)
2024-10-21 20:25:31,456 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=52a40b0:None (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 2409, Failed checks: 82, Skipped checks: 38

Check: CKV_AWS_26: "Ensure all data stored in the SNS topic is encrypted"
	FAILED for resource: aws_sns_topic.s3_events
	File: /data_store.tf:17-19
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-15

		17 | resource "aws_sns_topic" "s3_events" {
		18 |   name = "${module.s3-data-bucket.bucket.id}-object-created-topic"
		19 | }

Check: CKV_AWS_115: "Ensure that AWS Lambda function is configured for function-level concurrent execution limit"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-function-level-concurrent-execution-limit

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_173: "Check encryption settings for Lambda environmental variable"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-5

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_116: "Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-a-dead-letter-queue-dlq

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_272: "Ensure AWS Lambda function is configured to validate code-signing"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-272

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_117: "Ensure that AWS Lambda function is configured inside a VPC"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-inside-a-vpc-1

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_115: "Ensure that AWS Lambda function is configured for function-level concurrent execution limit"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-function-level-concurrent-execution-limit

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_116: "Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-a-dead-letter-queue-dlq

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_272: "Ensure AWS Lambda function is configured to validate code-signing"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-272

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_117: "Ensure that AWS Lambda function is configured inside a VPC"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-inside-a-vpc-1

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group
	File: /dms_data_validation_glue_job.tf:58-61
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		58 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group" {
		59 |   name              = "dms-dv-glue-job"
		60 |   retention_in_days = 14
		61 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group
	File: /dms_data_validation_glue_job.tf:58-61
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		58 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group" {
		59 |   name              = "dms-dv-glue-job"
		60 |   retention_in_days = 14
		61 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group_v2
	File: /dms_data_validation_glue_job.tf:63-66
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		63 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group_v2" {
		64 |   name              = "dms-dv-glue-job-v2"
		65 |   retention_in_days = 14
		66 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group_v2
	File: /dms_data_validation_glue_job.tf:63-66
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		63 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group_v2" {
		64 |   name              = "dms-dv-glue-job-v2"
		65 |   retention_in_days = 14
		66 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.rds_to_s3_parquet_migration
	File: /dms_data_validation_glue_job.tf:68-71
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		68 | resource "aws_cloudwatch_log_group" "rds_to_s3_parquet_migration" {
		69 |   name              = "rds-to-s3-parquet-migration"
		70 |   retention_in_days = 14
		71 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.rds_to_s3_parquet_migration
	File: /dms_data_validation_glue_job.tf:68-71
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		68 | resource "aws_cloudwatch_log_group" "rds_to_s3_parquet_migration" {
		69 |   name              = "rds-to-s3-parquet-migration"
		70 |   retention_in_days = 14
		71 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.resizing_parquet_files
	File: /dms_data_validation_glue_job.tf:73-76
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		73 | resource "aws_cloudwatch_log_group" "resizing_parquet_files" {
		74 |   name              = "resizing-parquet-files"
		75 |   retention_in_days = 14
		76 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.resizing_parquet_files
	File: /dms_data_validation_glue_job.tf:73-76
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		73 | resource "aws_cloudwatch_log_group" "resizing_parquet_files" {
		74 |   name              = "resizing-parquet-files"
		75 |   retention_in_days = 14
		76 | }

Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.dms_dv_glue_job_v2
	File: /dms_data_validation_glue_job.tf:79-132
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.dms_dv_glue_job_v4d
	File: /dms_data_validation_glue_job.tf:140-193
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.rds_to_s3_parquet_migration
	File: /dms_data_validation_glue_job.tf:196-260
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.rds_to_s3_parquet_migration_monthly
	File: /dms_data_validation_glue_job.tf:264-315
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.resizing_parquet_files
	File: /dms_data_validation_glue_job.tf:318-370
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.catalog_dv_table_glue_job
	File: /dms_data_validation_glue_job.tf:373-401
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		373 | resource "aws_glue_job" "catalog_dv_table_glue_job" {
		374 |   name              = "catalog-dv-table-glue-job"
		375 |   description       = "Python script uses Boto3-Athena-Client to run sql-statements"
		376 |   role_arn          = aws_iam_role.dms_dv_glue_job_iam_role.arn
		377 |   glue_version      = "4.0"
		378 |   worker_type       = "G.1X"
		379 |   number_of_workers = 2
		380 |   default_arguments = {
		381 |     "--parquet_output_bucket_name"       = module.s3-dms-data-validation-bucket.bucket.id
		382 |     "--glue_catalog_db_name"             = aws_glue_catalog_database.dms_dv_glue_catalog_db.name
		383 |     "--glue_catalog_tbl_name"            = "glue_df_output"
		384 |     "--continuous-log-logGroup"          = aws_cloudwatch_log_group.dms_dv_cw_log_group.name
		385 |     "--enable-continuous-cloudwatch-log" = "true"
		386 |     "--enable-continuous-log-filter"     = "true"
		387 |     "--enable-metrics"                   = ""
		388 |   }
		389 |   command {
		390 |     python_version  = "3"
		391 |     script_location = "s3://${module.s3-glue-job-script-bucket.bucket.id}/create_or_replace_dv_table.py"
		392 |   }
		393 | 
		394 |   tags = merge(
		395 |     local.tags,
		396 |     {
		397 |       Resource_Type = "Py script as glue-job that creates dv table / refreshes its partitions",
		398 |     }
		399 |   )
		400 | 
		401 | }

Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_crawler.rds_sqlserver_db_glue_crawler
	File: /dms_glue_crawler.tf:35-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		35 | resource "aws_glue_crawler" "rds_sqlserver_db_glue_crawler" {
		36 |   name          = "rds-sqlserver-${aws_db_instance.database_2022.identifier}-tf"
		37 |   role          = aws_iam_role.dms_dv_glue_job_iam_role.arn
		38 |   database_name = aws_glue_catalog_database.rds_sqlserver_glue_catalog_db.name
		39 |   description   = "Crawler to fetch database names"
		40 |   #   table_prefix  = "your_table_prefix"
		41 | 
		42 |   jdbc_target {
		43 |     connection_name = aws_glue_connection.glue_rds_sqlserver_db_connection.name
		44 |     path            = "%"
		45 |   }
		46 |   tags = merge(
		47 |     local.tags,
		48 |     {
		49 |       Resource_Type = "RDS-SQLServer Glue-Crawler for DMS",
		50 |     }
		51 |   )
		52 | 
		53 |   # provisioner "local-exec" {
		54 |   #   command = "aws glue start-crawler --name ${self.name}"
		55 |   # }
		56 | }

Check: CKV_AWS_212: "Ensure DMS replication instance is encrypted by KMS using a customer managed Key (CMK)"
	FAILED for resource: aws_dms_replication_instance.dms_replication_instance
	File: /dms_replication_instance.tf:24-55
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-ebs-volume-is-encrypted-by-key-management-service-kms-using-a-customer-managed-key-cmk

		24 | resource "aws_dms_replication_instance" "dms_replication_instance" {
		25 |   allocated_storage          = var.dms_allocated_storage_gib
		26 |   apply_immediately          = true
		27 |   auto_minor_version_upgrade = true
		28 |   availability_zone          = var.dms_availability_zone
		29 |   engine_version             = var.dms_engine_version
		30 |   #   kms_key_arn                  = "arn:aws:kms:eu-west-2:800964199911:key/b7f54acb-16a3-4958-9340-3bdf5f5842d8"
		31 |   multi_az = false
		32 |   #   preferred_maintenance_window = "sun:10:30-sun:14:30"
		33 |   publicly_accessible         = false
		34 |   replication_instance_class  = var.dms_replication_instance_class
		35 |   replication_instance_id     = "dms-replication-instance-tf"
		36 |   replication_subnet_group_id = aws_dms_replication_subnet_group.dms_replication_subnet_group.id
		37 | 
		38 |   tags = merge(
		39 |     local.tags,
		40 |     {
		41 |       Resource_Type = "DMS Replication Instance",
		42 |     }
		43 |   )
		44 | 
		45 |   vpc_security_group_ids = [
		46 |     aws_security_group.dms_ri_security_group.id,
		47 |   ]
		48 | 
		49 |   depends_on = [
		50 |     aws_iam_role.dms_vpc_role,
		51 |     aws_iam_role.dms_cloudwatch_logs_role,
		52 |     aws_iam_role.dms_endpoint_role
		53 |   ]
		54 | 
		55 | }

Check: CKV_AWS_260: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 80"
	FAILED for resource: aws_vpc_security_group_ingress_rule.glue_rds_conn_inbound
	File: /dms_security_groups.tf:95-103
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-aws-security-groups-do-not-allow-ingress-from-00000-to-port-80

		95  | resource "aws_vpc_security_group_ingress_rule" "glue_rds_conn_inbound" {
		96  |   security_group_id = aws_security_group.glue_rds_conn_security_group.id
		97  | 
		98  |   referenced_security_group_id = aws_security_group.glue_rds_conn_security_group.id
		99  |   ip_protocol                  = "tcp"
		100 |   from_port                    = 0
		101 |   to_port                      = 65535
		102 |   description                  = "Required ports open for Glue-RDS-Connection"
		103 | }

Check: CKV_AWS_24: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 22"
	FAILED for resource: aws_vpc_security_group_ingress_rule.glue_rds_conn_inbound
	File: /dms_security_groups.tf:95-103
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-1-port-security

		95  | resource "aws_vpc_security_group_ingress_rule" "glue_rds_conn_inbound" {
		96  |   security_group_id = aws_security_group.glue_rds_conn_security_group.id
		97  | 
		98  |   referenced_security_group_id = aws_security_group.glue_rds_conn_security_group.id
		99  |   ip_protocol                  = "tcp"
		100 |   from_port                    = 0
		101 |   to_port                      = 65535
		102 |   description                  = "Required ports open for Glue-RDS-Connection"
		103 | }

Check: CKV_AWS_25: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389"
	FAILED for resource: aws_vpc_security_group_ingress_rule.glue_rds_conn_inbound
	File: /dms_security_groups.tf:95-103
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-2

		95  | resource "aws_vpc_security_group_ingress_rule" "glue_rds_conn_inbound" {
		96  |   security_group_id = aws_security_group.glue_rds_conn_security_group.id
		97  | 
		98  |   referenced_security_group_id = aws_security_group.glue_rds_conn_security_group.id
		99  |   ip_protocol                  = "tcp"
		100 |   from_port                    = 0
		101 |   to_port                      = 65535
		102 |   description                  = "Required ports open for Glue-RDS-Connection"
		103 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.glue_notebook_ec2_iam_policy_document
	File: /glue_data.tf:96-111
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		96  | data "aws_iam_policy_document" "glue_notebook_ec2_iam_policy_document" {
		97  |   statement {
		98  |     effect = "Allow"
		99  |     actions = [
		100 |       "ec2:CreateNetworkInterface",
		101 |       "ec2:DescribeNetworkInterfaces",
		102 |       "ec2:DeleteNetworkInterface",
		103 |       "ec2:DescribeVpcEndpoints",
		104 |       "ec2:DescribeSubnets",
		105 |       "ec2:DescribeVpcAttribute",
		106 |       "ec2:DescribeRouteTables",
		107 |       "ec2:DescribeSecurityGroups"
		108 |     ]
		109 |     resources = ["*"]
		110 |   }
		111 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.glue_notebook_ec2_iam_policy_document
	File: /glue_data.tf:96-111
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		96  | data "aws_iam_policy_document" "glue_notebook_ec2_iam_policy_document" {
		97  |   statement {
		98  |     effect = "Allow"
		99  |     actions = [
		100 |       "ec2:CreateNetworkInterface",
		101 |       "ec2:DescribeNetworkInterfaces",
		102 |       "ec2:DeleteNetworkInterface",
		103 |       "ec2:DescribeVpcEndpoints",
		104 |       "ec2:DescribeSubnets",
		105 |       "ec2:DescribeVpcAttribute",
		106 |       "ec2:DescribeRouteTables",
		107 |       "ec2:DescribeSecurityGroups"
		108 |     ]
		109 |     resources = ["*"]
		110 |   }
		111 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.load_json_table_s3_policy_document
	File: /lambdas_iam.tf:430-487
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.load_json_table_s3_policy_document
	File: /lambdas_iam.tf:430-487
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.db_glue_connection
	File: /lambdas_secrets.tf:1-3
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		1 | resource "aws_secretsmanager_secret" "db_glue_connection" {
		2 |   name = "db_glue_connection"
		3 | }

Check: CKV_AWS_296: "Ensure DMS endpoint uses Customer Managed Key (CMK)"
	FAILED for resource: module.dms_task.aws_dms_endpoint.dms_rds_source
	File: /modules/dms/endpoints_rds_s3.tf:2-23
	Calling File: /dms_main.tf:1-39
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-296

		2  | resource "aws_dms_endpoint" "dms_rds_source" {
		3  | 
		4  |   #   certificate_arn             = ""
		5  |   database_name = var.database_name
		6  |   endpoint_id   = "rds-mssql-${replace(var.database_name, "_", "-")}-tf"
		7  |   endpoint_type = "source"
		8  |   engine_name   = "sqlserver"
		9  |   #   extra_connection_attributes = ""
		10 |   #   kms_key_arn                 = aws_db_instance.database_2022.kms_key_id
		11 |   password    = var.rds_db_instance_pasword
		12 |   port        = var.rds_db_instance_port
		13 |   server_name = var.rds_db_server_name
		14 |   ssl_mode    = "require"
		15 |   username    = var.rds_db_username
		16 | 
		17 |   tags = merge(
		18 |     var.local_tags,
		19 |     {
		20 |       Resource_Type = "DMS Source Endpoint - RDS MSSQL",
		21 |     },
		22 |   )
		23 | }

Check: CKV_AWS_298: "Ensure DMS S3 uses Customer Managed Key (CMK)"
	FAILED for resource: module.dms_task.aws_dms_s3_endpoint.dms_s3_parquet_target
	File: /modules/dms/endpoints_rds_s3.tf:28-84
	Calling File: /dms_main.tf:1-39
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-298

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: module.athena_layer.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-9
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 |   type       = var.type
		9 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: module.athena_layer.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-9
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 |   type       = var.type
		9 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.athena_layer.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:40-49
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		40 | data "aws_iam_policy_document" "step_function_base_permissions" {
		41 |   statement {
		42 |     effect = "Allow"
		43 |     actions = [
		44 |       "sns:Publish",
		45 |       "sqs:SendMessage"
		46 |     ]
		47 |     resources = ["*"]
		48 |   }
		49 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.athena_layer.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:40-49
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		40 | data "aws_iam_policy_document" "step_function_base_permissions" {
		41 |   statement {
		42 |     effect = "Allow"
		43 |     actions = [
		44 |       "sns:Publish",
		45 |       "sqs:SendMessage"
		46 |     ]
		47 |     resources = ["*"]
		48 |   }
		49 | }

Check: CKV_AWS_109: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: module.athena_layer.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-permissions-management-resource-exposure-without-constraint

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.athena_layer.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.athena_layer.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: module.get_zipped_file.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-9
	Calling File: /step_functions_main.tf:38-49
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 |   type       = var.type
		9 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: module.get_zipped_file.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-9
	Calling File: /step_functions_main.tf:38-49
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 |   type       = var.type
		9 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:40-49
	Calling File: /step_functions_main.tf:38-49
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		40 | data "aws_iam_policy_document" "step_function_base_permissions" {
		41 |   statement {
		42 |     effect = "Allow"
		43 |     actions = [
		44 |       "sns:Publish",
		45 |       "sqs:SendMessage"
		46 |     ]
		47 |     resources = ["*"]
		48 |   }
		49 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:40-49
	Calling File: /step_functions_main.tf:38-49
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		40 | data "aws_iam_policy_document" "step_function_base_permissions" {
		41 |   statement {
		42 |     effect = "Allow"
		43 |     actions = [
		44 |       "sns:Publish",
		45 |       "sqs:SendMessage"
		46 |     ]
		47 |     resources = ["*"]
		48 |   }
		49 | }

Check: CKV_AWS_109: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:38-49
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-permissions-management-resource-exposure-without-constraint

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:38-49
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:38-49
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: module.get_zipped_file_non_express.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-9
	Calling File: /step_functions_main.tf:52-62
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 |   type       = var.type
		9 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: module.get_zipped_file_non_express.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-9
	Calling File: /step_functions_main.tf:52-62
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 |   type       = var.type
		9 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.get_zipped_file_non_express.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:40-49
	Calling File: /step_functions_main.tf:52-62
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		40 | data "aws_iam_policy_document" "step_function_base_permissions" {
		41 |   statement {
		42 |     effect = "Allow"
		43 |     actions = [
		44 |       "sns:Publish",
		45 |       "sqs:SendMessage"
		46 |     ]
		47 |     resources = ["*"]
		48 |   }
		49 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.get_zipped_file_non_express.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:40-49
	Calling File: /step_functions_main.tf:52-62
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		40 | data "aws_iam_policy_document" "step_function_base_permissions" {
		41 |   statement {
		42 |     effect = "Allow"
		43 |     actions = [
		44 |       "sns:Publish",
		45 |       "sqs:SendMessage"
		46 |     ]
		47 |     resources = ["*"]
		48 |   }
		49 | }

Check: CKV_AWS_109: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: module.get_zipped_file_non_express.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:52-62
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-permissions-management-resource-exposure-without-constraint

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.get_zipped_file_non_express.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:52-62
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.get_zipped_file_non_express.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:52-62
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: module.send_database_to_ap.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-9
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 |   type       = var.type
		9 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: module.send_database_to_ap.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-9
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 |   type       = var.type
		9 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.send_database_to_ap.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:40-49
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		40 | data "aws_iam_policy_document" "step_function_base_permissions" {
		41 |   statement {
		42 |     effect = "Allow"
		43 |     actions = [
		44 |       "sns:Publish",
		45 |       "sqs:SendMessage"
		46 |     ]
		47 |     resources = ["*"]
		48 |   }
		49 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.send_database_to_ap.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:40-49
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		40 | data "aws_iam_policy_document" "step_function_base_permissions" {
		41 |   statement {
		42 |     effect = "Allow"
		43 |     actions = [
		44 |       "sns:Publish",
		45 |       "sqs:SendMessage"
		46 |     ]
		47 |     resources = ["*"]
		48 |   }
		49 | }

Check: CKV_AWS_109: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: module.send_database_to_ap.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-permissions-management-resource-exposure-without-constraint

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.send_database_to_ap.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.send_database_to_ap.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.db_password
	File: /server_backups.tf:4-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		4 | resource "aws_secretsmanager_secret" "db_password" {
		5 |   name = "db_password"
		6 | }

Check: CKV_AWS_354: "Ensure RDS Performance Insights are encrypted using KMS CMKs"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-354

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_157: "Ensure that RDS instances have Multi-AZ enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-73

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_118: "Ensure that enhanced monitoring is enabled for Amazon RDS instances"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/ensure-that-enhanced-monitoring-is-enabled-for-amazon-rds-instances

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_353: "Ensure that RDS instances have performance insights enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-353

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_293: "Ensure that AWS database instances have deletion protection enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-293

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_129: "Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-that-respective-logs-of-amazon-relational-database-service-amazon-rds-are-enabled

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.send_database_to_ap
	File: /step_functions_iam.tf:44-118
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.send_database_to_ap
	File: /step_functions_iam.tf:44-118
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.db_glue_connection
	File: /lambdas_secrets.tf:1-3
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		1 | resource "aws_secretsmanager_secret" "db_glue_connection" {
		2 |   name = "db_glue_connection"
		3 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.db_password
	File: /server_backups.tf:4-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		4 | resource "aws_secretsmanager_secret" "db_password" {
		5 |   name = "db_password"
		6 | }

Check: CKV2_AWS_60: "Ensure RDS instance with copy tags to snapshots is enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-60

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: aws_security_group.glue_rds_conn_security_group
	File: /dms_security_groups.tf:71-82
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		71 | resource "aws_security_group" "glue_rds_conn_security_group" {
		72 |   name        = "glue-rds-sqlserver-connection-tf"
		73 |   description = "Secuity Group for Glue-RDS-Connection"
		74 |   vpc_id      = data.aws_vpc.shared.id
		75 | 
		76 |   tags = merge(
		77 |     local.tags,
		78 |     {
		79 |       Resource_Type = "Secuity Group for Glue-RDS-Connection",
		80 |     }
		81 |   )
		82 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: module.buddi.module.landing_zone_security_groups.aws_security_group.this
	File: /modules/landing_zone/server_security_group/main.tf:7-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		7  | resource "aws_security_group" "this" {
		8  |   name        = "${var.supplier}-${var.user_name}-inbound-ips"
		9  |   description = "Allowed IP addresses for ${var.user_name} on ${var.supplier} server"
		10 |   vpc_id      = var.vpc_id
		11 | 
		12 |   lifecycle {
		13 |     create_before_destroy = true
		14 |   }
		15 | 
		16 |   tags = merge(
		17 |     var.local_tags,
		18 |     {
		19 |       supplier = var.user_name,
		20 |     },
		21 |   )
		22 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: module.capita.module.landing_zone_security_groups.aws_security_group.this
	File: /modules/landing_zone/server_security_group/main.tf:7-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		7  | resource "aws_security_group" "this" {
		8  |   name        = "${var.supplier}-${var.user_name}-inbound-ips"
		9  |   description = "Allowed IP addresses for ${var.user_name} on ${var.supplier} server"
		10 |   vpc_id      = var.vpc_id
		11 | 
		12 |   lifecycle {
		13 |     create_before_destroy = true
		14 |   }
		15 | 
		16 |   tags = merge(
		17 |     var.local_tags,
		18 |     {
		19 |       supplier = var.user_name,
		20 |     },
		21 |   )
		22 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: module.g4s.module.landing_zone_security_groups.aws_security_group.this
	File: /modules/landing_zone/server_security_group/main.tf:7-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		7  | resource "aws_security_group" "this" {
		8  |   name        = "${var.supplier}-${var.user_name}-inbound-ips"
		9  |   description = "Allowed IP addresses for ${var.user_name} on ${var.supplier} server"
		10 |   vpc_id      = var.vpc_id
		11 | 
		12 |   lifecycle {
		13 |     create_before_destroy = true
		14 |   }
		15 | 
		16 |   tags = merge(
		17 |     var.local_tags,
		18 |     {
		19 |       supplier = var.user_name,
		20 |     },
		21 |   )
		22 | }

dockerfile scan results:

Passed checks: 21, Failed checks: 2, Skipped checks: 0

Check: CKV_DOCKER_2: "Ensure that HEALTHCHECK instructions have been added to container images"
	FAILED for resource: /lambdas/update_log_table/Dockerfile.
	File: /lambdas/update_log_table/Dockerfile:1-9
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/docker-policies/docker-policy-index/ensure-that-healthcheck-instructions-have-been-added-to-container-images

		1 | FROM public.ecr.aws/lambda/python:3.11
		2 | 
		3 | COPY requirements.txt .
		4 | 
		5 | RUN pip install -r requirements.txt --target "${LAMBDA_TASK_ROOT}"
		6 | 
		7 | COPY update_log_table.py ${LAMBDA_TASK_ROOT}
		8 | 
		9 | CMD ["update_log_table.handler"]

Check: CKV_DOCKER_3: "Ensure that a user for the container has been created"
	FAILED for resource: /lambdas/update_log_table/Dockerfile.
	File: /lambdas/update_log_table/Dockerfile:1-9
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/docker-policies/docker-policy-index/ensure-that-a-user-for-the-container-has-been-created

		1 | FROM public.ecr.aws/lambda/python:3.11
		2 | 
		3 | COPY requirements.txt .
		4 | 
		5 | RUN pip install -r requirements.txt --target "${LAMBDA_TASK_ROOT}"
		6 | 
		7 | COPY update_log_table.py ${LAMBDA_TASK_ROOT}
		8 | 
		9 | CMD ["update_log_table.handler"]


checkov_exitcode=2

`CTFLint Scan` Failed

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
terraform/environments/electronic-monitoring-data/modules/step_function
terraform/environments/electronic-monitoring-data

*****************************

Running tflint in terraform/environments/electronic-monitoring-data/modules/step_function
Excluding the following checks: terraform_unused_declarations
2 issue(s) found:

Warning: terraform "required_version" attribute is required (terraform_required_version)

  on terraform/environments/electronic-monitoring-data/modules/step_function/main.tf line 1:

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_version.md

Warning: Missing version constraint for provider "aws" in `required_providers` (terraform_required_providers)

  on terraform/environments/electronic-monitoring-data/modules/step_function/main.tf line 93:
  93: resource "aws_cloudwatch_log_group" "this_log_group" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

tflint_exitcode=2

*****************************

Running tflint in terraform/environments/electronic-monitoring-data
Excluding the following checks: terraform_unused_declarations
2 issue(s) found:

Warning: Missing version constraint for provider "archive" in `required_providers` (terraform_required_providers)

  on terraform/environments/electronic-monitoring-data/lambdas_main.tf line 189:
 189: data "archive_file" "query_output_to_list" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

Warning: Missing version constraint for provider "random" in `required_providers` (terraform_required_providers)

  on terraform/environments/electronic-monitoring-data/server_backups.tf line 13:
  13: resource "random_password" "random_password" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

tflint_exitcode=4

`Trivy Scan` Failed

Show Output

*****************************

Trivy will check the following folders:
terraform/environments/electronic-monitoring-data/modules/step_function
terraform/environments/electronic-monitoring-data

*****************************

Running Trivy in terraform/environments/electronic-monitoring-data/modules/step_function
2024-10-21T20:25:13Z	INFO	[vulndb] Need to update DB
2024-10-21T20:25:13Z	INFO	[vulndb] Downloading vulnerability DB...
2024-10-21T20:25:13Z	INFO	[vulndb] Downloading artifact...	repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-21T20:25:15Z	INFO	[vulndb] Artifact successfully downloaded	repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-21T20:25:15Z	INFO	[vuln] Vulnerability scanning is enabled
2024-10-21T20:25:15Z	INFO	[misconfig] Misconfiguration scanning is enabled
2024-10-21T20:25:15Z	INFO	[misconfig] Need to update the built-in checks
2024-10-21T20:25:15Z	INFO	[misconfig] Downloading the built-in checks...
156.02 KiB / 156.02 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2024-10-21T20:25:15Z	INFO	[secret] Secret scanning is enabled
2024-10-21T20:25:15Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-21T20:25:15Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-10-21T20:25:16Z	INFO	[terraform scanner] Scanning root module	file_path="."
2024-10-21T20:25:16Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="iam_policies, name, variable_dictionary"
2024-10-21T20:25:16Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_iam_role_policy_attachment.this_attachment" value="cty.NilVal"
2024-10-21T20:25:16Z	INFO	Number of language-specific files	num=0
2024-10-21T20:25:16Z	INFO	Detected config files	num=1
trivy_exitcode=0

*****************************

Running Trivy in terraform/environments/electronic-monitoring-data
2024-10-21T20:25:16Z	INFO	[vuln] Vulnerability scanning is enabled
2024-10-21T20:25:16Z	INFO	[misconfig] Misconfiguration scanning is enabled
2024-10-21T20:25:16Z	INFO	[secret] Secret scanning is enabled
2024-10-21T20:25:16Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-21T20:25:16Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-10-21T20:25:18Z	INFO	[terraform scanner] Scanning root module	file_path="."
2024-10-21T20:25:18Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="networking"
2024-10-21T20:25:18Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:25:18Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.aws_s3_object.user_public_keys" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.data.aws_subnet.local_account" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:25:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:25:20Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:25:25Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-versioning" range="s3.tf:1081-1100"
2024-10-21T20:25:25Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-bucket-encryption" range="s3.tf:1081-1100"
2024-10-21T20:25:25Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:25:25Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:25:25Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:25:25Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:25:25Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:25:25Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:25:25Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:25:25Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:25:25Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:25:25Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:25:25Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=95ed3c3/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=568694e50e03630d99cb569eafa06a0b879a1239/main.tf:171-179"
2024-10-21T20:25:25Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="s3.tf:1081-1100"
2024-10-21T20:25:25Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-21T20:25:25Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-21T20:25:25Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-logging" range="s3.tf:1081-1100"
2024-10-21T20:25:25Z	INFO	[terraform executor] Ignore finding	rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:281-286"
2024-10-21T20:25:25Z	INFO	[terraform executor] Ignore finding	rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:407-411"
2024-10-21T20:25:25Z	WARN	[pip] Unable to find python `site-packages` directory. License detection is skipped.	err="site-packages directory not found"
2024-10-21T20:25:25Z	INFO	Number of language-specific files	num=1
2024-10-21T20:25:25Z	INFO	[pip] Detecting vulnerabilities...
2024-10-21T20:25:25Z	INFO	Detected config files	num=17

lambdas/update_log_table/Dockerfile (dockerfile)
================================================
Tests: 20 (SUCCESSES: 19, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Specify at least 1 USER command in Dockerfile with non-root user as argument
════════════════════════════════════════
Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

See https://avd.aquasec.com/misconfig/ds002
────────────────────────────────────────


trivy_exitcode=1

github-actions · 2024-10-21T20:32:13Z

`Trivy Scan` Failed

Show Output

```hcl

Trivy will check the following folders:
terraform/environments/electronic-monitoring-data/modules/step_function
terraform/environments/electronic-monitoring-data

Running Trivy in terraform/environments/electronic-monitoring-data/modules/step_function
2024-10-21T20:31:50Z INFO [vulndb] Need to update DB
2024-10-21T20:31:50Z INFO [vulndb] Downloading vulnerability DB...
2024-10-21T20:31:50Z INFO [vulndb] Downloading artifact... repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-21T20:31:52Z INFO [vulndb] Artifact successfully downloaded repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-21T20:31:52Z INFO [vuln] Vulnerability scanning is enabled
2024-10-21T20:31:52Z INFO [misconfig] Misconfiguration scanning is enabled
2024-10-21T20:31:52Z INFO [misconfig] Need to update the built-in checks
2024-10-21T20:31:52Z INFO [misconfig] Downloading the built-in checks...
2024-10-21T20:31:52Z ERROR [misconfig] Falling back to embedded checks err="failed to download built-in policies: download error: OCI repository error: 1 error occurred:\n\t* GET https://ghcr.io/v2/aquasecurity/trivy-checks/manifests/1: TOOMANYREQUESTS: retry-after: 309.169µs, allowed: 44000/minute\n\n"
2024-10-21T20:31:52Z INFO [secret] Secret scanning is enabled
2024-10-21T20:31:52Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-21T20:31:52Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-10-21T20:31:52Z INFO [terraform scanner] Scanning root module file_path="."
2024-10-21T20:31:52Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="iam_policies, name, variable_dictionary"
2024-10-21T20:31:52Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_iam_role_policy_attachment.this_attachment" value="cty.NilVal"
2024-10-21T20:31:52Z INFO Number of language-specific files num=0
2024-10-21T20:31:52Z INFO Detected config files num=1
trivy_exitcode=0

Running Trivy in terraform/environments/electronic-monitoring-data
2024-10-21T20:31:53Z INFO [vuln] Vulnerability scanning is enabled
2024-10-21T20:31:53Z INFO [misconfig] Misconfiguration scanning is enabled
2024-10-21T20:31:53Z INFO [misconfig] Need to update the built-in checks
2024-10-21T20:31:53Z INFO [misconfig] Downloading the built-in checks...
156.02 KiB / 156.02 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2024-10-21T20:31:53Z INFO [secret] Secret scanning is enabled
2024-10-21T20:31:53Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-21T20:31:53Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-10-21T20:31:54Z INFO [terraform scanner] Scanning root module file_path="."
2024-10-21T20:31:54Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="networking"
2024-10-21T20:31:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:31:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:31:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:31:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:31:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:31:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:31:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:31:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:31:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:31:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:31:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.aws_s3_object.user_public_keys" value="cty.NilVal"
2024-10-21T20:31:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.data.aws_subnet.local_account" value="cty.NilVal"
2024-10-21T20:31:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-21T20:31:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-21T20:31:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:31:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:31:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:31:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:31:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:31:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:31:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:31:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:31:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:31:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:31:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:31:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:31:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:31:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:31:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:31:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:31:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:31:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:31:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:31:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:31:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:31:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:31:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:31:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:31:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:31:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:31:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:31:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:31:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:31:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:31:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:31:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:31:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:31:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:31:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:31:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:31:56Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:32:00Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:32:00Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:32:00Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:32:00Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:32:00Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:32:00Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:32:00Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:32:00Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:32:00Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:32:00Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:32:00Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=95ed3c3/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=568694e50e03630d99cb569eafa06a0b879a1239/main.tf:171-179"
2024-10-21T20:32:00Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="s3.tf:1081-1100"
2024-10-21T20:32:00Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-21T20:32:00Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-21T20:32:00Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-logging" range="s3.tf:1081-1100"
2024-10-21T20:32:00Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-bucket-encryption" range="s3.tf:1081-1100"
2024-10-21T20:32:00Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-versioning" range="s3.tf:1081-1100"
2024-10-21T20:32:00Z INFO [terraform executor] Ignore finding rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:281-286"
2024-10-21T20:32:00Z INFO [terraform executor] Ignore finding rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:407-411"
2024-10-21T20:32:01Z WARN [pip] Unable to find python site-packages directory. License detection is skipped. err="site-packages directory not found"
2024-10-21T20:32:01Z INFO Number of language-specific files num=1
2024-10-21T20:32:01Z INFO [pip] Detecting vulnerabilities...
2024-10-21T20:32:01Z INFO Detected config files num=17

lambdas/update_log_table/Dockerfile (dockerfile)

Tests: 20 (SUCCESSES: 19, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Specify at least 1 USER command in Dockerfile with non-root user as argument
════════════════════════════════════════
Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

See https://avd.aquasec.com/misconfig/ds002
────────────────────────────────────────

trivy_exitcode=1

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/electronic-monitoring-data/modules/step_function
terraform/environments/electronic-monitoring-data

*****************************

Running Checkov in terraform/environments/electronic-monitoring-data/modules/step_function
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
terraform scan results:

Passed checks: 43, Failed checks: 7, Skipped checks: 0

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.step_function_base_permissions
	File: /main.tf:40-49
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		40 | data "aws_iam_policy_document" "step_function_base_permissions" {
		41 |   statement {
		42 |     effect = "Allow"
		43 |     actions = [
		44 |       "sns:Publish",
		45 |       "sqs:SendMessage"
		46 |     ]
		47 |     resources = ["*"]
		48 |   }
		49 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.step_function_base_permissions
	File: /main.tf:40-49
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		40 | data "aws_iam_policy_document" "step_function_base_permissions" {
		41 |   statement {
		42 |     effect = "Allow"
		43 |     actions = [
		44 |       "sns:Publish",
		45 |       "sqs:SendMessage"
		46 |     ]
		47 |     resources = ["*"]
		48 |   }
		49 | }

Check: CKV_AWS_109: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: aws_iam_policy_document.this_log_key_document
	File: /main.tf:56-80
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-permissions-management-resource-exposure-without-constraint

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.this_log_key_document
	File: /main.tf:56-80
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.this_log_key_document
	File: /main.tf:56-80
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: aws_sfn_state_machine.this
	File: /main.tf:4-9
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 |   type       = var.type
		9 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: aws_sfn_state_machine.this
	File: /main.tf:4-9
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 |   type       = var.type
		9 | }


checkov_exitcode=1

*****************************

Running Checkov in terraform/environments/electronic-monitoring-data
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2024-10-21 20:32:06,491 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=95ed3c3:None (for external modules, the --download-external-modules flag is required)
2024-10-21 20:32:06,492 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060:None (for external modules, the --download-external-modules flag is required)
2024-10-21 20:32:06,492 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/secrets-manager/aws:1.3.0 (for external modules, the --download-external-modules flag is required)
2024-10-21 20:32:06,492 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=52a40b0:None (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 2409, Failed checks: 82, Skipped checks: 38

Check: CKV_AWS_26: "Ensure all data stored in the SNS topic is encrypted"
	FAILED for resource: aws_sns_topic.s3_events
	File: /data_store.tf:17-19
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-15

		17 | resource "aws_sns_topic" "s3_events" {
		18 |   name = "${module.s3-data-bucket.bucket.id}-object-created-topic"
		19 | }

Check: CKV_AWS_115: "Ensure that AWS Lambda function is configured for function-level concurrent execution limit"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-function-level-concurrent-execution-limit

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_173: "Check encryption settings for Lambda environmental variable"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-5

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_116: "Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-a-dead-letter-queue-dlq

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_272: "Ensure AWS Lambda function is configured to validate code-signing"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-272

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_117: "Ensure that AWS Lambda function is configured inside a VPC"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-inside-a-vpc-1

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_115: "Ensure that AWS Lambda function is configured for function-level concurrent execution limit"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-function-level-concurrent-execution-limit

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_116: "Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-a-dead-letter-queue-dlq

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_272: "Ensure AWS Lambda function is configured to validate code-signing"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-272

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_117: "Ensure that AWS Lambda function is configured inside a VPC"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-inside-a-vpc-1

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group
	File: /dms_data_validation_glue_job.tf:58-61
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		58 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group" {
		59 |   name              = "dms-dv-glue-job"
		60 |   retention_in_days = 14
		61 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group
	File: /dms_data_validation_glue_job.tf:58-61
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		58 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group" {
		59 |   name              = "dms-dv-glue-job"
		60 |   retention_in_days = 14
		61 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group_v2
	File: /dms_data_validation_glue_job.tf:63-66
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		63 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group_v2" {
		64 |   name              = "dms-dv-glue-job-v2"
		65 |   retention_in_days = 14
		66 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group_v2
	File: /dms_data_validation_glue_job.tf:63-66
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		63 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group_v2" {
		64 |   name              = "dms-dv-glue-job-v2"
		65 |   retention_in_days = 14
		66 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.rds_to_s3_parquet_migration
	File: /dms_data_validation_glue_job.tf:68-71
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		68 | resource "aws_cloudwatch_log_group" "rds_to_s3_parquet_migration" {
		69 |   name              = "rds-to-s3-parquet-migration"
		70 |   retention_in_days = 14
		71 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.rds_to_s3_parquet_migration
	File: /dms_data_validation_glue_job.tf:68-71
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		68 | resource "aws_cloudwatch_log_group" "rds_to_s3_parquet_migration" {
		69 |   name              = "rds-to-s3-parquet-migration"
		70 |   retention_in_days = 14
		71 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.resizing_parquet_files
	File: /dms_data_validation_glue_job.tf:73-76
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		73 | resource "aws_cloudwatch_log_group" "resizing_parquet_files" {
		74 |   name              = "resizing-parquet-files"
		75 |   retention_in_days = 14
		76 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.resizing_parquet_files
	File: /dms_data_validation_glue_job.tf:73-76
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		73 | resource "aws_cloudwatch_log_group" "resizing_parquet_files" {
		74 |   name              = "resizing-parquet-files"
		75 |   retention_in_days = 14
		76 | }

Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.dms_dv_glue_job_v2
	File: /dms_data_validation_glue_job.tf:79-132
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.dms_dv_glue_job_v4d
	File: /dms_data_validation_glue_job.tf:140-193
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.rds_to_s3_parquet_migration
	File: /dms_data_validation_glue_job.tf:196-260
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.rds_to_s3_parquet_migration_monthly
	File: /dms_data_validation_glue_job.tf:264-315
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.resizing_parquet_files
	File: /dms_data_validation_glue_job.tf:318-370
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.catalog_dv_table_glue_job
	File: /dms_data_validation_glue_job.tf:373-401
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		373 | resource "aws_glue_job" "catalog_dv_table_glue_job" {
		374 |   name              = "catalog-dv-table-glue-job"
		375 |   description       = "Python script uses Boto3-Athena-Client to run sql-statements"
		376 |   role_arn          = aws_iam_role.dms_dv_glue_job_iam_role.arn
		377 |   glue_version      = "4.0"
		378 |   worker_type       = "G.1X"
		379 |   number_of_workers = 2
		380 |   default_arguments = {
		381 |     "--parquet_output_bucket_name"       = module.s3-dms-data-validation-bucket.bucket.id
		382 |     "--glue_catalog_db_name"             = aws_glue_catalog_database.dms_dv_glue_catalog_db.name
		383 |     "--glue_catalog_tbl_name"            = "glue_df_output"
		384 |     "--continuous-log-logGroup"          = aws_cloudwatch_log_group.dms_dv_cw_log_group.name
		385 |     "--enable-continuous-cloudwatch-log" = "true"
		386 |     "--enable-continuous-log-filter"     = "true"
		387 |     "--enable-metrics"                   = ""
		388 |   }
		389 |   command {
		390 |     python_version  = "3"
		391 |     script_location = "s3://${module.s3-glue-job-script-bucket.bucket.id}/create_or_replace_dv_table.py"
		392 |   }
		393 | 
		394 |   tags = merge(
		395 |     local.tags,
		396 |     {
		397 |       Resource_Type = "Py script as glue-job that creates dv table / refreshes its partitions",
		398 |     }
		399 |   )
		400 | 
		401 | }

Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_crawler.rds_sqlserver_db_glue_crawler
	File: /dms_glue_crawler.tf:35-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		35 | resource "aws_glue_crawler" "rds_sqlserver_db_glue_crawler" {
		36 |   name          = "rds-sqlserver-${aws_db_instance.database_2022.identifier}-tf"
		37 |   role          = aws_iam_role.dms_dv_glue_job_iam_role.arn
		38 |   database_name = aws_glue_catalog_database.rds_sqlserver_glue_catalog_db.name
		39 |   description   = "Crawler to fetch database names"
		40 |   #   table_prefix  = "your_table_prefix"
		41 | 
		42 |   jdbc_target {
		43 |     connection_name = aws_glue_connection.glue_rds_sqlserver_db_connection.name
		44 |     path            = "%"
		45 |   }
		46 |   tags = merge(
		47 |     local.tags,
		48 |     {
		49 |       Resource_Type = "RDS-SQLServer Glue-Crawler for DMS",
		50 |     }
		51 |   )
		52 | 
		53 |   # provisioner "local-exec" {
		54 |   #   command = "aws glue start-crawler --name ${self.name}"
		55 |   # }
		56 | }

Check: CKV_AWS_212: "Ensure DMS replication instance is encrypted by KMS using a customer managed Key (CMK)"
	FAILED for resource: aws_dms_replication_instance.dms_replication_instance
	File: /dms_replication_instance.tf:24-55
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-ebs-volume-is-encrypted-by-key-management-service-kms-using-a-customer-managed-key-cmk

		24 | resource "aws_dms_replication_instance" "dms_replication_instance" {
		25 |   allocated_storage          = var.dms_allocated_storage_gib
		26 |   apply_immediately          = true
		27 |   auto_minor_version_upgrade = true
		28 |   availability_zone          = var.dms_availability_zone
		29 |   engine_version             = var.dms_engine_version
		30 |   #   kms_key_arn                  = "arn:aws:kms:eu-west-2:800964199911:key/b7f54acb-16a3-4958-9340-3bdf5f5842d8"
		31 |   multi_az = false
		32 |   #   preferred_maintenance_window = "sun:10:30-sun:14:30"
		33 |   publicly_accessible         = false
		34 |   replication_instance_class  = var.dms_replication_instance_class
		35 |   replication_instance_id     = "dms-replication-instance-tf"
		36 |   replication_subnet_group_id = aws_dms_replication_subnet_group.dms_replication_subnet_group.id
		37 | 
		38 |   tags = merge(
		39 |     local.tags,
		40 |     {
		41 |       Resource_Type = "DMS Replication Instance",
		42 |     }
		43 |   )
		44 | 
		45 |   vpc_security_group_ids = [
		46 |     aws_security_group.dms_ri_security_group.id,
		47 |   ]
		48 | 
		49 |   depends_on = [
		50 |     aws_iam_role.dms_vpc_role,
		51 |     aws_iam_role.dms_cloudwatch_logs_role,
		52 |     aws_iam_role.dms_endpoint_role
		53 |   ]
		54 | 
		55 | }

Check: CKV_AWS_260: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 80"
	FAILED for resource: aws_vpc_security_group_ingress_rule.glue_rds_conn_inbound
	File: /dms_security_groups.tf:95-103
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-aws-security-groups-do-not-allow-ingress-from-00000-to-port-80

		95  | resource "aws_vpc_security_group_ingress_rule" "glue_rds_conn_inbound" {
		96  |   security_group_id = aws_security_group.glue_rds_conn_security_group.id
		97  | 
		98  |   referenced_security_group_id = aws_security_group.glue_rds_conn_security_group.id
		99  |   ip_protocol                  = "tcp"
		100 |   from_port                    = 0
		101 |   to_port                      = 65535
		102 |   description                  = "Required ports open for Glue-RDS-Connection"
		103 | }

Check: CKV_AWS_24: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 22"
	FAILED for resource: aws_vpc_security_group_ingress_rule.glue_rds_conn_inbound
	File: /dms_security_groups.tf:95-103
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-1-port-security

		95  | resource "aws_vpc_security_group_ingress_rule" "glue_rds_conn_inbound" {
		96  |   security_group_id = aws_security_group.glue_rds_conn_security_group.id
		97  | 
		98  |   referenced_security_group_id = aws_security_group.glue_rds_conn_security_group.id
		99  |   ip_protocol                  = "tcp"
		100 |   from_port                    = 0
		101 |   to_port                      = 65535
		102 |   description                  = "Required ports open for Glue-RDS-Connection"
		103 | }

Check: CKV_AWS_25: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389"
	FAILED for resource: aws_vpc_security_group_ingress_rule.glue_rds_conn_inbound
	File: /dms_security_groups.tf:95-103
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-2

		95  | resource "aws_vpc_security_group_ingress_rule" "glue_rds_conn_inbound" {
		96  |   security_group_id = aws_security_group.glue_rds_conn_security_group.id
		97  | 
		98  |   referenced_security_group_id = aws_security_group.glue_rds_conn_security_group.id
		99  |   ip_protocol                  = "tcp"
		100 |   from_port                    = 0
		101 |   to_port                      = 65535
		102 |   description                  = "Required ports open for Glue-RDS-Connection"
		103 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.glue_notebook_ec2_iam_policy_document
	File: /glue_data.tf:96-111
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		96  | data "aws_iam_policy_document" "glue_notebook_ec2_iam_policy_document" {
		97  |   statement {
		98  |     effect = "Allow"
		99  |     actions = [
		100 |       "ec2:CreateNetworkInterface",
		101 |       "ec2:DescribeNetworkInterfaces",
		102 |       "ec2:DeleteNetworkInterface",
		103 |       "ec2:DescribeVpcEndpoints",
		104 |       "ec2:DescribeSubnets",
		105 |       "ec2:DescribeVpcAttribute",
		106 |       "ec2:DescribeRouteTables",
		107 |       "ec2:DescribeSecurityGroups"
		108 |     ]
		109 |     resources = ["*"]
		110 |   }
		111 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.glue_notebook_ec2_iam_policy_document
	File: /glue_data.tf:96-111
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		96  | data "aws_iam_policy_document" "glue_notebook_ec2_iam_policy_document" {
		97  |   statement {
		98  |     effect = "Allow"
		99  |     actions = [
		100 |       "ec2:CreateNetworkInterface",
		101 |       "ec2:DescribeNetworkInterfaces",
		102 |       "ec2:DeleteNetworkInterface",
		103 |       "ec2:DescribeVpcEndpoints",
		104 |       "ec2:DescribeSubnets",
		105 |       "ec2:DescribeVpcAttribute",
		106 |       "ec2:DescribeRouteTables",
		107 |       "ec2:DescribeSecurityGroups"
		108 |     ]
		109 |     resources = ["*"]
		110 |   }
		111 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.load_json_table_s3_policy_document
	File: /lambdas_iam.tf:430-487
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.load_json_table_s3_policy_document
	File: /lambdas_iam.tf:430-487
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.db_glue_connection
	File: /lambdas_secrets.tf:1-3
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		1 | resource "aws_secretsmanager_secret" "db_glue_connection" {
		2 |   name = "db_glue_connection"
		3 | }

Check: CKV_AWS_296: "Ensure DMS endpoint uses Customer Managed Key (CMK)"
	FAILED for resource: module.dms_task.aws_dms_endpoint.dms_rds_source
	File: /modules/dms/endpoints_rds_s3.tf:2-23
	Calling File: /dms_main.tf:1-39
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-296

		2  | resource "aws_dms_endpoint" "dms_rds_source" {
		3  | 
		4  |   #   certificate_arn             = ""
		5  |   database_name = var.database_name
		6  |   endpoint_id   = "rds-mssql-${replace(var.database_name, "_", "-")}-tf"
		7  |   endpoint_type = "source"
		8  |   engine_name   = "sqlserver"
		9  |   #   extra_connection_attributes = ""
		10 |   #   kms_key_arn                 = aws_db_instance.database_2022.kms_key_id
		11 |   password    = var.rds_db_instance_pasword
		12 |   port        = var.rds_db_instance_port
		13 |   server_name = var.rds_db_server_name
		14 |   ssl_mode    = "require"
		15 |   username    = var.rds_db_username
		16 | 
		17 |   tags = merge(
		18 |     var.local_tags,
		19 |     {
		20 |       Resource_Type = "DMS Source Endpoint - RDS MSSQL",
		21 |     },
		22 |   )
		23 | }

Check: CKV_AWS_298: "Ensure DMS S3 uses Customer Managed Key (CMK)"
	FAILED for resource: module.dms_task.aws_dms_s3_endpoint.dms_s3_parquet_target
	File: /modules/dms/endpoints_rds_s3.tf:28-84
	Calling File: /dms_main.tf:1-39
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-298

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.athena_layer.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:40-49
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		40 | data "aws_iam_policy_document" "step_function_base_permissions" {
		41 |   statement {
		42 |     effect = "Allow"
		43 |     actions = [
		44 |       "sns:Publish",
		45 |       "sqs:SendMessage"
		46 |     ]
		47 |     resources = ["*"]
		48 |   }
		49 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.athena_layer.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:40-49
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		40 | data "aws_iam_policy_document" "step_function_base_permissions" {
		41 |   statement {
		42 |     effect = "Allow"
		43 |     actions = [
		44 |       "sns:Publish",
		45 |       "sqs:SendMessage"
		46 |     ]
		47 |     resources = ["*"]
		48 |   }
		49 | }

Check: CKV_AWS_109: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: module.athena_layer.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-permissions-management-resource-exposure-without-constraint

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.athena_layer.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.athena_layer.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: module.athena_layer.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-9
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 |   type       = var.type
		9 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: module.athena_layer.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-9
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 |   type       = var.type
		9 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:40-49
	Calling File: /step_functions_main.tf:38-49
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		40 | data "aws_iam_policy_document" "step_function_base_permissions" {
		41 |   statement {
		42 |     effect = "Allow"
		43 |     actions = [
		44 |       "sns:Publish",
		45 |       "sqs:SendMessage"
		46 |     ]
		47 |     resources = ["*"]
		48 |   }
		49 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:40-49
	Calling File: /step_functions_main.tf:38-49
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		40 | data "aws_iam_policy_document" "step_function_base_permissions" {
		41 |   statement {
		42 |     effect = "Allow"
		43 |     actions = [
		44 |       "sns:Publish",
		45 |       "sqs:SendMessage"
		46 |     ]
		47 |     resources = ["*"]
		48 |   }
		49 | }

Check: CKV_AWS_109: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:38-49
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-permissions-management-resource-exposure-without-constraint

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:38-49
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:38-49
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: module.get_zipped_file.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-9
	Calling File: /step_functions_main.tf:38-49
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 |   type       = var.type
		9 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: module.get_zipped_file.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-9
	Calling File: /step_functions_main.tf:38-49
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 |   type       = var.type
		9 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.get_zipped_file_express.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:40-49
	Calling File: /step_functions_main.tf:52-62
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		40 | data "aws_iam_policy_document" "step_function_base_permissions" {
		41 |   statement {
		42 |     effect = "Allow"
		43 |     actions = [
		44 |       "sns:Publish",
		45 |       "sqs:SendMessage"
		46 |     ]
		47 |     resources = ["*"]
		48 |   }
		49 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.get_zipped_file_express.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:40-49
	Calling File: /step_functions_main.tf:52-62
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		40 | data "aws_iam_policy_document" "step_function_base_permissions" {
		41 |   statement {
		42 |     effect = "Allow"
		43 |     actions = [
		44 |       "sns:Publish",
		45 |       "sqs:SendMessage"
		46 |     ]
		47 |     resources = ["*"]
		48 |   }
		49 | }

Check: CKV_AWS_109: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: module.get_zipped_file_express.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:52-62
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-permissions-management-resource-exposure-without-constraint

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.get_zipped_file_express.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:52-62
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.get_zipped_file_express.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:52-62
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: module.get_zipped_file_express.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-9
	Calling File: /step_functions_main.tf:52-62
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 |   type       = var.type
		9 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: module.get_zipped_file_express.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-9
	Calling File: /step_functions_main.tf:52-62
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 |   type       = var.type
		9 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.send_database_to_ap.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:40-49
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		40 | data "aws_iam_policy_document" "step_function_base_permissions" {
		41 |   statement {
		42 |     effect = "Allow"
		43 |     actions = [
		44 |       "sns:Publish",
		45 |       "sqs:SendMessage"
		46 |     ]
		47 |     resources = ["*"]
		48 |   }
		49 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.send_database_to_ap.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:40-49
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		40 | data "aws_iam_policy_document" "step_function_base_permissions" {
		41 |   statement {
		42 |     effect = "Allow"
		43 |     actions = [
		44 |       "sns:Publish",
		45 |       "sqs:SendMessage"
		46 |     ]
		47 |     resources = ["*"]
		48 |   }
		49 | }

Check: CKV_AWS_109: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: module.send_database_to_ap.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-permissions-management-resource-exposure-without-constraint

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.send_database_to_ap.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.send_database_to_ap.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: module.send_database_to_ap.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-9
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 |   type       = var.type
		9 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: module.send_database_to_ap.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-9
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 |   type       = var.type
		9 | }

Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.db_password
	File: /server_backups.tf:4-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		4 | resource "aws_secretsmanager_secret" "db_password" {
		5 |   name = "db_password"
		6 | }

Check: CKV_AWS_354: "Ensure RDS Performance Insights are encrypted using KMS CMKs"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-354

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_157: "Ensure that RDS instances have Multi-AZ enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-73

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_118: "Ensure that enhanced monitoring is enabled for Amazon RDS instances"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/ensure-that-enhanced-monitoring-is-enabled-for-amazon-rds-instances

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_353: "Ensure that RDS instances have performance insights enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-353

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_293: "Ensure that AWS database instances have deletion protection enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-293

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_129: "Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-that-respective-logs-of-amazon-relational-database-service-amazon-rds-are-enabled

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.send_database_to_ap
	File: /step_functions_iam.tf:44-118
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.send_database_to_ap
	File: /step_functions_iam.tf:44-118
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.db_glue_connection
	File: /lambdas_secrets.tf:1-3
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		1 | resource "aws_secretsmanager_secret" "db_glue_connection" {
		2 |   name = "db_glue_connection"
		3 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.db_password
	File: /server_backups.tf:4-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		4 | resource "aws_secretsmanager_secret" "db_password" {
		5 |   name = "db_password"
		6 | }

Check: CKV2_AWS_60: "Ensure RDS instance with copy tags to snapshots is enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-60

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: aws_security_group.glue_rds_conn_security_group
	File: /dms_security_groups.tf:71-82
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		71 | resource "aws_security_group" "glue_rds_conn_security_group" {
		72 |   name        = "glue-rds-sqlserver-connection-tf"
		73 |   description = "Secuity Group for Glue-RDS-Connection"
		74 |   vpc_id      = data.aws_vpc.shared.id
		75 | 
		76 |   tags = merge(
		77 |     local.tags,
		78 |     {
		79 |       Resource_Type = "Secuity Group for Glue-RDS-Connection",
		80 |     }
		81 |   )
		82 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: module.buddi.module.landing_zone_security_groups.aws_security_group.this
	File: /modules/landing_zone/server_security_group/main.tf:7-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		7  | resource "aws_security_group" "this" {
		8  |   name        = "${var.supplier}-${var.user_name}-inbound-ips"
		9  |   description = "Allowed IP addresses for ${var.user_name} on ${var.supplier} server"
		10 |   vpc_id      = var.vpc_id
		11 | 
		12 |   lifecycle {
		13 |     create_before_destroy = true
		14 |   }
		15 | 
		16 |   tags = merge(
		17 |     var.local_tags,
		18 |     {
		19 |       supplier = var.user_name,
		20 |     },
		21 |   )
		22 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: module.capita.module.landing_zone_security_groups.aws_security_group.this
	File: /modules/landing_zone/server_security_group/main.tf:7-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		7  | resource "aws_security_group" "this" {
		8  |   name        = "${var.supplier}-${var.user_name}-inbound-ips"
		9  |   description = "Allowed IP addresses for ${var.user_name} on ${var.supplier} server"
		10 |   vpc_id      = var.vpc_id
		11 | 
		12 |   lifecycle {
		13 |     create_before_destroy = true
		14 |   }
		15 | 
		16 |   tags = merge(
		17 |     var.local_tags,
		18 |     {
		19 |       supplier = var.user_name,
		20 |     },
		21 |   )
		22 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: module.g4s.module.landing_zone_security_groups.aws_security_group.this
	File: /modules/landing_zone/server_security_group/main.tf:7-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		7  | resource "aws_security_group" "this" {
		8  |   name        = "${var.supplier}-${var.user_name}-inbound-ips"
		9  |   description = "Allowed IP addresses for ${var.user_name} on ${var.supplier} server"
		10 |   vpc_id      = var.vpc_id
		11 | 
		12 |   lifecycle {
		13 |     create_before_destroy = true
		14 |   }
		15 | 
		16 |   tags = merge(
		17 |     var.local_tags,
		18 |     {
		19 |       supplier = var.user_name,
		20 |     },
		21 |   )
		22 | }

dockerfile scan results:

Passed checks: 21, Failed checks: 2, Skipped checks: 0

Check: CKV_DOCKER_2: "Ensure that HEALTHCHECK instructions have been added to container images"
	FAILED for resource: /lambdas/update_log_table/Dockerfile.
	File: /lambdas/update_log_table/Dockerfile:1-9
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/docker-policies/docker-policy-index/ensure-that-healthcheck-instructions-have-been-added-to-container-images

		1 | FROM public.ecr.aws/lambda/python:3.11
		2 | 
		3 | COPY requirements.txt .
		4 | 
		5 | RUN pip install -r requirements.txt --target "${LAMBDA_TASK_ROOT}"
		6 | 
		7 | COPY update_log_table.py ${LAMBDA_TASK_ROOT}
		8 | 
		9 | CMD ["update_log_table.handler"]

Check: CKV_DOCKER_3: "Ensure that a user for the container has been created"
	FAILED for resource: /lambdas/update_log_table/Dockerfile.
	File: /lambdas/update_log_table/Dockerfile:1-9
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/docker-policies/docker-policy-index/ensure-that-a-user-for-the-container-has-been-created

		1 | FROM public.ecr.aws/lambda/python:3.11
		2 | 
		3 | COPY requirements.txt .
		4 | 
		5 | RUN pip install -r requirements.txt --target "${LAMBDA_TASK_ROOT}"
		6 | 
		7 | COPY update_log_table.py ${LAMBDA_TASK_ROOT}
		8 | 
		9 | CMD ["update_log_table.handler"]


checkov_exitcode=2

`CTFLint Scan` Failed

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
terraform/environments/electronic-monitoring-data/modules/step_function
terraform/environments/electronic-monitoring-data

*****************************

Running tflint in terraform/environments/electronic-monitoring-data/modules/step_function
Excluding the following checks: terraform_unused_declarations
2 issue(s) found:

Warning: terraform "required_version" attribute is required (terraform_required_version)

  on terraform/environments/electronic-monitoring-data/modules/step_function/main.tf line 1:

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_version.md

Warning: Missing version constraint for provider "aws" in `required_providers` (terraform_required_providers)

  on terraform/environments/electronic-monitoring-data/modules/step_function/main.tf line 93:
  93: resource "aws_cloudwatch_log_group" "this_log_group" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

tflint_exitcode=2

*****************************

Running tflint in terraform/environments/electronic-monitoring-data
Excluding the following checks: terraform_unused_declarations
2 issue(s) found:

Warning: Missing version constraint for provider "archive" in `required_providers` (terraform_required_providers)

  on terraform/environments/electronic-monitoring-data/data_store.tf line 151:
 151: data "archive_file" "summarise_zip_lambda" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

Warning: Missing version constraint for provider "random" in `required_providers` (terraform_required_providers)

  on terraform/environments/electronic-monitoring-data/server_backups.tf line 13:
  13: resource "random_password" "random_password" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

tflint_exitcode=4

`Trivy Scan` Failed

Show Output

*****************************

Trivy will check the following folders:
terraform/environments/electronic-monitoring-data/modules/step_function
terraform/environments/electronic-monitoring-data

*****************************

Running Trivy in terraform/environments/electronic-monitoring-data/modules/step_function
2024-10-21T20:31:50Z	INFO	[vulndb] Need to update DB
2024-10-21T20:31:50Z	INFO	[vulndb] Downloading vulnerability DB...
2024-10-21T20:31:50Z	INFO	[vulndb] Downloading artifact...	repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-21T20:31:52Z	INFO	[vulndb] Artifact successfully downloaded	repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-21T20:31:52Z	INFO	[vuln] Vulnerability scanning is enabled
2024-10-21T20:31:52Z	INFO	[misconfig] Misconfiguration scanning is enabled
2024-10-21T20:31:52Z	INFO	[misconfig] Need to update the built-in checks
2024-10-21T20:31:52Z	INFO	[misconfig] Downloading the built-in checks...
2024-10-21T20:31:52Z	ERROR	[misconfig] Falling back to embedded checks	err="failed to download built-in policies: download error: OCI repository error: 1 error occurred:\n\t* GET https://ghcr.io/v2/aquasecurity/trivy-checks/manifests/1: TOOMANYREQUESTS: retry-after: 309.169µs, allowed: 44000/minute\n\n"
2024-10-21T20:31:52Z	INFO	[secret] Secret scanning is enabled
2024-10-21T20:31:52Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-21T20:31:52Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-10-21T20:31:52Z	INFO	[terraform scanner] Scanning root module	file_path="."
2024-10-21T20:31:52Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="iam_policies, name, variable_dictionary"
2024-10-21T20:31:52Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_iam_role_policy_attachment.this_attachment" value="cty.NilVal"
2024-10-21T20:31:52Z	INFO	Number of language-specific files	num=0
2024-10-21T20:31:52Z	INFO	Detected config files	num=1
trivy_exitcode=0

*****************************

Running Trivy in terraform/environments/electronic-monitoring-data
2024-10-21T20:31:53Z	INFO	[vuln] Vulnerability scanning is enabled
2024-10-21T20:31:53Z	INFO	[misconfig] Misconfiguration scanning is enabled
2024-10-21T20:31:53Z	INFO	[misconfig] Need to update the built-in checks
2024-10-21T20:31:53Z	INFO	[misconfig] Downloading the built-in checks...
156.02 KiB / 156.02 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2024-10-21T20:31:53Z	INFO	[secret] Secret scanning is enabled
2024-10-21T20:31:53Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-21T20:31:53Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-10-21T20:31:54Z	INFO	[terraform scanner] Scanning root module	file_path="."
2024-10-21T20:31:54Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="networking"
2024-10-21T20:31:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:31:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:31:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:31:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:31:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:31:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:31:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:31:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:31:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:31:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:31:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.aws_s3_object.user_public_keys" value="cty.NilVal"
2024-10-21T20:31:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.data.aws_subnet.local_account" value="cty.NilVal"
2024-10-21T20:31:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-21T20:31:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-21T20:31:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:31:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:31:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:31:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:31:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:31:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:31:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:31:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:31:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:31:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:31:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:31:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:31:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:31:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:31:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:31:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:31:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:31:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:31:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:31:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:31:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:31:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:31:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:31:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:31:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:31:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:31:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:31:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:31:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:31:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:31:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:31:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:31:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:31:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:31:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:31:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:31:56Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:32:00Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:32:00Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:32:00Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:32:00Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:32:00Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:32:00Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:32:00Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:32:00Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:32:00Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:32:00Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:32:00Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=95ed3c3/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=568694e50e03630d99cb569eafa06a0b879a1239/main.tf:171-179"
2024-10-21T20:32:00Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="s3.tf:1081-1100"
2024-10-21T20:32:00Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-21T20:32:00Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-21T20:32:00Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-logging" range="s3.tf:1081-1100"
2024-10-21T20:32:00Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-bucket-encryption" range="s3.tf:1081-1100"
2024-10-21T20:32:00Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-versioning" range="s3.tf:1081-1100"
2024-10-21T20:32:00Z	INFO	[terraform executor] Ignore finding	rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:281-286"
2024-10-21T20:32:00Z	INFO	[terraform executor] Ignore finding	rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:407-411"
2024-10-21T20:32:01Z	WARN	[pip] Unable to find python `site-packages` directory. License detection is skipped.	err="site-packages directory not found"
2024-10-21T20:32:01Z	INFO	Number of language-specific files	num=1
2024-10-21T20:32:01Z	INFO	[pip] Detecting vulnerabilities...
2024-10-21T20:32:01Z	INFO	Detected config files	num=17

lambdas/update_log_table/Dockerfile (dockerfile)
================================================
Tests: 20 (SUCCESSES: 19, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Specify at least 1 USER command in Dockerfile with non-root user as argument
════════════════════════════════════════
Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

See https://avd.aquasec.com/misconfig/ds002
────────────────────────────────────────


trivy_exitcode=1

github-actions · 2024-10-21T20:34:08Z

`Trivy Scan` Failed

Show Output

```hcl

Trivy will check the following folders:
terraform/environments/electronic-monitoring-data/modules/step_function
terraform/environments/electronic-monitoring-data

Running Trivy in terraform/environments/electronic-monitoring-data/modules/step_function
2024-10-21T20:33:38Z INFO [vulndb] Need to update DB
2024-10-21T20:33:38Z INFO [vulndb] Downloading vulnerability DB...
2024-10-21T20:33:38Z INFO [vulndb] Downloading artifact... repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-21T20:33:41Z INFO [vulndb] Artifact successfully downloaded repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-21T20:33:41Z INFO [vuln] Vulnerability scanning is enabled
2024-10-21T20:33:41Z INFO [misconfig] Misconfiguration scanning is enabled
2024-10-21T20:33:41Z INFO [misconfig] Need to update the built-in checks
2024-10-21T20:33:41Z INFO [misconfig] Downloading the built-in checks...
156.02 KiB / 156.02 KiB [---------------------------------------------------------] 100.00% ? p/s 0s2024-10-21T20:33:41Z INFO [secret] Secret scanning is enabled
2024-10-21T20:33:41Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-21T20:33:41Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-10-21T20:33:42Z INFO [terraform scanner] Scanning root module file_path="."
2024-10-21T20:33:42Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="iam_policies, name, variable_dictionary"
2024-10-21T20:33:42Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_iam_role_policy_attachment.this_attachment" value="cty.NilVal"
2024-10-21T20:33:42Z INFO Number of language-specific files num=0
2024-10-21T20:33:42Z INFO Detected config files num=1
trivy_exitcode=0

Running Trivy in terraform/environments/electronic-monitoring-data
2024-10-21T20:33:42Z INFO [vuln] Vulnerability scanning is enabled
2024-10-21T20:33:42Z INFO [misconfig] Misconfiguration scanning is enabled
2024-10-21T20:33:42Z INFO [secret] Secret scanning is enabled
2024-10-21T20:33:42Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-21T20:33:42Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-10-21T20:33:44Z INFO [terraform scanner] Scanning root module file_path="."
2024-10-21T20:33:44Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="networking"
2024-10-21T20:33:45Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:33:45Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:33:45Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:33:45Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:33:45Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:33:45Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.aws_s3_object.user_public_keys" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.data.aws_subnet.local_account" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:33:46Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:33:47Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:33:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:33:48Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:33:52Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-bucket-encryption" range="s3.tf:1081-1100"
2024-10-21T20:33:52Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-logging" range="s3.tf:1081-1100"
2024-10-21T20:33:52Z INFO [terraform executor] Ignore finding rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:281-286"
2024-10-21T20:33:52Z INFO [terraform executor] Ignore finding rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:407-411"
2024-10-21T20:33:52Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-21T20:33:52Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-21T20:33:52Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-versioning" range="s3.tf:1081-1100"
2024-10-21T20:33:52Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:33:52Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:33:52Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:33:52Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:33:52Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:33:52Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:33:52Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:33:52Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:33:52Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:33:52Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:33:52Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=95ed3c3/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=568694e50e03630d99cb569eafa06a0b879a1239/main.tf:171-179"
2024-10-21T20:33:52Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="s3.tf:1081-1100"
2024-10-21T20:33:52Z WARN [pip] Unable to find python site-packages directory. License detection is skipped. err="site-packages directory not found"
2024-10-21T20:33:53Z INFO Number of language-specific files num=1
2024-10-21T20:33:53Z INFO [pip] Detecting vulnerabilities...
2024-10-21T20:33:53Z INFO Detected config files num=17

lambdas/update_log_table/Dockerfile (dockerfile)

Tests: 20 (SUCCESSES: 19, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Specify at least 1 USER command in Dockerfile with non-root user as argument
════════════════════════════════════════
Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

See https://avd.aquasec.com/misconfig/ds002
────────────────────────────────────────

trivy_exitcode=1

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/electronic-monitoring-data/modules/step_function
terraform/environments/electronic-monitoring-data

*****************************

Running Checkov in terraform/environments/electronic-monitoring-data/modules/step_function
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
terraform scan results:

Passed checks: 43, Failed checks: 7, Skipped checks: 0

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.step_function_base_permissions
	File: /main.tf:40-49
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		40 | data "aws_iam_policy_document" "step_function_base_permissions" {
		41 |   statement {
		42 |     effect = "Allow"
		43 |     actions = [
		44 |       "sns:Publish",
		45 |       "sqs:SendMessage"
		46 |     ]
		47 |     resources = ["*"]
		48 |   }
		49 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.step_function_base_permissions
	File: /main.tf:40-49
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		40 | data "aws_iam_policy_document" "step_function_base_permissions" {
		41 |   statement {
		42 |     effect = "Allow"
		43 |     actions = [
		44 |       "sns:Publish",
		45 |       "sqs:SendMessage"
		46 |     ]
		47 |     resources = ["*"]
		48 |   }
		49 | }

Check: CKV_AWS_109: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: aws_iam_policy_document.this_log_key_document
	File: /main.tf:56-80
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-permissions-management-resource-exposure-without-constraint

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.this_log_key_document
	File: /main.tf:56-80
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.this_log_key_document
	File: /main.tf:56-80
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: aws_sfn_state_machine.this
	File: /main.tf:4-9
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 |   type       = var.type
		9 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: aws_sfn_state_machine.this
	File: /main.tf:4-9
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 |   type       = var.type
		9 | }


checkov_exitcode=1

*****************************

Running Checkov in terraform/environments/electronic-monitoring-data
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2024-10-21 20:33:59,902 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=95ed3c3:None (for external modules, the --download-external-modules flag is required)
2024-10-21 20:33:59,903 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060:None (for external modules, the --download-external-modules flag is required)
2024-10-21 20:33:59,903 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/secrets-manager/aws:1.3.0 (for external modules, the --download-external-modules flag is required)
2024-10-21 20:33:59,903 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=52a40b0:None (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 2409, Failed checks: 82, Skipped checks: 38

Check: CKV_AWS_26: "Ensure all data stored in the SNS topic is encrypted"
	FAILED for resource: aws_sns_topic.s3_events
	File: /data_store.tf:17-19
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-15

		17 | resource "aws_sns_topic" "s3_events" {
		18 |   name = "${module.s3-data-bucket.bucket.id}-object-created-topic"
		19 | }

Check: CKV_AWS_115: "Ensure that AWS Lambda function is configured for function-level concurrent execution limit"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-function-level-concurrent-execution-limit

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_173: "Check encryption settings for Lambda environmental variable"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-5

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_116: "Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-a-dead-letter-queue-dlq

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_272: "Ensure AWS Lambda function is configured to validate code-signing"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-272

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_117: "Ensure that AWS Lambda function is configured inside a VPC"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-inside-a-vpc-1

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_115: "Ensure that AWS Lambda function is configured for function-level concurrent execution limit"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-function-level-concurrent-execution-limit

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_116: "Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-a-dead-letter-queue-dlq

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_272: "Ensure AWS Lambda function is configured to validate code-signing"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-272

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_117: "Ensure that AWS Lambda function is configured inside a VPC"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-inside-a-vpc-1

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group
	File: /dms_data_validation_glue_job.tf:58-61
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		58 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group" {
		59 |   name              = "dms-dv-glue-job"
		60 |   retention_in_days = 14
		61 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group
	File: /dms_data_validation_glue_job.tf:58-61
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		58 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group" {
		59 |   name              = "dms-dv-glue-job"
		60 |   retention_in_days = 14
		61 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group_v2
	File: /dms_data_validation_glue_job.tf:63-66
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		63 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group_v2" {
		64 |   name              = "dms-dv-glue-job-v2"
		65 |   retention_in_days = 14
		66 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group_v2
	File: /dms_data_validation_glue_job.tf:63-66
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		63 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group_v2" {
		64 |   name              = "dms-dv-glue-job-v2"
		65 |   retention_in_days = 14
		66 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.rds_to_s3_parquet_migration
	File: /dms_data_validation_glue_job.tf:68-71
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		68 | resource "aws_cloudwatch_log_group" "rds_to_s3_parquet_migration" {
		69 |   name              = "rds-to-s3-parquet-migration"
		70 |   retention_in_days = 14
		71 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.rds_to_s3_parquet_migration
	File: /dms_data_validation_glue_job.tf:68-71
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		68 | resource "aws_cloudwatch_log_group" "rds_to_s3_parquet_migration" {
		69 |   name              = "rds-to-s3-parquet-migration"
		70 |   retention_in_days = 14
		71 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.resizing_parquet_files
	File: /dms_data_validation_glue_job.tf:73-76
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		73 | resource "aws_cloudwatch_log_group" "resizing_parquet_files" {
		74 |   name              = "resizing-parquet-files"
		75 |   retention_in_days = 14
		76 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.resizing_parquet_files
	File: /dms_data_validation_glue_job.tf:73-76
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		73 | resource "aws_cloudwatch_log_group" "resizing_parquet_files" {
		74 |   name              = "resizing-parquet-files"
		75 |   retention_in_days = 14
		76 | }

Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.dms_dv_glue_job_v2
	File: /dms_data_validation_glue_job.tf:79-132
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.dms_dv_glue_job_v4d
	File: /dms_data_validation_glue_job.tf:140-193
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.rds_to_s3_parquet_migration
	File: /dms_data_validation_glue_job.tf:196-260
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.rds_to_s3_parquet_migration_monthly
	File: /dms_data_validation_glue_job.tf:264-315
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.resizing_parquet_files
	File: /dms_data_validation_glue_job.tf:318-370
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.catalog_dv_table_glue_job
	File: /dms_data_validation_glue_job.tf:373-401
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		373 | resource "aws_glue_job" "catalog_dv_table_glue_job" {
		374 |   name              = "catalog-dv-table-glue-job"
		375 |   description       = "Python script uses Boto3-Athena-Client to run sql-statements"
		376 |   role_arn          = aws_iam_role.dms_dv_glue_job_iam_role.arn
		377 |   glue_version      = "4.0"
		378 |   worker_type       = "G.1X"
		379 |   number_of_workers = 2
		380 |   default_arguments = {
		381 |     "--parquet_output_bucket_name"       = module.s3-dms-data-validation-bucket.bucket.id
		382 |     "--glue_catalog_db_name"             = aws_glue_catalog_database.dms_dv_glue_catalog_db.name
		383 |     "--glue_catalog_tbl_name"            = "glue_df_output"
		384 |     "--continuous-log-logGroup"          = aws_cloudwatch_log_group.dms_dv_cw_log_group.name
		385 |     "--enable-continuous-cloudwatch-log" = "true"
		386 |     "--enable-continuous-log-filter"     = "true"
		387 |     "--enable-metrics"                   = ""
		388 |   }
		389 |   command {
		390 |     python_version  = "3"
		391 |     script_location = "s3://${module.s3-glue-job-script-bucket.bucket.id}/create_or_replace_dv_table.py"
		392 |   }
		393 | 
		394 |   tags = merge(
		395 |     local.tags,
		396 |     {
		397 |       Resource_Type = "Py script as glue-job that creates dv table / refreshes its partitions",
		398 |     }
		399 |   )
		400 | 
		401 | }

Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_crawler.rds_sqlserver_db_glue_crawler
	File: /dms_glue_crawler.tf:35-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		35 | resource "aws_glue_crawler" "rds_sqlserver_db_glue_crawler" {
		36 |   name          = "rds-sqlserver-${aws_db_instance.database_2022.identifier}-tf"
		37 |   role          = aws_iam_role.dms_dv_glue_job_iam_role.arn
		38 |   database_name = aws_glue_catalog_database.rds_sqlserver_glue_catalog_db.name
		39 |   description   = "Crawler to fetch database names"
		40 |   #   table_prefix  = "your_table_prefix"
		41 | 
		42 |   jdbc_target {
		43 |     connection_name = aws_glue_connection.glue_rds_sqlserver_db_connection.name
		44 |     path            = "%"
		45 |   }
		46 |   tags = merge(
		47 |     local.tags,
		48 |     {
		49 |       Resource_Type = "RDS-SQLServer Glue-Crawler for DMS",
		50 |     }
		51 |   )
		52 | 
		53 |   # provisioner "local-exec" {
		54 |   #   command = "aws glue start-crawler --name ${self.name}"
		55 |   # }
		56 | }

Check: CKV_AWS_212: "Ensure DMS replication instance is encrypted by KMS using a customer managed Key (CMK)"
	FAILED for resource: aws_dms_replication_instance.dms_replication_instance
	File: /dms_replication_instance.tf:24-55
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-ebs-volume-is-encrypted-by-key-management-service-kms-using-a-customer-managed-key-cmk

		24 | resource "aws_dms_replication_instance" "dms_replication_instance" {
		25 |   allocated_storage          = var.dms_allocated_storage_gib
		26 |   apply_immediately          = true
		27 |   auto_minor_version_upgrade = true
		28 |   availability_zone          = var.dms_availability_zone
		29 |   engine_version             = var.dms_engine_version
		30 |   #   kms_key_arn                  = "arn:aws:kms:eu-west-2:800964199911:key/b7f54acb-16a3-4958-9340-3bdf5f5842d8"
		31 |   multi_az = false
		32 |   #   preferred_maintenance_window = "sun:10:30-sun:14:30"
		33 |   publicly_accessible         = false
		34 |   replication_instance_class  = var.dms_replication_instance_class
		35 |   replication_instance_id     = "dms-replication-instance-tf"
		36 |   replication_subnet_group_id = aws_dms_replication_subnet_group.dms_replication_subnet_group.id
		37 | 
		38 |   tags = merge(
		39 |     local.tags,
		40 |     {
		41 |       Resource_Type = "DMS Replication Instance",
		42 |     }
		43 |   )
		44 | 
		45 |   vpc_security_group_ids = [
		46 |     aws_security_group.dms_ri_security_group.id,
		47 |   ]
		48 | 
		49 |   depends_on = [
		50 |     aws_iam_role.dms_vpc_role,
		51 |     aws_iam_role.dms_cloudwatch_logs_role,
		52 |     aws_iam_role.dms_endpoint_role
		53 |   ]
		54 | 
		55 | }

Check: CKV_AWS_260: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 80"
	FAILED for resource: aws_vpc_security_group_ingress_rule.glue_rds_conn_inbound
	File: /dms_security_groups.tf:95-103
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-aws-security-groups-do-not-allow-ingress-from-00000-to-port-80

		95  | resource "aws_vpc_security_group_ingress_rule" "glue_rds_conn_inbound" {
		96  |   security_group_id = aws_security_group.glue_rds_conn_security_group.id
		97  | 
		98  |   referenced_security_group_id = aws_security_group.glue_rds_conn_security_group.id
		99  |   ip_protocol                  = "tcp"
		100 |   from_port                    = 0
		101 |   to_port                      = 65535
		102 |   description                  = "Required ports open for Glue-RDS-Connection"
		103 | }

Check: CKV_AWS_24: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 22"
	FAILED for resource: aws_vpc_security_group_ingress_rule.glue_rds_conn_inbound
	File: /dms_security_groups.tf:95-103
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-1-port-security

		95  | resource "aws_vpc_security_group_ingress_rule" "glue_rds_conn_inbound" {
		96  |   security_group_id = aws_security_group.glue_rds_conn_security_group.id
		97  | 
		98  |   referenced_security_group_id = aws_security_group.glue_rds_conn_security_group.id
		99  |   ip_protocol                  = "tcp"
		100 |   from_port                    = 0
		101 |   to_port                      = 65535
		102 |   description                  = "Required ports open for Glue-RDS-Connection"
		103 | }

Check: CKV_AWS_25: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389"
	FAILED for resource: aws_vpc_security_group_ingress_rule.glue_rds_conn_inbound
	File: /dms_security_groups.tf:95-103
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-2

		95  | resource "aws_vpc_security_group_ingress_rule" "glue_rds_conn_inbound" {
		96  |   security_group_id = aws_security_group.glue_rds_conn_security_group.id
		97  | 
		98  |   referenced_security_group_id = aws_security_group.glue_rds_conn_security_group.id
		99  |   ip_protocol                  = "tcp"
		100 |   from_port                    = 0
		101 |   to_port                      = 65535
		102 |   description                  = "Required ports open for Glue-RDS-Connection"
		103 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.glue_notebook_ec2_iam_policy_document
	File: /glue_data.tf:96-111
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		96  | data "aws_iam_policy_document" "glue_notebook_ec2_iam_policy_document" {
		97  |   statement {
		98  |     effect = "Allow"
		99  |     actions = [
		100 |       "ec2:CreateNetworkInterface",
		101 |       "ec2:DescribeNetworkInterfaces",
		102 |       "ec2:DeleteNetworkInterface",
		103 |       "ec2:DescribeVpcEndpoints",
		104 |       "ec2:DescribeSubnets",
		105 |       "ec2:DescribeVpcAttribute",
		106 |       "ec2:DescribeRouteTables",
		107 |       "ec2:DescribeSecurityGroups"
		108 |     ]
		109 |     resources = ["*"]
		110 |   }
		111 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.glue_notebook_ec2_iam_policy_document
	File: /glue_data.tf:96-111
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		96  | data "aws_iam_policy_document" "glue_notebook_ec2_iam_policy_document" {
		97  |   statement {
		98  |     effect = "Allow"
		99  |     actions = [
		100 |       "ec2:CreateNetworkInterface",
		101 |       "ec2:DescribeNetworkInterfaces",
		102 |       "ec2:DeleteNetworkInterface",
		103 |       "ec2:DescribeVpcEndpoints",
		104 |       "ec2:DescribeSubnets",
		105 |       "ec2:DescribeVpcAttribute",
		106 |       "ec2:DescribeRouteTables",
		107 |       "ec2:DescribeSecurityGroups"
		108 |     ]
		109 |     resources = ["*"]
		110 |   }
		111 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.load_json_table_s3_policy_document
	File: /lambdas_iam.tf:430-487
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.load_json_table_s3_policy_document
	File: /lambdas_iam.tf:430-487
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.db_glue_connection
	File: /lambdas_secrets.tf:1-3
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		1 | resource "aws_secretsmanager_secret" "db_glue_connection" {
		2 |   name = "db_glue_connection"
		3 | }

Check: CKV_AWS_296: "Ensure DMS endpoint uses Customer Managed Key (CMK)"
	FAILED for resource: module.dms_task.aws_dms_endpoint.dms_rds_source
	File: /modules/dms/endpoints_rds_s3.tf:2-23
	Calling File: /dms_main.tf:1-39
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-296

		2  | resource "aws_dms_endpoint" "dms_rds_source" {
		3  | 
		4  |   #   certificate_arn             = ""
		5  |   database_name = var.database_name
		6  |   endpoint_id   = "rds-mssql-${replace(var.database_name, "_", "-")}-tf"
		7  |   endpoint_type = "source"
		8  |   engine_name   = "sqlserver"
		9  |   #   extra_connection_attributes = ""
		10 |   #   kms_key_arn                 = aws_db_instance.database_2022.kms_key_id
		11 |   password    = var.rds_db_instance_pasword
		12 |   port        = var.rds_db_instance_port
		13 |   server_name = var.rds_db_server_name
		14 |   ssl_mode    = "require"
		15 |   username    = var.rds_db_username
		16 | 
		17 |   tags = merge(
		18 |     var.local_tags,
		19 |     {
		20 |       Resource_Type = "DMS Source Endpoint - RDS MSSQL",
		21 |     },
		22 |   )
		23 | }

Check: CKV_AWS_298: "Ensure DMS S3 uses Customer Managed Key (CMK)"
	FAILED for resource: module.dms_task.aws_dms_s3_endpoint.dms_s3_parquet_target
	File: /modules/dms/endpoints_rds_s3.tf:28-84
	Calling File: /dms_main.tf:1-39
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-298

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.athena_layer.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:40-49
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		40 | data "aws_iam_policy_document" "step_function_base_permissions" {
		41 |   statement {
		42 |     effect = "Allow"
		43 |     actions = [
		44 |       "sns:Publish",
		45 |       "sqs:SendMessage"
		46 |     ]
		47 |     resources = ["*"]
		48 |   }
		49 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.athena_layer.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:40-49
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		40 | data "aws_iam_policy_document" "step_function_base_permissions" {
		41 |   statement {
		42 |     effect = "Allow"
		43 |     actions = [
		44 |       "sns:Publish",
		45 |       "sqs:SendMessage"
		46 |     ]
		47 |     resources = ["*"]
		48 |   }
		49 | }

Check: CKV_AWS_109: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: module.athena_layer.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-permissions-management-resource-exposure-without-constraint

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.athena_layer.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.athena_layer.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: module.athena_layer.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-9
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 |   type       = var.type
		9 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: module.athena_layer.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-9
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 |   type       = var.type
		9 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:40-49
	Calling File: /step_functions_main.tf:38-49
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		40 | data "aws_iam_policy_document" "step_function_base_permissions" {
		41 |   statement {
		42 |     effect = "Allow"
		43 |     actions = [
		44 |       "sns:Publish",
		45 |       "sqs:SendMessage"
		46 |     ]
		47 |     resources = ["*"]
		48 |   }
		49 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:40-49
	Calling File: /step_functions_main.tf:38-49
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		40 | data "aws_iam_policy_document" "step_function_base_permissions" {
		41 |   statement {
		42 |     effect = "Allow"
		43 |     actions = [
		44 |       "sns:Publish",
		45 |       "sqs:SendMessage"
		46 |     ]
		47 |     resources = ["*"]
		48 |   }
		49 | }

Check: CKV_AWS_109: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:38-49
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-permissions-management-resource-exposure-without-constraint

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:38-49
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.get_zipped_file.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:38-49
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: module.get_zipped_file.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-9
	Calling File: /step_functions_main.tf:38-49
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 |   type       = var.type
		9 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: module.get_zipped_file.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-9
	Calling File: /step_functions_main.tf:38-49
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 |   type       = var.type
		9 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.get_zipped_file_express.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:40-49
	Calling File: /step_functions_main.tf:52-62
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		40 | data "aws_iam_policy_document" "step_function_base_permissions" {
		41 |   statement {
		42 |     effect = "Allow"
		43 |     actions = [
		44 |       "sns:Publish",
		45 |       "sqs:SendMessage"
		46 |     ]
		47 |     resources = ["*"]
		48 |   }
		49 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.get_zipped_file_express.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:40-49
	Calling File: /step_functions_main.tf:52-62
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		40 | data "aws_iam_policy_document" "step_function_base_permissions" {
		41 |   statement {
		42 |     effect = "Allow"
		43 |     actions = [
		44 |       "sns:Publish",
		45 |       "sqs:SendMessage"
		46 |     ]
		47 |     resources = ["*"]
		48 |   }
		49 | }

Check: CKV_AWS_109: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: module.get_zipped_file_express.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:52-62
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-permissions-management-resource-exposure-without-constraint

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.get_zipped_file_express.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:52-62
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.get_zipped_file_express.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:52-62
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: module.get_zipped_file_express.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-9
	Calling File: /step_functions_main.tf:52-62
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 |   type       = var.type
		9 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: module.get_zipped_file_express.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-9
	Calling File: /step_functions_main.tf:52-62
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 |   type       = var.type
		9 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.send_database_to_ap.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:40-49
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		40 | data "aws_iam_policy_document" "step_function_base_permissions" {
		41 |   statement {
		42 |     effect = "Allow"
		43 |     actions = [
		44 |       "sns:Publish",
		45 |       "sqs:SendMessage"
		46 |     ]
		47 |     resources = ["*"]
		48 |   }
		49 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.send_database_to_ap.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:40-49
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		40 | data "aws_iam_policy_document" "step_function_base_permissions" {
		41 |   statement {
		42 |     effect = "Allow"
		43 |     actions = [
		44 |       "sns:Publish",
		45 |       "sqs:SendMessage"
		46 |     ]
		47 |     resources = ["*"]
		48 |   }
		49 | }

Check: CKV_AWS_109: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: module.send_database_to_ap.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-permissions-management-resource-exposure-without-constraint

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.send_database_to_ap.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.send_database_to_ap.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: module.send_database_to_ap.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-9
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 |   type       = var.type
		9 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: module.send_database_to_ap.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-9
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 |   type       = var.type
		9 | }

Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.db_password
	File: /server_backups.tf:4-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		4 | resource "aws_secretsmanager_secret" "db_password" {
		5 |   name = "db_password"
		6 | }

Check: CKV_AWS_354: "Ensure RDS Performance Insights are encrypted using KMS CMKs"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-354

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_157: "Ensure that RDS instances have Multi-AZ enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-73

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_118: "Ensure that enhanced monitoring is enabled for Amazon RDS instances"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/ensure-that-enhanced-monitoring-is-enabled-for-amazon-rds-instances

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_353: "Ensure that RDS instances have performance insights enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-353

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_293: "Ensure that AWS database instances have deletion protection enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-293

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_129: "Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-that-respective-logs-of-amazon-relational-database-service-amazon-rds-are-enabled

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.send_database_to_ap
	File: /step_functions_iam.tf:44-118
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.send_database_to_ap
	File: /step_functions_iam.tf:44-118
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.db_glue_connection
	File: /lambdas_secrets.tf:1-3
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		1 | resource "aws_secretsmanager_secret" "db_glue_connection" {
		2 |   name = "db_glue_connection"
		3 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.db_password
	File: /server_backups.tf:4-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		4 | resource "aws_secretsmanager_secret" "db_password" {
		5 |   name = "db_password"
		6 | }

Check: CKV2_AWS_60: "Ensure RDS instance with copy tags to snapshots is enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-60

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: aws_security_group.glue_rds_conn_security_group
	File: /dms_security_groups.tf:71-82
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		71 | resource "aws_security_group" "glue_rds_conn_security_group" {
		72 |   name        = "glue-rds-sqlserver-connection-tf"
		73 |   description = "Secuity Group for Glue-RDS-Connection"
		74 |   vpc_id      = data.aws_vpc.shared.id
		75 | 
		76 |   tags = merge(
		77 |     local.tags,
		78 |     {
		79 |       Resource_Type = "Secuity Group for Glue-RDS-Connection",
		80 |     }
		81 |   )
		82 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: module.buddi.module.landing_zone_security_groups.aws_security_group.this
	File: /modules/landing_zone/server_security_group/main.tf:7-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		7  | resource "aws_security_group" "this" {
		8  |   name        = "${var.supplier}-${var.user_name}-inbound-ips"
		9  |   description = "Allowed IP addresses for ${var.user_name} on ${var.supplier} server"
		10 |   vpc_id      = var.vpc_id
		11 | 
		12 |   lifecycle {
		13 |     create_before_destroy = true
		14 |   }
		15 | 
		16 |   tags = merge(
		17 |     var.local_tags,
		18 |     {
		19 |       supplier = var.user_name,
		20 |     },
		21 |   )
		22 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: module.capita.module.landing_zone_security_groups.aws_security_group.this
	File: /modules/landing_zone/server_security_group/main.tf:7-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		7  | resource "aws_security_group" "this" {
		8  |   name        = "${var.supplier}-${var.user_name}-inbound-ips"
		9  |   description = "Allowed IP addresses for ${var.user_name} on ${var.supplier} server"
		10 |   vpc_id      = var.vpc_id
		11 | 
		12 |   lifecycle {
		13 |     create_before_destroy = true
		14 |   }
		15 | 
		16 |   tags = merge(
		17 |     var.local_tags,
		18 |     {
		19 |       supplier = var.user_name,
		20 |     },
		21 |   )
		22 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: module.g4s.module.landing_zone_security_groups.aws_security_group.this
	File: /modules/landing_zone/server_security_group/main.tf:7-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		7  | resource "aws_security_group" "this" {
		8  |   name        = "${var.supplier}-${var.user_name}-inbound-ips"
		9  |   description = "Allowed IP addresses for ${var.user_name} on ${var.supplier} server"
		10 |   vpc_id      = var.vpc_id
		11 | 
		12 |   lifecycle {
		13 |     create_before_destroy = true
		14 |   }
		15 | 
		16 |   tags = merge(
		17 |     var.local_tags,
		18 |     {
		19 |       supplier = var.user_name,
		20 |     },
		21 |   )
		22 | }

dockerfile scan results:

Passed checks: 21, Failed checks: 2, Skipped checks: 0

Check: CKV_DOCKER_2: "Ensure that HEALTHCHECK instructions have been added to container images"
	FAILED for resource: /lambdas/update_log_table/Dockerfile.
	File: /lambdas/update_log_table/Dockerfile:1-9
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/docker-policies/docker-policy-index/ensure-that-healthcheck-instructions-have-been-added-to-container-images

		1 | FROM public.ecr.aws/lambda/python:3.11
		2 | 
		3 | COPY requirements.txt .
		4 | 
		5 | RUN pip install -r requirements.txt --target "${LAMBDA_TASK_ROOT}"
		6 | 
		7 | COPY update_log_table.py ${LAMBDA_TASK_ROOT}
		8 | 
		9 | CMD ["update_log_table.handler"]

Check: CKV_DOCKER_3: "Ensure that a user for the container has been created"
	FAILED for resource: /lambdas/update_log_table/Dockerfile.
	File: /lambdas/update_log_table/Dockerfile:1-9
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/docker-policies/docker-policy-index/ensure-that-a-user-for-the-container-has-been-created

		1 | FROM public.ecr.aws/lambda/python:3.11
		2 | 
		3 | COPY requirements.txt .
		4 | 
		5 | RUN pip install -r requirements.txt --target "${LAMBDA_TASK_ROOT}"
		6 | 
		7 | COPY update_log_table.py ${LAMBDA_TASK_ROOT}
		8 | 
		9 | CMD ["update_log_table.handler"]


checkov_exitcode=2

`CTFLint Scan` Failed

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
terraform/environments/electronic-monitoring-data/modules/step_function
terraform/environments/electronic-monitoring-data

*****************************

Running tflint in terraform/environments/electronic-monitoring-data/modules/step_function
Excluding the following checks: terraform_unused_declarations
2 issue(s) found:

Warning: terraform "required_version" attribute is required (terraform_required_version)

  on terraform/environments/electronic-monitoring-data/modules/step_function/main.tf line 1:

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_version.md

Warning: Missing version constraint for provider "aws" in `required_providers` (terraform_required_providers)

  on terraform/environments/electronic-monitoring-data/modules/step_function/main.tf line 93:
  93: resource "aws_cloudwatch_log_group" "this_log_group" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

tflint_exitcode=2

*****************************

Running tflint in terraform/environments/electronic-monitoring-data
Excluding the following checks: terraform_unused_declarations
2 issue(s) found:

Warning: Missing version constraint for provider "archive" in `required_providers` (terraform_required_providers)

  on terraform/environments/electronic-monitoring-data/data_store.tf line 151:
 151: data "archive_file" "summarise_zip_lambda" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

Warning: Missing version constraint for provider "random" in `required_providers` (terraform_required_providers)

  on terraform/environments/electronic-monitoring-data/server_backups.tf line 13:
  13: resource "random_password" "random_password" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

tflint_exitcode=4

`Trivy Scan` Failed

Show Output

*****************************

Trivy will check the following folders:
terraform/environments/electronic-monitoring-data/modules/step_function
terraform/environments/electronic-monitoring-data

*****************************

Running Trivy in terraform/environments/electronic-monitoring-data/modules/step_function
2024-10-21T20:33:38Z	INFO	[vulndb] Need to update DB
2024-10-21T20:33:38Z	INFO	[vulndb] Downloading vulnerability DB...
2024-10-21T20:33:38Z	INFO	[vulndb] Downloading artifact...	repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-21T20:33:41Z	INFO	[vulndb] Artifact successfully downloaded	repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-21T20:33:41Z	INFO	[vuln] Vulnerability scanning is enabled
2024-10-21T20:33:41Z	INFO	[misconfig] Misconfiguration scanning is enabled
2024-10-21T20:33:41Z	INFO	[misconfig] Need to update the built-in checks
2024-10-21T20:33:41Z	INFO	[misconfig] Downloading the built-in checks...
156.02 KiB / 156.02 KiB [---------------------------------------------------------] 100.00% ? p/s 0s2024-10-21T20:33:41Z	INFO	[secret] Secret scanning is enabled
2024-10-21T20:33:41Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-21T20:33:41Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-10-21T20:33:42Z	INFO	[terraform scanner] Scanning root module	file_path="."
2024-10-21T20:33:42Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="iam_policies, name, variable_dictionary"
2024-10-21T20:33:42Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_iam_role_policy_attachment.this_attachment" value="cty.NilVal"
2024-10-21T20:33:42Z	INFO	Number of language-specific files	num=0
2024-10-21T20:33:42Z	INFO	Detected config files	num=1
trivy_exitcode=0

*****************************

Running Trivy in terraform/environments/electronic-monitoring-data
2024-10-21T20:33:42Z	INFO	[vuln] Vulnerability scanning is enabled
2024-10-21T20:33:42Z	INFO	[misconfig] Misconfiguration scanning is enabled
2024-10-21T20:33:42Z	INFO	[secret] Secret scanning is enabled
2024-10-21T20:33:42Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-21T20:33:42Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-10-21T20:33:44Z	INFO	[terraform scanner] Scanning root module	file_path="."
2024-10-21T20:33:44Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="networking"
2024-10-21T20:33:45Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:33:45Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:33:45Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:33:45Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:33:45Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:33:45Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.aws_s3_object.user_public_keys" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.data.aws_subnet.local_account" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:33:46Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:33:47Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:33:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:33:48Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:33:52Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-bucket-encryption" range="s3.tf:1081-1100"
2024-10-21T20:33:52Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-logging" range="s3.tf:1081-1100"
2024-10-21T20:33:52Z	INFO	[terraform executor] Ignore finding	rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:281-286"
2024-10-21T20:33:52Z	INFO	[terraform executor] Ignore finding	rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:407-411"
2024-10-21T20:33:52Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-21T20:33:52Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-21T20:33:52Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-versioning" range="s3.tf:1081-1100"
2024-10-21T20:33:52Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:33:52Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:33:52Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:33:52Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:33:52Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:33:52Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:33:52Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:33:52Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:33:52Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:33:52Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:33:52Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=95ed3c3/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=568694e50e03630d99cb569eafa06a0b879a1239/main.tf:171-179"
2024-10-21T20:33:52Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="s3.tf:1081-1100"
2024-10-21T20:33:52Z	WARN	[pip] Unable to find python `site-packages` directory. License detection is skipped.	err="site-packages directory not found"
2024-10-21T20:33:53Z	INFO	Number of language-specific files	num=1
2024-10-21T20:33:53Z	INFO	[pip] Detecting vulnerabilities...
2024-10-21T20:33:53Z	INFO	Detected config files	num=17

lambdas/update_log_table/Dockerfile (dockerfile)
================================================
Tests: 20 (SUCCESSES: 19, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Specify at least 1 USER command in Dockerfile with non-root user as argument
════════════════════════════════════════
Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

See https://avd.aquasec.com/misconfig/ds002
────────────────────────────────────────


trivy_exitcode=1

github-actions · 2024-10-21T20:55:39Z

`Trivy Scan` Failed

Show Output

```hcl

Trivy will check the following folders:
terraform/environments/electronic-monitoring-data/modules/step_function
terraform/environments/electronic-monitoring-data

Running Trivy in terraform/environments/electronic-monitoring-data/modules/step_function
2024-10-21T20:55:03Z INFO [vulndb] Need to update DB
2024-10-21T20:55:03Z INFO [vulndb] Downloading vulnerability DB...
2024-10-21T20:55:03Z INFO [vulndb] Downloading artifact... repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-21T20:55:07Z INFO [vulndb] Artifact successfully downloaded repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-21T20:55:07Z INFO [vuln] Vulnerability scanning is enabled
2024-10-21T20:55:07Z INFO [misconfig] Misconfiguration scanning is enabled
2024-10-21T20:55:07Z INFO [misconfig] Need to update the built-in checks
2024-10-21T20:55:07Z INFO [misconfig] Downloading the built-in checks...
156.02 KiB / 156.02 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2024-10-21T20:55:07Z INFO [secret] Secret scanning is enabled
2024-10-21T20:55:07Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-21T20:55:07Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-10-21T20:55:08Z INFO [terraform scanner] Scanning root module file_path="."
2024-10-21T20:55:08Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="iam_policies, name, variable_dictionary"
2024-10-21T20:55:08Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_iam_role_policy_attachment.this_attachment" value="cty.NilVal"
2024-10-21T20:55:08Z INFO Number of language-specific files num=0
2024-10-21T20:55:08Z INFO Detected config files num=1
trivy_exitcode=0

Running Trivy in terraform/environments/electronic-monitoring-data
2024-10-21T20:55:08Z INFO [vuln] Vulnerability scanning is enabled
2024-10-21T20:55:08Z INFO [misconfig] Misconfiguration scanning is enabled
2024-10-21T20:55:08Z INFO [secret] Secret scanning is enabled
2024-10-21T20:55:08Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-21T20:55:08Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-10-21T20:55:10Z INFO [terraform scanner] Scanning root module file_path="."
2024-10-21T20:55:10Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="networking"
2024-10-21T20:55:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:55:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:55:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:55:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:55:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:55:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:55:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:55:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:55:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:55:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:55:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.aws_s3_object.user_public_keys" value="cty.NilVal"
2024-10-21T20:55:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.data.aws_subnet.local_account" value="cty.NilVal"
2024-10-21T20:55:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-21T20:55:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-21T20:55:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:55:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:55:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:55:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:55:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:55:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:55:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:55:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:55:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:55:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:55:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:55:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:55:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:55:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:55:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:55:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:55:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:55:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:55:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:55:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:55:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:55:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:55:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:55:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:55:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:55:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:55:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:55:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:55:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:55:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:55:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:55:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:55:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:55:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:55:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:55:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:55:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:55:15Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:55:15Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:55:15Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:55:15Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:55:15Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:55:15Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:55:15Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:55:15Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:55:15Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:55:15Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:55:15Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:55:15Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:55:15Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:55:15Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:55:15Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:55:15Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:55:15Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:55:15Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:55:15Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:55:15Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:55:15Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:55:15Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:55:15Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:55:15Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:55:15Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:55:15Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:55:15Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:55:15Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:55:15Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:55:15Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:55:15Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:55:15Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:55:15Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:55:15Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:55:15Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:55:15Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:55:15Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:55:15Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-logging-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:55:15Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:55:15Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:55:15Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:55:15Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:55:15Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:55:15Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:55:15Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:55:15Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:55:15Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:55:15Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:55:15Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:55:15Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:55:19Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:55:19Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:55:19Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:55:19Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:55:19Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:55:19Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:55:19Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:55:19Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:55:19Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:55:19Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:55:19Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:55:19Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=95ed3c3/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=568694e50e03630d99cb569eafa06a0b879a1239/main.tf:171-179"
2024-10-21T20:55:19Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="s3.tf:1081-1100"
2024-10-21T20:55:19Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-logging" range="s3.tf:1081-1100"
2024-10-21T20:55:19Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-bucket-encryption" range="s3.tf:1081-1100"
2024-10-21T20:55:19Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-21T20:55:19Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-21T20:55:19Z INFO [terraform executor] Ignore finding rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:281-286"
2024-10-21T20:55:19Z INFO [terraform executor] Ignore finding rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:407-411"
2024-10-21T20:55:19Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-versioning" range="s3.tf:1081-1100"
2024-10-21T20:55:19Z WARN [pip] Unable to find python site-packages directory. License detection is skipped. err="site-packages directory not found"
2024-10-21T20:55:19Z INFO Number of language-specific files num=1
2024-10-21T20:55:19Z INFO [pip] Detecting vulnerabilities...
2024-10-21T20:55:19Z INFO Detected config files num=17

lambdas/update_log_table/Dockerfile (dockerfile)

Tests: 20 (SUCCESSES: 19, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Specify at least 1 USER command in Dockerfile with non-root user as argument
════════════════════════════════════════
Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

See https://avd.aquasec.com/misconfig/ds002
────────────────────────────────────────

trivy_exitcode=1

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/electronic-monitoring-data/modules/step_function
terraform/environments/electronic-monitoring-data

*****************************

Running Checkov in terraform/environments/electronic-monitoring-data/modules/step_function
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
terraform scan results:

Passed checks: 43, Failed checks: 7, Skipped checks: 0

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.step_function_base_permissions
	File: /main.tf:40-49
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		40 | data "aws_iam_policy_document" "step_function_base_permissions" {
		41 |   statement {
		42 |     effect = "Allow"
		43 |     actions = [
		44 |       "sns:Publish",
		45 |       "sqs:SendMessage"
		46 |     ]
		47 |     resources = ["*"]
		48 |   }
		49 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.step_function_base_permissions
	File: /main.tf:40-49
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		40 | data "aws_iam_policy_document" "step_function_base_permissions" {
		41 |   statement {
		42 |     effect = "Allow"
		43 |     actions = [
		44 |       "sns:Publish",
		45 |       "sqs:SendMessage"
		46 |     ]
		47 |     resources = ["*"]
		48 |   }
		49 | }

Check: CKV_AWS_109: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: aws_iam_policy_document.this_log_key_document
	File: /main.tf:56-80
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-permissions-management-resource-exposure-without-constraint

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.this_log_key_document
	File: /main.tf:56-80
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.this_log_key_document
	File: /main.tf:56-80
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: aws_sfn_state_machine.this
	File: /main.tf:4-9
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 |   type       = var.type
		9 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: aws_sfn_state_machine.this
	File: /main.tf:4-9
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 |   type       = var.type
		9 | }


checkov_exitcode=1

*****************************

Running Checkov in terraform/environments/electronic-monitoring-data
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2024-10-21 20:55:30,653 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=95ed3c3:None (for external modules, the --download-external-modules flag is required)
2024-10-21 20:55:30,654 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060:None (for external modules, the --download-external-modules flag is required)
2024-10-21 20:55:30,654 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/secrets-manager/aws:1.3.0 (for external modules, the --download-external-modules flag is required)
2024-10-21 20:55:30,654 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=52a40b0:None (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 2321, Failed checks: 68, Skipped checks: 38

Check: CKV_AWS_26: "Ensure all data stored in the SNS topic is encrypted"
	FAILED for resource: aws_sns_topic.s3_events
	File: /data_store.tf:17-19
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-15

		17 | resource "aws_sns_topic" "s3_events" {
		18 |   name = "${module.s3-data-bucket.bucket.id}-object-created-topic"
		19 | }

Check: CKV_AWS_115: "Ensure that AWS Lambda function is configured for function-level concurrent execution limit"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-function-level-concurrent-execution-limit

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_173: "Check encryption settings for Lambda environmental variable"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-5

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_116: "Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-a-dead-letter-queue-dlq

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_272: "Ensure AWS Lambda function is configured to validate code-signing"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-272

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_117: "Ensure that AWS Lambda function is configured inside a VPC"
	FAILED for resource: aws_lambda_function.calculate_checksum_lambda
	File: /data_store.tf:82-98
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-inside-a-vpc-1

		82 | resource "aws_lambda_function" "calculate_checksum_lambda" {
		83 |   filename      = "lambdas/calculate_checksum_lambda.zip"
		84 |   function_name = "calculate-checksum-lambda"
		85 |   role          = aws_iam_role.calculate_checksum_lambda.arn
		86 |   handler       = "calculate_checksum_lambda.handler"
		87 |   runtime       = "python3.12"
		88 |   memory_size   = 4096
		89 |   timeout       = 900
		90 | 
		91 |   environment {
		92 |     variables = {
		93 |       Checksum = var.checksum_algorithm
		94 |     }
		95 |   }
		96 | 
		97 |   tags = local.tags
		98 | }

Check: CKV_AWS_115: "Ensure that AWS Lambda function is configured for function-level concurrent execution limit"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-function-level-concurrent-execution-limit

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_116: "Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-a-dead-letter-queue-dlq

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_272: "Ensure AWS Lambda function is configured to validate code-signing"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-272

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_117: "Ensure that AWS Lambda function is configured inside a VPC"
	FAILED for resource: aws_lambda_function.summarise_zip_lambda
	File: /data_store.tf:157-168
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-inside-a-vpc-1

		157 | resource "aws_lambda_function" "summarise_zip_lambda" {
		158 |   filename         = "lambdas/summarise_zip_lambda.zip"
		159 |   function_name    = "summarise-zip-lambda"
		160 |   role             = aws_iam_role.summarise_zip_lambda.arn
		161 |   handler          = "summarise_zip_lambda.handler"
		162 |   runtime          = "python3.12"
		163 |   timeout          = 900
		164 |   memory_size      = 1024
		165 |   layers           = ["arn:aws:lambda:eu-west-2:017000801446:layer:AWSLambdaPowertoolsPythonV2:67"]
		166 |   source_code_hash = data.archive_file.summarise_zip_lambda.output_base64sha256
		167 |   tags             = local.tags
		168 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group
	File: /dms_data_validation_glue_job.tf:58-61
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		58 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group" {
		59 |   name              = "dms-dv-glue-job"
		60 |   retention_in_days = 14
		61 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group
	File: /dms_data_validation_glue_job.tf:58-61
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		58 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group" {
		59 |   name              = "dms-dv-glue-job"
		60 |   retention_in_days = 14
		61 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group_v2
	File: /dms_data_validation_glue_job.tf:63-66
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		63 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group_v2" {
		64 |   name              = "dms-dv-glue-job-v2"
		65 |   retention_in_days = 14
		66 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.dms_dv_cw_log_group_v2
	File: /dms_data_validation_glue_job.tf:63-66
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		63 | resource "aws_cloudwatch_log_group" "dms_dv_cw_log_group_v2" {
		64 |   name              = "dms-dv-glue-job-v2"
		65 |   retention_in_days = 14
		66 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.rds_to_s3_parquet_migration
	File: /dms_data_validation_glue_job.tf:68-71
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		68 | resource "aws_cloudwatch_log_group" "rds_to_s3_parquet_migration" {
		69 |   name              = "rds-to-s3-parquet-migration"
		70 |   retention_in_days = 14
		71 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.rds_to_s3_parquet_migration
	File: /dms_data_validation_glue_job.tf:68-71
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		68 | resource "aws_cloudwatch_log_group" "rds_to_s3_parquet_migration" {
		69 |   name              = "rds-to-s3-parquet-migration"
		70 |   retention_in_days = 14
		71 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.resizing_parquet_files
	File: /dms_data_validation_glue_job.tf:73-76
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		73 | resource "aws_cloudwatch_log_group" "resizing_parquet_files" {
		74 |   name              = "resizing-parquet-files"
		75 |   retention_in_days = 14
		76 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.resizing_parquet_files
	File: /dms_data_validation_glue_job.tf:73-76
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		73 | resource "aws_cloudwatch_log_group" "resizing_parquet_files" {
		74 |   name              = "resizing-parquet-files"
		75 |   retention_in_days = 14
		76 | }

Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.dms_dv_glue_job_v2
	File: /dms_data_validation_glue_job.tf:79-132
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.dms_dv_glue_job_v4d
	File: /dms_data_validation_glue_job.tf:140-193
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.rds_to_s3_parquet_migration
	File: /dms_data_validation_glue_job.tf:196-260
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.rds_to_s3_parquet_migration_monthly
	File: /dms_data_validation_glue_job.tf:264-315
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.resizing_parquet_files
	File: /dms_data_validation_glue_job.tf:318-370
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_job.catalog_dv_table_glue_job
	File: /dms_data_validation_glue_job.tf:373-401
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		373 | resource "aws_glue_job" "catalog_dv_table_glue_job" {
		374 |   name              = "catalog-dv-table-glue-job"
		375 |   description       = "Python script uses Boto3-Athena-Client to run sql-statements"
		376 |   role_arn          = aws_iam_role.dms_dv_glue_job_iam_role.arn
		377 |   glue_version      = "4.0"
		378 |   worker_type       = "G.1X"
		379 |   number_of_workers = 2
		380 |   default_arguments = {
		381 |     "--parquet_output_bucket_name"       = module.s3-dms-data-validation-bucket.bucket.id
		382 |     "--glue_catalog_db_name"             = aws_glue_catalog_database.dms_dv_glue_catalog_db.name
		383 |     "--glue_catalog_tbl_name"            = "glue_df_output"
		384 |     "--continuous-log-logGroup"          = aws_cloudwatch_log_group.dms_dv_cw_log_group.name
		385 |     "--enable-continuous-cloudwatch-log" = "true"
		386 |     "--enable-continuous-log-filter"     = "true"
		387 |     "--enable-metrics"                   = ""
		388 |   }
		389 |   command {
		390 |     python_version  = "3"
		391 |     script_location = "s3://${module.s3-glue-job-script-bucket.bucket.id}/create_or_replace_dv_table.py"
		392 |   }
		393 | 
		394 |   tags = merge(
		395 |     local.tags,
		396 |     {
		397 |       Resource_Type = "Py script as glue-job that creates dv table / refreshes its partitions",
		398 |     }
		399 |   )
		400 | 
		401 | }

Check: CKV_AWS_195: "Ensure Glue component has a security configuration associated"
	FAILED for resource: aws_glue_crawler.rds_sqlserver_db_glue_crawler
	File: /dms_glue_crawler.tf:35-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-glue-component-is-associated-with-a-security-configuration

		35 | resource "aws_glue_crawler" "rds_sqlserver_db_glue_crawler" {
		36 |   name          = "rds-sqlserver-${aws_db_instance.database_2022.identifier}-tf"
		37 |   role          = aws_iam_role.dms_dv_glue_job_iam_role.arn
		38 |   database_name = aws_glue_catalog_database.rds_sqlserver_glue_catalog_db.name
		39 |   description   = "Crawler to fetch database names"
		40 |   #   table_prefix  = "your_table_prefix"
		41 | 
		42 |   jdbc_target {
		43 |     connection_name = aws_glue_connection.glue_rds_sqlserver_db_connection.name
		44 |     path            = "%"
		45 |   }
		46 |   tags = merge(
		47 |     local.tags,
		48 |     {
		49 |       Resource_Type = "RDS-SQLServer Glue-Crawler for DMS",
		50 |     }
		51 |   )
		52 | 
		53 |   # provisioner "local-exec" {
		54 |   #   command = "aws glue start-crawler --name ${self.name}"
		55 |   # }
		56 | }

Check: CKV_AWS_212: "Ensure DMS replication instance is encrypted by KMS using a customer managed Key (CMK)"
	FAILED for resource: aws_dms_replication_instance.dms_replication_instance
	File: /dms_replication_instance.tf:24-55
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-ebs-volume-is-encrypted-by-key-management-service-kms-using-a-customer-managed-key-cmk

		24 | resource "aws_dms_replication_instance" "dms_replication_instance" {
		25 |   allocated_storage          = var.dms_allocated_storage_gib
		26 |   apply_immediately          = true
		27 |   auto_minor_version_upgrade = true
		28 |   availability_zone          = var.dms_availability_zone
		29 |   engine_version             = var.dms_engine_version
		30 |   #   kms_key_arn                  = "arn:aws:kms:eu-west-2:800964199911:key/b7f54acb-16a3-4958-9340-3bdf5f5842d8"
		31 |   multi_az = false
		32 |   #   preferred_maintenance_window = "sun:10:30-sun:14:30"
		33 |   publicly_accessible         = false
		34 |   replication_instance_class  = var.dms_replication_instance_class
		35 |   replication_instance_id     = "dms-replication-instance-tf"
		36 |   replication_subnet_group_id = aws_dms_replication_subnet_group.dms_replication_subnet_group.id
		37 | 
		38 |   tags = merge(
		39 |     local.tags,
		40 |     {
		41 |       Resource_Type = "DMS Replication Instance",
		42 |     }
		43 |   )
		44 | 
		45 |   vpc_security_group_ids = [
		46 |     aws_security_group.dms_ri_security_group.id,
		47 |   ]
		48 | 
		49 |   depends_on = [
		50 |     aws_iam_role.dms_vpc_role,
		51 |     aws_iam_role.dms_cloudwatch_logs_role,
		52 |     aws_iam_role.dms_endpoint_role
		53 |   ]
		54 | 
		55 | }

Check: CKV_AWS_260: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 80"
	FAILED for resource: aws_vpc_security_group_ingress_rule.glue_rds_conn_inbound
	File: /dms_security_groups.tf:95-103
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-aws-security-groups-do-not-allow-ingress-from-00000-to-port-80

		95  | resource "aws_vpc_security_group_ingress_rule" "glue_rds_conn_inbound" {
		96  |   security_group_id = aws_security_group.glue_rds_conn_security_group.id
		97  | 
		98  |   referenced_security_group_id = aws_security_group.glue_rds_conn_security_group.id
		99  |   ip_protocol                  = "tcp"
		100 |   from_port                    = 0
		101 |   to_port                      = 65535
		102 |   description                  = "Required ports open for Glue-RDS-Connection"
		103 | }

Check: CKV_AWS_24: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 22"
	FAILED for resource: aws_vpc_security_group_ingress_rule.glue_rds_conn_inbound
	File: /dms_security_groups.tf:95-103
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-1-port-security

		95  | resource "aws_vpc_security_group_ingress_rule" "glue_rds_conn_inbound" {
		96  |   security_group_id = aws_security_group.glue_rds_conn_security_group.id
		97  | 
		98  |   referenced_security_group_id = aws_security_group.glue_rds_conn_security_group.id
		99  |   ip_protocol                  = "tcp"
		100 |   from_port                    = 0
		101 |   to_port                      = 65535
		102 |   description                  = "Required ports open for Glue-RDS-Connection"
		103 | }

Check: CKV_AWS_25: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389"
	FAILED for resource: aws_vpc_security_group_ingress_rule.glue_rds_conn_inbound
	File: /dms_security_groups.tf:95-103
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-2

		95  | resource "aws_vpc_security_group_ingress_rule" "glue_rds_conn_inbound" {
		96  |   security_group_id = aws_security_group.glue_rds_conn_security_group.id
		97  | 
		98  |   referenced_security_group_id = aws_security_group.glue_rds_conn_security_group.id
		99  |   ip_protocol                  = "tcp"
		100 |   from_port                    = 0
		101 |   to_port                      = 65535
		102 |   description                  = "Required ports open for Glue-RDS-Connection"
		103 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.glue_notebook_ec2_iam_policy_document
	File: /glue_data.tf:96-111
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		96  | data "aws_iam_policy_document" "glue_notebook_ec2_iam_policy_document" {
		97  |   statement {
		98  |     effect = "Allow"
		99  |     actions = [
		100 |       "ec2:CreateNetworkInterface",
		101 |       "ec2:DescribeNetworkInterfaces",
		102 |       "ec2:DeleteNetworkInterface",
		103 |       "ec2:DescribeVpcEndpoints",
		104 |       "ec2:DescribeSubnets",
		105 |       "ec2:DescribeVpcAttribute",
		106 |       "ec2:DescribeRouteTables",
		107 |       "ec2:DescribeSecurityGroups"
		108 |     ]
		109 |     resources = ["*"]
		110 |   }
		111 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.glue_notebook_ec2_iam_policy_document
	File: /glue_data.tf:96-111
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		96  | data "aws_iam_policy_document" "glue_notebook_ec2_iam_policy_document" {
		97  |   statement {
		98  |     effect = "Allow"
		99  |     actions = [
		100 |       "ec2:CreateNetworkInterface",
		101 |       "ec2:DescribeNetworkInterfaces",
		102 |       "ec2:DeleteNetworkInterface",
		103 |       "ec2:DescribeVpcEndpoints",
		104 |       "ec2:DescribeSubnets",
		105 |       "ec2:DescribeVpcAttribute",
		106 |       "ec2:DescribeRouteTables",
		107 |       "ec2:DescribeSecurityGroups"
		108 |     ]
		109 |     resources = ["*"]
		110 |   }
		111 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.load_json_table_s3_policy_document
	File: /lambdas_iam.tf:430-487
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.load_json_table_s3_policy_document
	File: /lambdas_iam.tf:430-487
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.db_glue_connection
	File: /lambdas_secrets.tf:1-3
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		1 | resource "aws_secretsmanager_secret" "db_glue_connection" {
		2 |   name = "db_glue_connection"
		3 | }

Check: CKV_AWS_296: "Ensure DMS endpoint uses Customer Managed Key (CMK)"
	FAILED for resource: module.dms_task.aws_dms_endpoint.dms_rds_source
	File: /modules/dms/endpoints_rds_s3.tf:2-23
	Calling File: /dms_main.tf:1-39
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-296

		2  | resource "aws_dms_endpoint" "dms_rds_source" {
		3  | 
		4  |   #   certificate_arn             = ""
		5  |   database_name = var.database_name
		6  |   endpoint_id   = "rds-mssql-${replace(var.database_name, "_", "-")}-tf"
		7  |   endpoint_type = "source"
		8  |   engine_name   = "sqlserver"
		9  |   #   extra_connection_attributes = ""
		10 |   #   kms_key_arn                 = aws_db_instance.database_2022.kms_key_id
		11 |   password    = var.rds_db_instance_pasword
		12 |   port        = var.rds_db_instance_port
		13 |   server_name = var.rds_db_server_name
		14 |   ssl_mode    = "require"
		15 |   username    = var.rds_db_username
		16 | 
		17 |   tags = merge(
		18 |     var.local_tags,
		19 |     {
		20 |       Resource_Type = "DMS Source Endpoint - RDS MSSQL",
		21 |     },
		22 |   )
		23 | }

Check: CKV_AWS_298: "Ensure DMS S3 uses Customer Managed Key (CMK)"
	FAILED for resource: module.dms_task.aws_dms_s3_endpoint.dms_s3_parquet_target
	File: /modules/dms/endpoints_rds_s3.tf:28-84
	Calling File: /dms_main.tf:1-39
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-298

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: module.athena_layer.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-9
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 |   type       = var.type
		9 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: module.athena_layer.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-9
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 |   type       = var.type
		9 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.athena_layer.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:40-49
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		40 | data "aws_iam_policy_document" "step_function_base_permissions" {
		41 |   statement {
		42 |     effect = "Allow"
		43 |     actions = [
		44 |       "sns:Publish",
		45 |       "sqs:SendMessage"
		46 |     ]
		47 |     resources = ["*"]
		48 |   }
		49 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.athena_layer.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:40-49
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		40 | data "aws_iam_policy_document" "step_function_base_permissions" {
		41 |   statement {
		42 |     effect = "Allow"
		43 |     actions = [
		44 |       "sns:Publish",
		45 |       "sqs:SendMessage"
		46 |     ]
		47 |     resources = ["*"]
		48 |   }
		49 | }

Check: CKV_AWS_109: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: module.athena_layer.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-permissions-management-resource-exposure-without-constraint

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.athena_layer.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.athena_layer.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:5-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_285: "Ensure State Machine has execution history logging enabled"
	FAILED for resource: module.send_database_to_ap.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-9
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-285

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 |   type       = var.type
		9 | }

Check: CKV_AWS_284: "Ensure State Machine has X-Ray tracing enabled"
	FAILED for resource: module.send_database_to_ap.aws_sfn_state_machine.this
	File: /modules/step_function/main.tf:4-9
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-284

		4 | resource "aws_sfn_state_machine" "this" {
		5 |   name       = var.name
		6 |   role_arn   = aws_iam_role.step_function_role.arn
		7 |   definition = templatefile("step_function_definitions/${var.name}.json.tmpl", var.variable_dictionary)
		8 |   type       = var.type
		9 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.send_database_to_ap.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:40-49
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		40 | data "aws_iam_policy_document" "step_function_base_permissions" {
		41 |   statement {
		42 |     effect = "Allow"
		43 |     actions = [
		44 |       "sns:Publish",
		45 |       "sqs:SendMessage"
		46 |     ]
		47 |     resources = ["*"]
		48 |   }
		49 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.send_database_to_ap.aws_iam_policy_document.step_function_base_permissions
	File: /modules/step_function/main.tf:40-49
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		40 | data "aws_iam_policy_document" "step_function_base_permissions" {
		41 |   statement {
		42 |     effect = "Allow"
		43 |     actions = [
		44 |       "sns:Publish",
		45 |       "sqs:SendMessage"
		46 |     ]
		47 |     resources = ["*"]
		48 |   }
		49 | }

Check: CKV_AWS_109: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	FAILED for resource: module.send_database_to_ap.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-permissions-management-resource-exposure-without-constraint

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.send_database_to_ap.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: module.send_database_to_ap.aws_iam_policy_document.this_log_key_document
	File: /modules/step_function/main.tf:56-80
	Calling File: /step_functions_main.tf:20-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		56 | data "aws_iam_policy_document" "this_log_key_document" {
		57 |   statement {
		58 |     sid    = "EnableIAMUserPermissions"
		59 |     effect = "Allow"
		60 |     principals {
		61 |       type        = "AWS"
		62 |       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
		63 |     }
		64 |     actions   = ["kms:*"]
		65 |     resources = ["*"]
		66 |   }
		67 | 
		68 |   statement {
		69 |     sid    = "EnableLogServicePermissions"
		70 |     effect = "Allow"
		71 |     principals {
		72 |       type        = "Service"
		73 |       identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
		74 |     }
		75 |     actions = [
		76 |       "kms:*",
		77 |     ]
		78 |     resources = ["*"]
		79 |   }
		80 | }

Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.db_password
	File: /server_backups.tf:4-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		4 | resource "aws_secretsmanager_secret" "db_password" {
		5 |   name = "db_password"
		6 | }

Check: CKV_AWS_354: "Ensure RDS Performance Insights are encrypted using KMS CMKs"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-354

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_157: "Ensure that RDS instances have Multi-AZ enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-73

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_118: "Ensure that enhanced monitoring is enabled for Amazon RDS instances"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/ensure-that-enhanced-monitoring-is-enabled-for-amazon-rds-instances

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_353: "Ensure that RDS instances have performance insights enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-353

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_293: "Ensure that AWS database instances have deletion protection enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-293

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_129: "Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-that-respective-logs-of-amazon-relational-database-service-amazon-rds-are-enabled

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: aws_iam_policy_document.send_database_to_ap
	File: /step_functions_iam.tf:44-118
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-iam-policies-do-not-allow-write-access-without-constraint

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_AWS_356: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	FAILED for resource: aws_iam_policy_document.send_database_to_ap
	File: /step_functions_iam.tf:44-118
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-356

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.db_glue_connection
	File: /lambdas_secrets.tf:1-3
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		1 | resource "aws_secretsmanager_secret" "db_glue_connection" {
		2 |   name = "db_glue_connection"
		3 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.db_password
	File: /server_backups.tf:4-6
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		4 | resource "aws_secretsmanager_secret" "db_password" {
		5 |   name = "db_password"
		6 | }

Check: CKV2_AWS_60: "Ensure RDS instance with copy tags to snapshots is enabled"
	FAILED for resource: aws_db_instance.database_2022
	File: /server_backups.tf:21-56
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-60

		21 | resource "aws_db_instance" "database_2022" {
		22 |   #   count = local.is-production ? 1 : 0
		23 | 
		24 |   identifier    = "database-v2022"
		25 |   license_model = "license-included"
		26 |   username      = "admin"
		27 |   password      = aws_secretsmanager_secret_version.db_password.secret_string
		28 | 
		29 |   engine         = "sqlserver-se"
		30 |   engine_version = "16.00.4105.2.v1"
		31 |   instance_class = "db.m5.large"
		32 | 
		33 |   storage_type          = "gp2"
		34 |   allocated_storage     = 2100
		35 |   max_allocated_storage = 2500
		36 |   storage_encrypted     = true
		37 | 
		38 |   multi_az = false
		39 | 
		40 |   db_subnet_group_name   = aws_db_subnet_group.db.id
		41 |   vpc_security_group_ids = [aws_security_group.db.id]
		42 |   port                   = 1433
		43 | 
		44 |   auto_minor_version_upgrade = true
		45 |   skip_final_snapshot        = true
		46 |   maintenance_window         = "Mon:00:00-Mon:03:00"
		47 |   deletion_protection        = false
		48 | 
		49 |   option_group_name = aws_db_option_group.sqlserver_backup_restore_2022.name
		50 | 
		51 |   iam_database_authentication_enabled = false
		52 | 
		53 |   apply_immediately = true
		54 | 
		55 |   tags = local.tags
		56 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: aws_security_group.glue_rds_conn_security_group
	File: /dms_security_groups.tf:71-82
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		71 | resource "aws_security_group" "glue_rds_conn_security_group" {
		72 |   name        = "glue-rds-sqlserver-connection-tf"
		73 |   description = "Secuity Group for Glue-RDS-Connection"
		74 |   vpc_id      = data.aws_vpc.shared.id
		75 | 
		76 |   tags = merge(
		77 |     local.tags,
		78 |     {
		79 |       Resource_Type = "Secuity Group for Glue-RDS-Connection",
		80 |     }
		81 |   )
		82 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: module.buddi.module.landing_zone_security_groups.aws_security_group.this
	File: /modules/landing_zone/server_security_group/main.tf:7-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		7  | resource "aws_security_group" "this" {
		8  |   name        = "${var.supplier}-${var.user_name}-inbound-ips"
		9  |   description = "Allowed IP addresses for ${var.user_name} on ${var.supplier} server"
		10 |   vpc_id      = var.vpc_id
		11 | 
		12 |   lifecycle {
		13 |     create_before_destroy = true
		14 |   }
		15 | 
		16 |   tags = merge(
		17 |     var.local_tags,
		18 |     {
		19 |       supplier = var.user_name,
		20 |     },
		21 |   )
		22 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: module.capita.module.landing_zone_security_groups.aws_security_group.this
	File: /modules/landing_zone/server_security_group/main.tf:7-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		7  | resource "aws_security_group" "this" {
		8  |   name        = "${var.supplier}-${var.user_name}-inbound-ips"
		9  |   description = "Allowed IP addresses for ${var.user_name} on ${var.supplier} server"
		10 |   vpc_id      = var.vpc_id
		11 | 
		12 |   lifecycle {
		13 |     create_before_destroy = true
		14 |   }
		15 | 
		16 |   tags = merge(
		17 |     var.local_tags,
		18 |     {
		19 |       supplier = var.user_name,
		20 |     },
		21 |   )
		22 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: module.g4s.module.landing_zone_security_groups.aws_security_group.this
	File: /modules/landing_zone/server_security_group/main.tf:7-22
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		7  | resource "aws_security_group" "this" {
		8  |   name        = "${var.supplier}-${var.user_name}-inbound-ips"
		9  |   description = "Allowed IP addresses for ${var.user_name} on ${var.supplier} server"
		10 |   vpc_id      = var.vpc_id
		11 | 
		12 |   lifecycle {
		13 |     create_before_destroy = true
		14 |   }
		15 | 
		16 |   tags = merge(
		17 |     var.local_tags,
		18 |     {
		19 |       supplier = var.user_name,
		20 |     },
		21 |   )
		22 | }

dockerfile scan results:

Passed checks: 21, Failed checks: 2, Skipped checks: 0

Check: CKV_DOCKER_2: "Ensure that HEALTHCHECK instructions have been added to container images"
	FAILED for resource: /lambdas/update_log_table/Dockerfile.
	File: /lambdas/update_log_table/Dockerfile:1-9
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/docker-policies/docker-policy-index/ensure-that-healthcheck-instructions-have-been-added-to-container-images

		1 | FROM public.ecr.aws/lambda/python:3.11
		2 | 
		3 | COPY requirements.txt .
		4 | 
		5 | RUN pip install -r requirements.txt --target "${LAMBDA_TASK_ROOT}"
		6 | 
		7 | COPY update_log_table.py ${LAMBDA_TASK_ROOT}
		8 | 
		9 | CMD ["update_log_table.handler"]

Check: CKV_DOCKER_3: "Ensure that a user for the container has been created"
	FAILED for resource: /lambdas/update_log_table/Dockerfile.
	File: /lambdas/update_log_table/Dockerfile:1-9
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/docker-policies/docker-policy-index/ensure-that-a-user-for-the-container-has-been-created

		1 | FROM public.ecr.aws/lambda/python:3.11
		2 | 
		3 | COPY requirements.txt .
		4 | 
		5 | RUN pip install -r requirements.txt --target "${LAMBDA_TASK_ROOT}"
		6 | 
		7 | COPY update_log_table.py ${LAMBDA_TASK_ROOT}
		8 | 
		9 | CMD ["update_log_table.handler"]


checkov_exitcode=2

`CTFLint Scan` Failed

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
terraform/environments/electronic-monitoring-data/modules/step_function
terraform/environments/electronic-monitoring-data

*****************************

Running tflint in terraform/environments/electronic-monitoring-data/modules/step_function
Excluding the following checks: terraform_unused_declarations
2 issue(s) found:

Warning: terraform "required_version" attribute is required (terraform_required_version)

  on terraform/environments/electronic-monitoring-data/modules/step_function/main.tf line 1:

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_version.md

Warning: Missing version constraint for provider "aws" in `required_providers` (terraform_required_providers)

  on terraform/environments/electronic-monitoring-data/modules/step_function/main.tf line 93:
  93: resource "aws_cloudwatch_log_group" "this_log_group" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

tflint_exitcode=2

*****************************

Running tflint in terraform/environments/electronic-monitoring-data
Excluding the following checks: terraform_unused_declarations
2 issue(s) found:

Warning: Missing version constraint for provider "archive" in `required_providers` (terraform_required_providers)

  on terraform/environments/electronic-monitoring-data/data_store.tf line 151:
 151: data "archive_file" "summarise_zip_lambda" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

Warning: Missing version constraint for provider "random" in `required_providers` (terraform_required_providers)

  on terraform/environments/electronic-monitoring-data/server_backups.tf line 13:
  13: resource "random_password" "random_password" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

tflint_exitcode=4

`Trivy Scan` Failed

Show Output

*****************************

Trivy will check the following folders:
terraform/environments/electronic-monitoring-data/modules/step_function
terraform/environments/electronic-monitoring-data

*****************************

Running Trivy in terraform/environments/electronic-monitoring-data/modules/step_function
2024-10-21T20:55:03Z	INFO	[vulndb] Need to update DB
2024-10-21T20:55:03Z	INFO	[vulndb] Downloading vulnerability DB...
2024-10-21T20:55:03Z	INFO	[vulndb] Downloading artifact...	repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-21T20:55:07Z	INFO	[vulndb] Artifact successfully downloaded	repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-21T20:55:07Z	INFO	[vuln] Vulnerability scanning is enabled
2024-10-21T20:55:07Z	INFO	[misconfig] Misconfiguration scanning is enabled
2024-10-21T20:55:07Z	INFO	[misconfig] Need to update the built-in checks
2024-10-21T20:55:07Z	INFO	[misconfig] Downloading the built-in checks...
156.02 KiB / 156.02 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2024-10-21T20:55:07Z	INFO	[secret] Secret scanning is enabled
2024-10-21T20:55:07Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-21T20:55:07Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-10-21T20:55:08Z	INFO	[terraform scanner] Scanning root module	file_path="."
2024-10-21T20:55:08Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="iam_policies, name, variable_dictionary"
2024-10-21T20:55:08Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_iam_role_policy_attachment.this_attachment" value="cty.NilVal"
2024-10-21T20:55:08Z	INFO	Number of language-specific files	num=0
2024-10-21T20:55:08Z	INFO	Detected config files	num=1
trivy_exitcode=0

*****************************

Running Trivy in terraform/environments/electronic-monitoring-data
2024-10-21T20:55:08Z	INFO	[vuln] Vulnerability scanning is enabled
2024-10-21T20:55:08Z	INFO	[misconfig] Misconfiguration scanning is enabled
2024-10-21T20:55:08Z	INFO	[secret] Secret scanning is enabled
2024-10-21T20:55:08Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-21T20:55:08Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-10-21T20:55:10Z	INFO	[terraform scanner] Scanning root module	file_path="."
2024-10-21T20:55:10Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="networking"
2024-10-21T20:55:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:55:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:55:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:55:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:55:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:55:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_metadata_from_rds_lambda.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:55:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:55:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:55:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:55:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.query_output_to_list.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:55:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.aws_s3_object.user_public_keys" value="cty.NilVal"
2024-10-21T20:55:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.data.aws_subnet.local_account" value="cty.NilVal"
2024-10-21T20:55:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-21T20:55:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.dynamic.tag" value="cty.NilVal"
2024-10-21T20:55:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:55:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:55:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:55:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:55:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:55:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:55:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:55:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:55:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:55:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:55:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:55:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.rds_bastion.module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:55:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:55:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:55:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:55:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:55:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:55:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:55:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:55:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:55:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:55:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:55:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:55:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-athena-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:55:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:55:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:55:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:55:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:55:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:55:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:55:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:55:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:55:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:55:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:55:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:55:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-clamav-definitions-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-data-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-data-validation-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-premigrate-assess-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-dms-target-store-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.create_athena_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.get_file_keys_for_table.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:55:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-specials-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:55:15Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:55:15Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:55:15Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:55:15Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:55:15Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:55:15Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:55:15Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:55:15Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:55:15Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:55:15Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:55:15Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:55:15Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-glue-job-script-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:55:15Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:55:15Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:55:15Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:55:15Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:55:15Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:55:15Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:55:15Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:55:15Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:55:15Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:55:15Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:55:15Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:55:15Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-json-directory-structure-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:55:15Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:55:15Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.output_file_structure_as_json_from_zip.dynamic.vpc_config" value="cty.NilVal"
2024-10-21T20:55:15Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:55:15Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:55:15Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:55:15Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:55:15Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:55:15Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:55:15Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:55:15Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:55:15Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:55:15Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:55:15Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:55:15Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-logging-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:55:15Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:55:15Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:55:15Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:55:15Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:55:15Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:55:15Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:55:15Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-21T20:55:15Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.transition" value="cty.NilVal"
2024-10-21T20:55:15Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-21T20:55:15Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-21T20:55:15Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.principals" value="cty.NilVal"
2024-10-21T20:55:15Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-fms-general-landing-bucket.module.this-bucket.dynamic.condition" value="cty.NilVal"
2024-10-21T20:55:19Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:55:19Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:55:19Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:55:19Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:55:19Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:55:19Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:55:19Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:55:19Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:55:19Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:55:19Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:55:19Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=f759060/main.tf:153-163"
2024-10-21T20:55:19Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=95ed3c3/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=568694e50e03630d99cb569eafa06a0b879a1239/main.tf:171-179"
2024-10-21T20:55:19Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="s3.tf:1081-1100"
2024-10-21T20:55:19Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-logging" range="s3.tf:1081-1100"
2024-10-21T20:55:19Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-bucket-encryption" range="s3.tf:1081-1100"
2024-10-21T20:55:19Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-21T20:55:19Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-user-attached-policies" range="modules/landing_bucket_iam_user_access/main.tf:2-10"
2024-10-21T20:55:19Z	INFO	[terraform executor] Ignore finding	rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:281-286"
2024-10-21T20:55:19Z	INFO	[terraform executor] Ignore finding	rule="aws-cloudwatch-log-group-customer-key" range="modules/api_step_function/main.tf:407-411"
2024-10-21T20:55:19Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-versioning" range="s3.tf:1081-1100"
2024-10-21T20:55:19Z	WARN	[pip] Unable to find python `site-packages` directory. License detection is skipped.	err="site-packages directory not found"
2024-10-21T20:55:19Z	INFO	Number of language-specific files	num=1
2024-10-21T20:55:19Z	INFO	[pip] Detecting vulnerabilities...
2024-10-21T20:55:19Z	INFO	Detected config files	num=17

lambdas/update_log_table/Dockerfile (dockerfile)
================================================
Tests: 20 (SUCCESSES: 19, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Specify at least 1 USER command in Dockerfile with non-root user as argument
════════════════════════════════════════
Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

See https://avd.aquasec.com/misconfig/ds002
────────────────────────────────────────


trivy_exitcode=1

step function express

2d1c252

matt-heery requested review from a team as code owners October 21, 2024 20:03

github-actions bot added the environments-repository Used to exclude PRs from this repo in our Slack PR update label Oct 21, 2024

matt-heery had a problem deploying to electronic-monitoring-data-development October 21, 2024 20:05 — with GitHub Actions Failure

matt-heery had a problem deploying to electronic-monitoring-data-test October 21, 2024 20:06 — with GitHub Actions Failure

pricemg previously approved these changes Oct 21, 2024

View reviewed changes

create dummy step func

018e78d

matt-heery dismissed pricemg’s stale review via 018e78d October 21, 2024 20:16

copy of definition

c592f55

matt-heery had a problem deploying to electronic-monitoring-data-development October 21, 2024 20:24 — with GitHub Actions Failure

matt-heery had a problem deploying to electronic-monitoring-data-test October 21, 2024 20:24 — with GitHub Actions Failure

matt-heery added 2 commits October 21, 2024 21:29

rename

11ed6a5

reexpress

c2e1d80

matt-heery had a problem deploying to electronic-monitoring-data-development October 21, 2024 20:33 — with GitHub Actions Failure

matt-heery had a problem deploying to electronic-monitoring-data-test October 21, 2024 20:33 — with GitHub Actions Failure

delete it all!

a7a162b

madhu-k-sr2 approved these changes Nov 1, 2024

View reviewed changes

matt-heery merged commit 164889c into main Nov 1, 2024
10 of 14 checks passed

matt-heery deleted the express-step-func branch November 1, 2024 14:49

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

step function express #8351

step function express #8351

matt-heery commented Oct 21, 2024

github-actions bot commented Oct 21, 2024

lambdas/update_log_table/Dockerfile (dockerfile)

pricemg left a comment

github-actions bot commented Oct 21, 2024

lambdas/update_log_table/Dockerfile (dockerfile)

github-actions bot commented Oct 21, 2024

lambdas/update_log_table/Dockerfile (dockerfile)

github-actions bot commented Oct 21, 2024

lambdas/update_log_table/Dockerfile (dockerfile)

github-actions bot commented Oct 21, 2024

lambdas/update_log_table/Dockerfile (dockerfile)

github-actions bot commented Oct 21, 2024

lambdas/update_log_table/Dockerfile (dockerfile)

step function express #8351

step function express #8351

Conversation

matt-heery commented Oct 21, 2024

github-actions bot commented Oct 21, 2024

Trivy Scan Failed

lambdas/update_log_table/Dockerfile (dockerfile)

CTFLint Scan Failed

Trivy Scan Failed

pricemg left a comment

Choose a reason for hiding this comment

github-actions bot commented Oct 21, 2024

Trivy Scan Failed

lambdas/update_log_table/Dockerfile (dockerfile)

CTFLint Scan Failed

Trivy Scan Failed

github-actions bot commented Oct 21, 2024

Trivy Scan Failed

lambdas/update_log_table/Dockerfile (dockerfile)

CTFLint Scan Failed

Trivy Scan Failed

github-actions bot commented Oct 21, 2024

Trivy Scan Failed

lambdas/update_log_table/Dockerfile (dockerfile)

CTFLint Scan Failed

Trivy Scan Failed

github-actions bot commented Oct 21, 2024

Trivy Scan Failed

lambdas/update_log_table/Dockerfile (dockerfile)

CTFLint Scan Failed

Trivy Scan Failed

github-actions bot commented Oct 21, 2024

Trivy Scan Failed

lambdas/update_log_table/Dockerfile (dockerfile)

CTFLint Scan Failed

Trivy Scan Failed

`Trivy Scan` Failed

`CTFLint Scan` Failed

`Trivy Scan` Failed

`Trivy Scan` Failed

`CTFLint Scan` Failed

`Trivy Scan` Failed

`Trivy Scan` Failed

`CTFLint Scan` Failed

`Trivy Scan` Failed

`Trivy Scan` Failed

`CTFLint Scan` Failed

`Trivy Scan` Failed

`Trivy Scan` Failed

`CTFLint Scan` Failed

`Trivy Scan` Failed

`Trivy Scan` Failed

`CTFLint Scan` Failed

`Trivy Scan` Failed