Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

👋🔥 Remove JML Lambda from Data Platform Apps and Tools #9242

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
Open

👋🔥 Remove JML Lambda from Data Platform Apps and Tools #9242

wants to merge 3 commits into from
+0 −107

Conversation

Gary-H9
Copy link
Contributor

@Gary-H9 Gary-H9 commented Jan 7, 2025

The purpose of this PR is to remove the JML Lambda and associated components from the DPAT AWS Account as per this ticket.

@Gary-H9 Gary-H9 requested review from a team as code owners January 7, 2025 16:20
@github-actions github-actions bot added the environments-repository Used to exclude PRs from this repo in our Slack PR update label Jan 7, 2025
modernisation-platform-ci
modernisation-platform-ci requested changes Jan 7, 2025
View reviewed changes
Copy link
Contributor

@modernisation-platform-ci modernisation-platform-ci left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Terraform plan evaluation detected changes to resources that require approval from @ministryofjustice/modernsation-platform - please contact #ask-modernisation-platform for assistance

@modernisation-platform-ci
Copy link
Contributor

@Gary-H9 Terraform plan evaluation detected changes to resources that require approval from a member of @ministryofjustice/modernisation-platform - please contact #ask-modernisation-platform for assistance

Guidance on approving these PRs is available at https://user-guide.modernisation-platform.service.justice.gov.uk/runbooks/reviewing-mp-environments-prs.html#process-for-approving-prs

@Gary-H9 Gary-H9 had a problem deploying to analytical-platform-ingestion-development January 7, 2025 16:22 — with GitHub Actions Failure
modernisation-platform-ci
modernisation-platform-ci requested changes Jan 7, 2025
View reviewed changes
Copy link
Contributor

@modernisation-platform-ci modernisation-platform-ci left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Terraform plan evaluation detected changes to resources that require approval from @ministryofjustice/modernsation-platform - please contact #ask-modernisation-platform for assistance

@modernisation-platform-ci
Copy link
Contributor

@Gary-H9 Terraform plan evaluation detected changes to resources that require approval from a member of @ministryofjustice/modernisation-platform - please contact #ask-modernisation-platform for assistance

Guidance on approving these PRs is available at https://user-guide.modernisation-platform.service.justice.gov.uk/runbooks/reviewing-mp-environments-prs.html#process-for-approving-prs

@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Jan 7, 2025

Trivy Scan Failed

Show Output ```hcl

Trivy will check the following folders:
terraform/environments/analytical-platform-ingestion
terraform/environments/data-platform-apps-and-tools

Running Trivy in terraform/environments/analytical-platform-ingestion
2025-01-07T16:23:07Z INFO [vulndb] Need to update DB
2025-01-07T16:23:07Z INFO [vulndb] Downloading vulnerability DB...
2025-01-07T16:23:07Z INFO [vulndb] Downloading artifact... repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-07T16:23:09Z INFO [vulndb] Artifact successfully downloaded repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-07T16:23:09Z INFO [vuln] Vulnerability scanning is enabled
2025-01-07T16:23:09Z INFO [misconfig] Misconfiguration scanning is enabled
2025-01-07T16:23:09Z INFO [misconfig] Need to update the built-in checks
2025-01-07T16:23:09Z INFO [misconfig] Downloading the built-in checks...
160.80 KiB / 160.80 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2025-01-07T16:23:10Z INFO [secret] Secret scanning is enabled
2025-01-07T16:23:10Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-07T16:23:10Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-07T16:23:11Z INFO [terraform scanner] Scanning root module file_path="."
2025-01-07T16:23:11Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="networking"
2025-01-07T16:23:11Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.connected_vpc_transit_gateway_routes" value="cty.NilVal"
2025-01-07T16:23:11Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.sftp_users" value="cty.NilVal"
2025-01-07T16:23:11Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.sftp_users_with_egress" value="cty.NilVal"
2025-01-07T16:23:21Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.bold_egress_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:21Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.bold_egress_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:22Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datasync_bucket.aws_s3_bucket_replication_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_replication_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:22Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datasync_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:22Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datasync_bucket.aws_s3_bucket_replication_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_replication_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:22Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datasync_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:22Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datasync_bucket.aws_s3_bucket_replication_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_replication_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:22Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datasync_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:22Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datasync_bucket.aws_s3_bucket_replication_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_replication_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:22Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datasync_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:22Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.definition_upload_lambda.aws_lambda_function.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.vpc_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.logging_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:22Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.definition_upload_lambda.aws_lambda_function.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.vpc_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.logging_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:22Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.definition_upload_lambda.aws_lambda_function.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.vpc_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.logging_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:22Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.definition_upload_lambda.aws_lambda_function.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.vpc_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.logging_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:22Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.definitions_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:22Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.definitions_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:22Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.definition_upload_lambda.aws_lambda_function.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.vpc_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.logging_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:22Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.definition_upload_lambda.aws_lambda_function.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.vpc_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.logging_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:23Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="git::https:/github.com/terraform-aws-modules/terraform-aws-s3-bucket?ref=8a0b697adfbc673e6135c70246cff7f8052ad95a/main.tf:176-198"
2025-01-07T16:23:23Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-bucket-encryption" range="git::https:/github.com/terraform-aws-modules/terraform-aws-s3-bucket?ref=8a0b697adfbc673e6135c70246cff7f8052ad95a/main.tf:176-198"
2025-01-07T16:23:23Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-public-egress-sgr" range="terraform-aws-modules/security-group/aws/main.tf:533"
2025-01-07T16:23:23Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-public-egress-sgr" range="terraform-aws-modules/security-group/aws/main.tf:534"
2025-01-07T16:23:23Z INFO Number of language-specific files num=0
2025-01-07T16:23:23Z INFO Detected config files num=8

git::https:/github.com/terraform-aws-modules/terraform-aws-alb?ref=349540d1a611cd98a6383cc64ef0d9bf08d88fb7/main.tf (terraform)

Tests: 1 (SUCCESSES: 0, FAILURES: 1)
Failures: 1 (HIGH: 1, CRITICAL: 0)

AVD-AWS-0053 (HIGH): Load balancer is exposed publicly.
════════════════════════════════════════
There are many scenarios in which you would want to expose a load balancer to the wider internet, but this check exists as a warning to prevent accidental exposure of internal assets. You should ensure that this resource should be exposed publicly.

See https://avd.aquasec.com/misconfig/avd-aws-0053
────────────────────────────────────────
git::https:/github.com/terraform-aws-modules/terraform-aws-alb?ref=349540d1a611cd98a6383cc64ef0d9bf08d88fb7/main.tf:47
via git::https:/github.com/terraform-aws-modules/terraform-aws-alb?ref=349540d1a611cd98a6383cc64ef0d9bf08d88fb7/main.tf:12-81 (aws_lb.this[0])
via network-load-balancers.tf:1-37 (module.datasync_activation_nlb)
────────────────────────────────────────
12 resource "aws_lb" "this" {
..
47 [ internal = var.internal
..
81 }
────────────────────────────────────────

git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf (terraform)

Tests: 4 (SUCCESSES: 0, FAILURES: 4)
Failures: 4 (HIGH: 0, CRITICAL: 4)

AVD-AWS-0102 (CRITICAL): Network ACL rule allows access using ALL ports.
════════════════════════════════════════
Ensure access to specific required ports is allowed, and nothing else.

See https://avd.aquasec.com/misconfig/aws-vpc-no-excessive-port-access
────────────────────────────────────────
git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:340
via git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:328-343 (aws_network_acl_rule.private_outbound[0])
via vpc.tf:1-23 (module.connected_vpc)
────────────────────────────────────────
328 resource "aws_network_acl_rule" "private_outbound" {
...
340 [ protocol = var.private_outbound_acl_rules[count.index]["protocol"]
...
343 }
────────────────────────────────────────

AVD-AWS-0102 (CRITICAL): Network ACL rule allows access using ALL ports.
════════════════════════════════════════
Ensure access to specific required ports is allowed, and nothing else.

See https://avd.aquasec.com/misconfig/aws-vpc-no-excessive-port-access
────────────────────────────────────────
git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:323
via git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:311-326 (aws_network_acl_rule.private_inbound[0])
via vpc.tf:1-23 (module.connected_vpc)
────────────────────────────────────────
311 resource "aws_network_acl_rule" "private_inbound" {
...
323 [ protocol = var.private_inbound_acl_rules[count.index]["protocol"]
...
326 }
────────────────────────────────────────

AVD-AWS-0102 (CRITICAL): Network ACL rule allows access using ALL ports.
════════════════════════════════════════
Ensure access to specific required ports is allowed, and nothing else.

See https://avd.aquasec.com/misconfig/aws-vpc-no-excessive-port-access
────────────────────────────────────────
git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:221
via git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:209-224 (aws_network_acl_rule.public_outbound[0])
via vpc.tf:1-23 (module.connected_vpc)
────────────────────────────────────────
209 resource "aws_network_acl_rule" "public_outbound" {
...
221 [ protocol = var.public_outbound_acl_rules[count.index]["protocol"]
...
224 }
────────────────────────────────────────

AVD-AWS-0102 (CRITICAL): Network ACL rule allows access using ALL ports.
════════════════════════════════════════
Ensure access to specific required ports is allowed, and nothing else.

See https://avd.aquasec.com/misconfig/aws-vpc-no-excessive-port-access
────────────────────────────────────────
git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:204
via git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:192-207 (aws_network_acl_rule.public_inbound[0])
via vpc.tf:1-23 (module.connected_vpc)
────────────────────────────────────────
192 resource "aws_network_acl_rule" "public_inbound" {
...
204 [ protocol = var.public_inbound_acl_rules[count.index]["protocol"]
...
207 }
────────────────────────────────────────

trivy_exitcode=1

Running Trivy in terraform/environments/data-platform-apps-and-tools
2025-01-07T16:23:23Z INFO [vuln] Vulnerability scanning is enabled
2025-01-07T16:23:23Z INFO [misconfig] Misconfiguration scanning is enabled
2025-01-07T16:23:23Z INFO [secret] Secret scanning is enabled
2025-01-07T16:23:23Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-07T16:23:23Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-07T16:23:25Z INFO [terraform scanner] Scanning root module file_path="."
2025-01-07T16:23:25Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="networking"
2025-01-07T16:23:25Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="data.aws_subnet.private" value="cty.NilVal"
2025-01-07T16:23:25Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.auth0_log_streams" value="cty.NilVal"
2025-01-07T16:23:37Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.cluster_autoscaler_role.data.aws_iam_policy_document.cluster_autoscaler[0]" err="1 error occurred:\n\t* invalid for-each in data.aws_iam_policy_document.cluster_autoscaler[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:37Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.cluster_autoscaler_role.data.aws_iam_policy_document.cluster_autoscaler[0]" err="1 error occurred:\n\t* invalid for-each in data.aws_iam_policy_document.cluster_autoscaler[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:37Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:37Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:37Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:37Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:37Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:37Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:37Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:37Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:37Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:37Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:37Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:37Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:37Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:37Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.eks.aws_ec2_tag.cluster_primary_security_group" value="cty.NilVal"
2025-01-07T16:23:38Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.eks.module.kms.data.aws_iam_policy_document.this[0]" err="2 errors occurred:\n\t* invalid for-each in data.aws_iam_policy_document.this[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in data.aws_iam_policy_document.this[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:38Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.eks.module.kms.data.aws_iam_policy_document.this[0]" err="2 errors occurred:\n\t* invalid for-each in data.aws_iam_policy_document.this[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in data.aws_iam_policy_document.this[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:38Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.eks.module.kms.data.aws_iam_policy_document.this[0]" err="1 error occurred:\n\t* invalid for-each in data.aws_iam_policy_document.this[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:38Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.eks.module.kms.data.aws_iam_policy_document.this[0]" err="1 error occurred:\n\t* invalid for-each in data.aws_iam_policy_document.this[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.eks.module.eks_managed_node_group["general"].aws_iam_role_policy_attachment.this" value="cty.NilVal"
2025-01-07T16:23:38Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.cluster_autoscaler_role.data.aws_iam_policy_document.cluster_autoscaler[0]" err="1 error occurred:\n\t* invalid for-each in data.aws_iam_policy_document.cluster_autoscaler[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:38Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.cluster_autoscaler_role.data.aws_iam_policy_document.cluster_autoscaler[0]" err="1 error occurred:\n\t* invalid for-each in data.aws_iam_policy_document.cluster_autoscaler[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:38Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.openmetadata_airflow_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:38Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.openmetadata_airflow_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:38Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.openmetadata_airflow_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:38Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.openmetadata_airflow_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:40Z INFO [terraform executor] Ignore finding rule="aws-eks-no-public-cluster-access-to-cidr" range="git::https:/github.com/terraform-aws-modules/terraform-aws-eks?ref=2cb1fac31b0fc2dd6a236b0c0678df75819c5a3b/main.tf:38"
2025-01-07T16:23:40Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.1.0/main.tf:171-179"
2025-01-07T16:23:40Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-public-egress-sgr" range="git::https:/github.com/terraform-aws-modules/terraform-aws-eks?ref=2cb1fac31b0fc2dd6a236b0c0678df75819c5a3b/node_groups.tf:223"
2025-01-07T16:23:40Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-public-egress-sgr" range="terraform-aws-modules/security-group/aws/main.tf:533"
2025-01-07T16:23:40Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-public-egress-sgr" range="terraform-aws-modules/security-group/aws/main.tf:534"
2025-01-07T16:23:40Z INFO [terraform executor] Ignore finding rule="aws-eks-no-public-cluster-access" range="git::https:/github.com/terraform-aws-modules/terraform-aws-eks?ref=2cb1fac31b0fc2dd6a236b0c0678df75819c5a3b/main.tf:37"
2025-01-07T16:23:40Z WARN [pip] Unable to find python site-packages directory. License detection is skipped. err="site-packages directory not found"
2025-01-07T16:23:40Z INFO Number of language-specific files num=1
2025-01-07T16:23:40Z INFO [pip] Detecting vulnerabilities...
2025-01-07T16:23:40Z INFO Detected config files num=10
trivy_exitcode=1

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/analytical-platform-ingestion
terraform/environments/data-platform-apps-and-tools

*****************************

Running Checkov in terraform/environments/analytical-platform-ingestion
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2025-01-07 16:23:43,689 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/iam/aws//modules/iam-policy:5.44.1 (for external modules, the --download-external-modules flag is required)
2025-01-07 16:23:43,689 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/iam/aws//modules/iam-assumable-role:5.44.1 (for external modules, the --download-external-modules flag is required)
2025-01-07 16:23:43,689 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/route53/aws//modules/resolver-rule-associations:4.1.0 (for external modules, the --download-external-modules flag is required)
2025-01-07 16:23:43,689 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/cloudwatch/aws//modules/log-group:5.6.0 (for external modules, the --download-external-modules flag is required)
2025-01-07 16:23:43,689 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/kms/aws:3.1.0 (for external modules, the --download-external-modules flag is required)
2025-01-07 16:23:43,689 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/sns/aws:6.1.0 (for external modules, the --download-external-modules flag is required)
2025-01-07 16:23:43,690 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/lambda/aws:7.9.0 (for external modules, the --download-external-modules flag is required)
2025-01-07 16:23:43,690 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/security-group/aws:5.2.0 (for external modules, the --download-external-modules flag is required)
2025-01-07 16:23:43,690 [MainThread  ] [WARNI]  Failed to download module ministryofjustice/observability-platform-tenant/aws:1.2.0 (for external modules, the --download-external-modules flag is required)
2025-01-07 16:23:43,690 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/vpc/aws//modules/vpc-endpoints:5.13.0 (for external modules, the --download-external-modules flag is required)
2025-01-07 16:23:43,690 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/secrets-manager/aws:1.3.1 (for external modules, the --download-external-modules flag is required)
2025-01-07 16:23:43,690 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/alb/aws:9.11.0 (for external modules, the --download-external-modules flag is required)
2025-01-07 16:23:43,690 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/s3-bucket/aws//modules/notification:4.1.2 (for external modules, the --download-external-modules flag is required)
2025-01-07 16:23:43,691 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/route53/aws//modules/resolver-endpoints:4.1.0 (for external modules, the --download-external-modules flag is required)
2025-01-07 16:23:43,691 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/s3-bucket/aws:4.1.2 (for external modules, the --download-external-modules flag is required)
2025-01-07 16:23:43,691 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/ec2-instance/aws:5.7.1 (for external modules, the --download-external-modules flag is required)
2025-01-07 16:23:43,691 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/vpc/aws:5.13.0 (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 201, Failed checks: 0, Skipped checks: 76


checkov_exitcode=0

*****************************

Running Checkov in terraform/environments/data-platform-apps-and-tools
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2025-01-07 16:23:47,776 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/cloudwatch/aws//modules/log-group:~> 5.0 (for external modules, the --download-external-modules flag is required)
2025-01-07 16:23:47,776 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/kms/aws:~> 2.0 (for external modules, the --download-external-modules flag is required)
2025-01-07 16:23:47,776 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/iam/aws//modules/iam-assumable-role:~> 5.0 (for external modules, the --download-external-modules flag is required)
2025-01-07 16:23:47,776 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/rds/aws:~> 6.0 (for external modules, the --download-external-modules flag is required)
2025-01-07 16:23:47,777 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/efs/aws:~> 1.0 (for external modules, the --download-external-modules flag is required)
2025-01-07 16:23:47,777 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/security-group/aws:~> 5.0 (for external modules, the --download-external-modules flag is required)
2025-01-07 16:23:47,777 [MainThread  ] [WARNI]  Failed to download module ministryofjustice/observability-platform-tenant/aws:1.0.1 (for external modules, the --download-external-modules flag is required)
2025-01-07 16:23:47,777 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks:~> 5.0 (for external modules, the --download-external-modules flag is required)
2025-01-07 16:23:47,777 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/vpc/aws//modules/vpc-endpoints:~> 5.0 (for external modules, the --download-external-modules flag is required)
2025-01-07 16:23:47,777 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/vpc/aws:~> 5.0 (for external modules, the --download-external-modules flag is required)
2025-01-07 16:23:47,777 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/iam/aws//modules/iam-user:~> 5 (for external modules, the --download-external-modules flag is required)
2025-01-07 16:23:47,778 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/iam/aws//modules/iam-policy:~> 5.0 (for external modules, the --download-external-modules flag is required)
2025-01-07 16:23:47,778 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/eks/aws:19.21.0 (for external modules, the --download-external-modules flag is required)
2025-01-07 16:23:47,778 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/ec2-instance/aws:None (for external modules, the --download-external-modules flag is required)
2025-01-07 16:23:47,778 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.1.0:None (for external modules, the --download-external-modules flag is required)
2025-01-07 16:23:47,778 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/kms/aws:2.2.0 (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 169, Failed checks: 16, Skipped checks: 42

Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.powerbi_gateway_reg_credentials
	File: /powerbi-gateway-secret.tf:1-3
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		1 | resource "aws_secretsmanager_secret" "powerbi_gateway_reg_credentials" {
		2 |   name = "${local.environment_configuration.powerbi_gateway_ec2.instance_name}-credentials"
		3 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: aws_security_group.powerbi_gateway
	File: /powerbi-gateway-security-group.tf:2-30
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		2  | resource "aws_security_group" "powerbi_gateway" {
		3  |   name        = local.environment_configuration.powerbi_gateway_ec2.instance_name
		4  |   description = local.environment_configuration.powerbi_gateway_ec2.instance_name
		5  |   vpc_id      = data.aws_vpc.shared.id
		6  | 
		7  |   # https://learn.microsoft.com/en-us/data-integration/gateway/service-gateway-communication#ports
		8  |   egress {
		9  |     from_port   = 443
		10 |     to_port     = 443
		11 |     protocol    = "tcp"
		12 |     cidr_blocks = ["0.0.0.0/0"]
		13 |   }
		14 | 
		15 |   egress {
		16 |     from_port   = 5671
		17 |     to_port     = 5672
		18 |     protocol    = "tcp"
		19 |     cidr_blocks = ["0.0.0.0/0"]
		20 |   }
		21 | 
		22 |   egress {
		23 |     from_port   = 9352
		24 |     to_port     = 9354
		25 |     protocol    = "tcp"
		26 |     cidr_blocks = ["0.0.0.0/0"]
		27 |   }
		28 | 
		29 |   tags = local.tags
		30 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: powerbi_gateway
	File: /powerbi-gateway-server.tf:14-59
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		14 | module "powerbi_gateway" {
		15 |   source  = "terraform-aws-modules/ec2-instance/aws"
		16 |   version = "v5.6.0"
		17 | 
		18 |   name = local.environment_configuration.powerbi_gateway_ec2.instance_name
		19 |   # ami                         = data.aws_ami.windows_server_2022.id
		20 |   ami                         = "ami-00ffeb610527f540b" # Hardcoded AMI ID for Windows Server 2022
		21 |   instance_type               = local.environment_configuration.powerbi_gateway_ec2.instance_type
		22 |   key_name                    = aws_key_pair.powerbi_gateway_keypair.key_name
		23 |   monitoring                  = true
		24 |   create_iam_instance_profile = true
		25 |   iam_role_description        = "IAM role for PowerBI Gateway Instance"
		26 |   ignore_ami_changes          = false
		27 |   enable_volume_tags          = false
		28 |   associate_public_ip_address = false
		29 |   iam_role_policies = {
		30 |     SSMCore            = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
		31 |     PowerBI_DataAccess = aws_iam_policy.powerbi_gateway_data_access.arn
		32 |   }
		33 |   root_block_device = [
		34 |     {
		35 |       encrypted   = true
		36 |       volume_type = "gp3"
		37 |       volume_size = 100
		38 |       tags = merge({
		39 |         Name = "${local.environment_configuration.powerbi_gateway_ec2.instance_name}-root-volume"
		40 |       }, local.tags)
		41 |     },
		42 |   ]
		43 | 
		44 |   ebs_block_device = [
		45 |     {
		46 |       volume_type = "gp3"
		47 |       device_name = "/dev/sdf"
		48 |       volume_size = 300
		49 |       encrypted   = true
		50 |       tags = merge({
		51 |         Name = "${local.environment_configuration.powerbi_gateway_ec2.instance_name}-data-volume"
		52 |       }, local.tags)
		53 |     }
		54 |   ]
		55 |   vpc_security_group_ids = [aws_security_group.powerbi_gateway.id]
		56 |   subnet_id              = data.aws_subnet.private_subnets_a.id
		57 | 
		58 |   tags = local.tags
		59 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: airflow_s3_bucket
	File: /s3.tf:5-15
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		5  | module "airflow_s3_bucket" {
		6  |   source = "github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.1.0"
		7  | 
		8  |   providers = {
		9  |     aws.bucket-replication = aws
		10 |   }
		11 | 
		12 |   bucket_prefix = "moj-data-platform-airflow-${local.environment}"
		13 | 
		14 |   tags = local.tags
		15 | }

Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.openmetadata_entra_id_client_id
	File: /secrets.tf:7-11
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		7  | resource "aws_secretsmanager_secret" "openmetadata_entra_id_client_id" {
		8  |   count = terraform.workspace == "data-platform-apps-and-tools-production" ? 1 : 0
		9  | 
		10 |   name = "openmetadata/entra-id/client-id"
		11 | }

Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.openmetadata_entra_id_tenant_id
	File: /secrets.tf:13-17
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		13 | resource "aws_secretsmanager_secret" "openmetadata_entra_id_tenant_id" {
		14 |   count = terraform.workspace == "data-platform-apps-and-tools-production" ? 1 : 0
		15 | 
		16 |   name = "openmetadata/entra-id/tenant-id"
		17 | }

Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.github_app_arc_app_id
	File: /secrets.tf:19-23
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		19 | resource "aws_secretsmanager_secret" "github_app_arc_app_id" {
		20 |   count = terraform.workspace == "data-platform-apps-and-tools-production" ? 1 : 0
		21 | 
		22 |   name = "github/arc/app-id"
		23 | }

Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.github_app_arc_install_id
	File: /secrets.tf:25-29
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		25 | resource "aws_secretsmanager_secret" "github_app_arc_install_id" {
		26 |   count = terraform.workspace == "data-platform-apps-and-tools-production" ? 1 : 0
		27 | 
		28 |   name = "github/arc/install-id"
		29 | }

Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.github_app_arc_private_key
	File: /secrets.tf:31-35
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		31 | resource "aws_secretsmanager_secret" "github_app_arc_private_key" {
		32 |   count = terraform.workspace == "data-platform-apps-and-tools-production" ? 1 : 0
		33 | 
		34 |   name = "github/arc/private-key"
		35 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: aws_security_group.powerbi_gateway
	File: /powerbi-gateway-security-group.tf:2-30
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		2  | resource "aws_security_group" "powerbi_gateway" {
		3  |   name        = local.environment_configuration.powerbi_gateway_ec2.instance_name
		4  |   description = local.environment_configuration.powerbi_gateway_ec2.instance_name
		5  |   vpc_id      = data.aws_vpc.shared.id
		6  | 
		7  |   # https://learn.microsoft.com/en-us/data-integration/gateway/service-gateway-communication#ports
		8  |   egress {
		9  |     from_port   = 443
		10 |     to_port     = 443
		11 |     protocol    = "tcp"
		12 |     cidr_blocks = ["0.0.0.0/0"]
		13 |   }
		14 | 
		15 |   egress {
		16 |     from_port   = 5671
		17 |     to_port     = 5672
		18 |     protocol    = "tcp"
		19 |     cidr_blocks = ["0.0.0.0/0"]
		20 |   }
		21 | 
		22 |   egress {
		23 |     from_port   = 9352
		24 |     to_port     = 9354
		25 |     protocol    = "tcp"
		26 |     cidr_blocks = ["0.0.0.0/0"]
		27 |   }
		28 | 
		29 |   tags = local.tags
		30 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.powerbi_gateway_reg_credentials
	File: /powerbi-gateway-secret.tf:1-3
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		1 | resource "aws_secretsmanager_secret" "powerbi_gateway_reg_credentials" {
		2 |   name = "${local.environment_configuration.powerbi_gateway_ec2.instance_name}-credentials"
		3 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.openmetadata_entra_id_client_id
	File: /secrets.tf:7-11
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		7  | resource "aws_secretsmanager_secret" "openmetadata_entra_id_client_id" {
		8  |   count = terraform.workspace == "data-platform-apps-and-tools-production" ? 1 : 0
		9  | 
		10 |   name = "openmetadata/entra-id/client-id"
		11 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.openmetadata_entra_id_tenant_id
	File: /secrets.tf:13-17
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		13 | resource "aws_secretsmanager_secret" "openmetadata_entra_id_tenant_id" {
		14 |   count = terraform.workspace == "data-platform-apps-and-tools-production" ? 1 : 0
		15 | 
		16 |   name = "openmetadata/entra-id/tenant-id"
		17 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.github_app_arc_app_id
	File: /secrets.tf:19-23
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		19 | resource "aws_secretsmanager_secret" "github_app_arc_app_id" {
		20 |   count = terraform.workspace == "data-platform-apps-and-tools-production" ? 1 : 0
		21 | 
		22 |   name = "github/arc/app-id"
		23 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.github_app_arc_install_id
	File: /secrets.tf:25-29
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		25 | resource "aws_secretsmanager_secret" "github_app_arc_install_id" {
		26 |   count = terraform.workspace == "data-platform-apps-and-tools-production" ? 1 : 0
		27 | 
		28 |   name = "github/arc/install-id"
		29 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.github_app_arc_private_key
	File: /secrets.tf:31-35
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		31 | resource "aws_secretsmanager_secret" "github_app_arc_private_key" {
		32 |   count = terraform.workspace == "data-platform-apps-and-tools-production" ? 1 : 0
		33 | 
		34 |   name = "github/arc/private-key"
		35 | }


checkov_exitcode=1

CTFLint Scan Failed

Show Output 
*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
terraform/environments/analytical-platform-ingestion
terraform/environments/data-platform-apps-and-tools

*****************************

Running tflint in terraform/environments/analytical-platform-ingestion
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=0

*****************************

Running tflint in terraform/environments/data-platform-apps-and-tools
Excluding the following checks: terraform_unused_declarations
4 issue(s) found:

Warning: Duplicate key: "airflow_execution_role_name", first defined at terraform/environments/data-platform-apps-and-tools/environment-configuration.tf:31,7-34 (terraform_map_duplicate_keys)

  on terraform/environments/data-platform-apps-and-tools/environment-configuration.tf line 35:
  35:       airflow_execution_role_name   = "${local.application_name}-${local.environment}-airflow-execution"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_map_duplicate_keys.md

Warning: Duplicate key: "eks_cluster_name", first defined at terraform/environments/data-platform-apps-and-tools/environment-configuration.tf:17,7-23 (terraform_map_duplicate_keys)

  on terraform/environments/data-platform-apps-and-tools/environment-configuration.tf line 68:
  68:       eks_cluster_name               = "apps-tools-development"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_map_duplicate_keys.md

Warning: Duplicate key: "eks_cluster_name", first defined at terraform/environments/data-platform-apps-and-tools/environment-configuration.tf:105,7-23 (terraform_map_duplicate_keys)

  on terraform/environments/data-platform-apps-and-tools/environment-configuration.tf line 169:
 169:       eks_cluster_name               = "apps-tools-production"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_map_duplicate_keys.md

Warning: Missing version constraint for provider "random" in `required_providers` (terraform_required_providers)

  on terraform/environments/data-platform-apps-and-tools/random.tf line 24:
  24: resource "random_password" "datahub_rds" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

tflint_exitcode=2

Trivy Scan Failed

Show Output 
*****************************

Trivy will check the following folders:
terraform/environments/analytical-platform-ingestion
terraform/environments/data-platform-apps-and-tools

*****************************

Running Trivy in terraform/environments/analytical-platform-ingestion
2025-01-07T16:23:07Z	INFO	[vulndb] Need to update DB
2025-01-07T16:23:07Z	INFO	[vulndb] Downloading vulnerability DB...
2025-01-07T16:23:07Z	INFO	[vulndb] Downloading artifact...	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-07T16:23:09Z	INFO	[vulndb] Artifact successfully downloaded	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-07T16:23:09Z	INFO	[vuln] Vulnerability scanning is enabled
2025-01-07T16:23:09Z	INFO	[misconfig] Misconfiguration scanning is enabled
2025-01-07T16:23:09Z	INFO	[misconfig] Need to update the built-in checks
2025-01-07T16:23:09Z	INFO	[misconfig] Downloading the built-in checks...
160.80 KiB / 160.80 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2025-01-07T16:23:10Z	INFO	[secret] Secret scanning is enabled
2025-01-07T16:23:10Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-07T16:23:10Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-07T16:23:11Z	INFO	[terraform scanner] Scanning root module	file_path="."
2025-01-07T16:23:11Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="networking"
2025-01-07T16:23:11Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.connected_vpc_transit_gateway_routes" value="cty.NilVal"
2025-01-07T16:23:11Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.sftp_users" value="cty.NilVal"
2025-01-07T16:23:11Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.sftp_users_with_egress" value="cty.NilVal"
2025-01-07T16:23:21Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.bold_egress_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:21Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.bold_egress_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:22Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datasync_bucket.aws_s3_bucket_replication_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_replication_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:22Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datasync_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:22Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datasync_bucket.aws_s3_bucket_replication_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_replication_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:22Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datasync_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:22Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datasync_bucket.aws_s3_bucket_replication_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_replication_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:22Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datasync_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:22Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datasync_bucket.aws_s3_bucket_replication_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_replication_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:22Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datasync_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:22Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.definition_upload_lambda.aws_lambda_function.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.vpc_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.logging_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:22Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.definition_upload_lambda.aws_lambda_function.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.vpc_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.logging_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:22Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.definition_upload_lambda.aws_lambda_function.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.vpc_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.logging_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:22Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.definition_upload_lambda.aws_lambda_function.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.vpc_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.logging_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:22Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.definitions_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:22Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.definitions_bucket.aws_s3_bucket_server_side_encryption_configuration.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_server_side_encryption_configuration.this[0].dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:22Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.definition_upload_lambda.aws_lambda_function.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.vpc_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.logging_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:22Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.definition_upload_lambda.aws_lambda_function.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.vpc_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_lambda_function.this[0].dynamic.logging_config block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:23Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="git::https:/github.com/terraform-aws-modules/terraform-aws-s3-bucket?ref=8a0b697adfbc673e6135c70246cff7f8052ad95a/main.tf:176-198"
2025-01-07T16:23:23Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-bucket-encryption" range="git::https:/github.com/terraform-aws-modules/terraform-aws-s3-bucket?ref=8a0b697adfbc673e6135c70246cff7f8052ad95a/main.tf:176-198"
2025-01-07T16:23:23Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-public-egress-sgr" range="terraform-aws-modules/security-group/aws/main.tf:533"
2025-01-07T16:23:23Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-public-egress-sgr" range="terraform-aws-modules/security-group/aws/main.tf:534"
2025-01-07T16:23:23Z	INFO	Number of language-specific files	num=0
2025-01-07T16:23:23Z	INFO	Detected config files	num=8

git::https:/github.com/terraform-aws-modules/terraform-aws-alb?ref=349540d1a611cd98a6383cc64ef0d9bf08d88fb7/main.tf (terraform)
===============================================================================================================================
Tests: 1 (SUCCESSES: 0, FAILURES: 1)
Failures: 1 (HIGH: 1, CRITICAL: 0)

AVD-AWS-0053 (HIGH): Load balancer is exposed publicly.
════════════════════════════════════════
There are many scenarios in which you would want to expose a load balancer to the wider internet, but this check exists as a warning to prevent accidental exposure of internal assets. You should ensure that this resource should be exposed publicly.


See https://avd.aquasec.com/misconfig/avd-aws-0053
────────────────────────────────────────
 git::https:/github.com/terraform-aws-modules/terraform-aws-alb?ref=349540d1a611cd98a6383cc64ef0d9bf08d88fb7/main.tf:47
   via git::https:/github.com/terraform-aws-modules/terraform-aws-alb?ref=349540d1a611cd98a6383cc64ef0d9bf08d88fb7/main.tf:12-81 (aws_lb.this[0])
    via network-load-balancers.tf:1-37 (module.datasync_activation_nlb)
────────────────────────────────────────
  12   resource "aws_lb" "this" {
  ..   
  47 [   internal                                                     = var.internal
  ..   
  81   }
────────────────────────────────────────



git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf (terraform)
===============================================================================================================================
Tests: 4 (SUCCESSES: 0, FAILURES: 4)
Failures: 4 (HIGH: 0, CRITICAL: 4)

AVD-AWS-0102 (CRITICAL): Network ACL rule allows access using ALL ports.
════════════════════════════════════════
Ensure access to specific required ports is allowed, and nothing else.


See https://avd.aquasec.com/misconfig/aws-vpc-no-excessive-port-access
────────────────────────────────────────
 git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:340
   via git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:328-343 (aws_network_acl_rule.private_outbound[0])
    via vpc.tf:1-23 (module.connected_vpc)
────────────────────────────────────────
 328   resource "aws_network_acl_rule" "private_outbound" {
 ...   
 340 [   protocol        = var.private_outbound_acl_rules[count.index]["protocol"]
 ...   
 343   }
────────────────────────────────────────


AVD-AWS-0102 (CRITICAL): Network ACL rule allows access using ALL ports.
════════════════════════════════════════
Ensure access to specific required ports is allowed, and nothing else.


See https://avd.aquasec.com/misconfig/aws-vpc-no-excessive-port-access
────────────────────────────────────────
 git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:323
   via git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:311-326 (aws_network_acl_rule.private_inbound[0])
    via vpc.tf:1-23 (module.connected_vpc)
────────────────────────────────────────
 311   resource "aws_network_acl_rule" "private_inbound" {
 ...   
 323 [   protocol        = var.private_inbound_acl_rules[count.index]["protocol"]
 ...   
 326   }
────────────────────────────────────────


AVD-AWS-0102 (CRITICAL): Network ACL rule allows access using ALL ports.
════════════════════════════════════════
Ensure access to specific required ports is allowed, and nothing else.


See https://avd.aquasec.com/misconfig/aws-vpc-no-excessive-port-access
────────────────────────────────────────
 git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:221
   via git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:209-224 (aws_network_acl_rule.public_outbound[0])
    via vpc.tf:1-23 (module.connected_vpc)
────────────────────────────────────────
 209   resource "aws_network_acl_rule" "public_outbound" {
 ...   
 221 [   protocol        = var.public_outbound_acl_rules[count.index]["protocol"]
 ...   
 224   }
────────────────────────────────────────


AVD-AWS-0102 (CRITICAL): Network ACL rule allows access using ALL ports.
════════════════════════════════════════
Ensure access to specific required ports is allowed, and nothing else.


See https://avd.aquasec.com/misconfig/aws-vpc-no-excessive-port-access
────────────────────────────────────────
 git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:204
   via git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=e226cc15a7b8f62fd0e108792fea66fa85bcb4b9/main.tf:192-207 (aws_network_acl_rule.public_inbound[0])
    via vpc.tf:1-23 (module.connected_vpc)
────────────────────────────────────────
 192   resource "aws_network_acl_rule" "public_inbound" {
 ...   
 204 [   protocol        = var.public_inbound_acl_rules[count.index]["protocol"]
 ...   
 207   }
────────────────────────────────────────


trivy_exitcode=1

*****************************

Running Trivy in terraform/environments/data-platform-apps-and-tools
2025-01-07T16:23:23Z	INFO	[vuln] Vulnerability scanning is enabled
2025-01-07T16:23:23Z	INFO	[misconfig] Misconfiguration scanning is enabled
2025-01-07T16:23:23Z	INFO	[secret] Secret scanning is enabled
2025-01-07T16:23:23Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-07T16:23:23Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-07T16:23:25Z	INFO	[terraform scanner] Scanning root module	file_path="."
2025-01-07T16:23:25Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="networking"
2025-01-07T16:23:25Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="data.aws_subnet.private" value="cty.NilVal"
2025-01-07T16:23:25Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.auth0_log_streams" value="cty.NilVal"
2025-01-07T16:23:37Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.cluster_autoscaler_role.data.aws_iam_policy_document.cluster_autoscaler[0]" err="1 error occurred:\n\t* invalid for-each in data.aws_iam_policy_document.cluster_autoscaler[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:37Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.cluster_autoscaler_role.data.aws_iam_policy_document.cluster_autoscaler[0]" err="1 error occurred:\n\t* invalid for-each in data.aws_iam_policy_document.cluster_autoscaler[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:37Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:37Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:37Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:37Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:37Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:37Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:37Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:37Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:37Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:37Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:37Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:37Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:37Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:37Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.eks.aws_ec2_tag.cluster_primary_security_group" value="cty.NilVal"
2025-01-07T16:23:38Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.eks.module.kms.data.aws_iam_policy_document.this[0]" err="2 errors occurred:\n\t* invalid for-each in data.aws_iam_policy_document.this[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in data.aws_iam_policy_document.this[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:38Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.eks.module.kms.data.aws_iam_policy_document.this[0]" err="2 errors occurred:\n\t* invalid for-each in data.aws_iam_policy_document.this[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in data.aws_iam_policy_document.this[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:38Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.eks.module.kms.data.aws_iam_policy_document.this[0]" err="1 error occurred:\n\t* invalid for-each in data.aws_iam_policy_document.this[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:38Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.eks.module.kms.data.aws_iam_policy_document.this[0]" err="1 error occurred:\n\t* invalid for-each in data.aws_iam_policy_document.this[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.eks.module.eks_managed_node_group[\"general\"].aws_iam_role_policy_attachment.this" value="cty.NilVal"
2025-01-07T16:23:38Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.cluster_autoscaler_role.data.aws_iam_policy_document.cluster_autoscaler[0]" err="1 error occurred:\n\t* invalid for-each in data.aws_iam_policy_document.cluster_autoscaler[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:38Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.cluster_autoscaler_role.data.aws_iam_policy_document.cluster_autoscaler[0]" err="1 error occurred:\n\t* invalid for-each in data.aws_iam_policy_document.cluster_autoscaler[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:38Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.openmetadata_airflow_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:38Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.openmetadata_airflow_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:38Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.openmetadata_airflow_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:38Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.openmetadata_airflow_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T16:23:40Z	INFO	[terraform executor] Ignore finding	rule="aws-eks-no-public-cluster-access-to-cidr" range="git::https:/github.com/terraform-aws-modules/terraform-aws-eks?ref=2cb1fac31b0fc2dd6a236b0c0678df75819c5a3b/main.tf:38"
2025-01-07T16:23:40Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.1.0/main.tf:171-179"
2025-01-07T16:23:40Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-public-egress-sgr" range="git::https:/github.com/terraform-aws-modules/terraform-aws-eks?ref=2cb1fac31b0fc2dd6a236b0c0678df75819c5a3b/node_groups.tf:223"
2025-01-07T16:23:40Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-public-egress-sgr" range="terraform-aws-modules/security-group/aws/main.tf:533"
2025-01-07T16:23:40Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-public-egress-sgr" range="terraform-aws-modules/security-group/aws/main.tf:534"
2025-01-07T16:23:40Z	INFO	[terraform executor] Ignore finding	rule="aws-eks-no-public-cluster-access" range="git::https:/github.com/terraform-aws-modules/terraform-aws-eks?ref=2cb1fac31b0fc2dd6a236b0c0678df75819c5a3b/main.tf:37"
2025-01-07T16:23:40Z	WARN	[pip] Unable to find python `site-packages` directory. License detection is skipped.	err="site-packages directory not found"
2025-01-07T16:23:40Z	INFO	Number of language-specific files	num=1
2025-01-07T16:23:40Z	INFO	[pip] Detecting vulnerabilities...
2025-01-07T16:23:40Z	INFO	Detected config files	num=10
trivy_exitcode=1

modernisation-platform-ci
modernisation-platform-ci requested changes Jan 7, 2025
View reviewed changes
Copy link
Contributor

@modernisation-platform-ci modernisation-platform-ci left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Terraform plan evaluation detected changes to resources that require approval from @ministryofjustice/modernsation-platform - please contact #ask-modernisation-platform for assistance

@modernisation-platform-ci
Copy link
Contributor

@Gary-H9 Terraform plan evaluation detected changes to resources that require approval from a member of @ministryofjustice/modernisation-platform - please contact #ask-modernisation-platform for assistance

Guidance on approving these PRs is available at https://user-guide.modernisation-platform.service.justice.gov.uk/runbooks/reviewing-mp-environments-prs.html#process-for-approving-prs

modernisation-platform-ci
modernisation-platform-ci requested changes Jan 7, 2025
View reviewed changes
Copy link
Contributor

@modernisation-platform-ci modernisation-platform-ci left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Terraform plan evaluation detected changes to resources that require approval from @ministryofjustice/modernsation-platform - please contact #ask-modernisation-platform for assistance

@modernisation-platform-ci
Copy link
Contributor

@Gary-H9 Terraform plan evaluation detected changes to resources that require approval from a member of @ministryofjustice/modernisation-platform - please contact #ask-modernisation-platform for assistance

Guidance on approving these PRs is available at https://user-guide.modernisation-platform.service.justice.gov.uk/runbooks/reviewing-mp-environments-prs.html#process-for-approving-prs

@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Jan 7, 2025

Trivy Scan Success

Show Output ```hcl

Trivy will check the following folders:
terraform/environments/data-platform-apps-and-tools

Running Trivy in terraform/environments/data-platform-apps-and-tools
2025-01-07T17:14:50Z INFO [vulndb] Need to update DB
2025-01-07T17:14:50Z INFO [vulndb] Downloading vulnerability DB...
2025-01-07T17:14:50Z INFO [vulndb] Downloading artifact... repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-07T17:14:53Z INFO [vulndb] Artifact successfully downloaded repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-07T17:14:53Z INFO [vuln] Vulnerability scanning is enabled
2025-01-07T17:14:53Z INFO [misconfig] Misconfiguration scanning is enabled
2025-01-07T17:14:53Z INFO [misconfig] Need to update the built-in checks
2025-01-07T17:14:53Z INFO [misconfig] Downloading the built-in checks...
160.80 KiB / 160.80 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2025-01-07T17:14:53Z INFO [secret] Secret scanning is enabled
2025-01-07T17:14:53Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-07T17:14:53Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-07T17:14:55Z WARN [pip] Unable to find python site-packages directory. License detection is skipped. err="site-packages directory not found"
2025-01-07T17:14:55Z INFO [terraform scanner] Scanning root module file_path="."
2025-01-07T17:14:55Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="networking"
2025-01-07T17:14:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="data.aws_subnet.private" value="cty.NilVal"
2025-01-07T17:14:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.auth0_log_streams" value="cty.NilVal"
2025-01-07T17:15:06Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.cluster_autoscaler_role.data.aws_iam_policy_document.cluster_autoscaler[0]" err="1 error occurred:\n\t* invalid for-each in data.aws_iam_policy_document.cluster_autoscaler[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T17:15:06Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.cluster_autoscaler_role.data.aws_iam_policy_document.cluster_autoscaler[0]" err="1 error occurred:\n\t* invalid for-each in data.aws_iam_policy_document.cluster_autoscaler[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T17:15:06Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T17:15:06Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T17:15:06Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T17:15:06Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T17:15:06Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T17:15:06Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T17:15:06Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T17:15:06Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T17:15:06Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T17:15:06Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T17:15:06Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T17:15:06Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T17:15:06Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T17:15:06Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T17:15:06Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.eks.aws_ec2_tag.cluster_primary_security_group" value="cty.NilVal"
2025-01-07T17:15:06Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.eks.module.kms.data.aws_iam_policy_document.this[0]" err="2 errors occurred:\n\t* invalid for-each in data.aws_iam_policy_document.this[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in data.aws_iam_policy_document.this[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T17:15:06Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.eks.module.kms.data.aws_iam_policy_document.this[0]" err="2 errors occurred:\n\t* invalid for-each in data.aws_iam_policy_document.this[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in data.aws_iam_policy_document.this[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T17:15:06Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.eks.module.kms.data.aws_iam_policy_document.this[0]" err="1 error occurred:\n\t* invalid for-each in data.aws_iam_policy_document.this[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T17:15:06Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.eks.module.kms.data.aws_iam_policy_document.this[0]" err="1 error occurred:\n\t* invalid for-each in data.aws_iam_policy_document.this[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T17:15:06Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.eks.module.eks_managed_node_group["general"].aws_iam_role_policy_attachment.this" value="cty.NilVal"
2025-01-07T17:15:06Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.cluster_autoscaler_role.data.aws_iam_policy_document.cluster_autoscaler[0]" err="1 error occurred:\n\t* invalid for-each in data.aws_iam_policy_document.cluster_autoscaler[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T17:15:06Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.cluster_autoscaler_role.data.aws_iam_policy_document.cluster_autoscaler[0]" err="1 error occurred:\n\t* invalid for-each in data.aws_iam_policy_document.cluster_autoscaler[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T17:15:07Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.openmetadata_airflow_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T17:15:07Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.openmetadata_airflow_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T17:15:07Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.openmetadata_airflow_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T17:15:07Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.openmetadata_airflow_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T17:15:08Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-public-egress-sgr" range="git::https:/github.com/terraform-aws-modules/terraform-aws-eks?ref=2cb1fac31b0fc2dd6a236b0c0678df75819c5a3b/node_groups.tf:223"
2025-01-07T17:15:08Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-public-egress-sgr" range="terraform-aws-modules/security-group/aws/main.tf:533"
2025-01-07T17:15:08Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-public-egress-sgr" range="terraform-aws-modules/security-group/aws/main.tf:534"
2025-01-07T17:15:08Z INFO [terraform executor] Ignore finding rule="aws-eks-no-public-cluster-access-to-cidr" range="git::https:/github.com/terraform-aws-modules/terraform-aws-eks?ref=2cb1fac31b0fc2dd6a236b0c0678df75819c5a3b/main.tf:38"
2025-01-07T17:15:08Z INFO [terraform executor] Ignore finding rule="aws-eks-no-public-cluster-access" range="git::https:/github.com/terraform-aws-modules/terraform-aws-eks?ref=2cb1fac31b0fc2dd6a236b0c0678df75819c5a3b/main.tf:37"
2025-01-07T17:15:08Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.1.0/main.tf:171-179"
2025-01-07T17:15:08Z INFO Number of language-specific files num=1
2025-01-07T17:15:08Z INFO [pip] Detecting vulnerabilities...
2025-01-07T17:15:08Z INFO Detected config files num=10
trivy_exitcode=0

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/data-platform-apps-and-tools

*****************************

Running Checkov in terraform/environments/data-platform-apps-and-tools
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2025-01-07 17:15:11,491 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/cloudwatch/aws//modules/log-group:~> 5.0 (for external modules, the --download-external-modules flag is required)
2025-01-07 17:15:11,491 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/kms/aws:~> 2.0 (for external modules, the --download-external-modules flag is required)
2025-01-07 17:15:11,491 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/iam/aws//modules/iam-assumable-role:~> 5.0 (for external modules, the --download-external-modules flag is required)
2025-01-07 17:15:11,492 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/rds/aws:~> 6.0 (for external modules, the --download-external-modules flag is required)
2025-01-07 17:15:11,492 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/efs/aws:~> 1.0 (for external modules, the --download-external-modules flag is required)
2025-01-07 17:15:11,492 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/security-group/aws:~> 5.0 (for external modules, the --download-external-modules flag is required)
2025-01-07 17:15:11,492 [MainThread  ] [WARNI]  Failed to download module ministryofjustice/observability-platform-tenant/aws:1.0.1 (for external modules, the --download-external-modules flag is required)
2025-01-07 17:15:11,492 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks:~> 5.0 (for external modules, the --download-external-modules flag is required)
2025-01-07 17:15:11,492 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/vpc/aws//modules/vpc-endpoints:~> 5.0 (for external modules, the --download-external-modules flag is required)
2025-01-07 17:15:11,492 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/vpc/aws:~> 5.0 (for external modules, the --download-external-modules flag is required)
2025-01-07 17:15:11,492 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/iam/aws//modules/iam-user:~> 5 (for external modules, the --download-external-modules flag is required)
2025-01-07 17:15:11,493 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/iam/aws//modules/iam-policy:~> 5.0 (for external modules, the --download-external-modules flag is required)
2025-01-07 17:15:11,493 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/eks/aws:19.21.0 (for external modules, the --download-external-modules flag is required)
2025-01-07 17:15:11,493 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/ec2-instance/aws:None (for external modules, the --download-external-modules flag is required)
2025-01-07 17:15:11,493 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.1.0:None (for external modules, the --download-external-modules flag is required)
2025-01-07 17:15:11,493 [MainThread  ] [WARNI]  Failed to download module terraform-aws-modules/kms/aws:2.2.0 (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 169, Failed checks: 16, Skipped checks: 42

Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.powerbi_gateway_reg_credentials
	File: /powerbi-gateway-secret.tf:1-3
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		1 | resource "aws_secretsmanager_secret" "powerbi_gateway_reg_credentials" {
		2 |   name = "${local.environment_configuration.powerbi_gateway_ec2.instance_name}-credentials"
		3 | }

Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: aws_security_group.powerbi_gateway
	File: /powerbi-gateway-security-group.tf:2-30
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		2  | resource "aws_security_group" "powerbi_gateway" {
		3  |   name        = local.environment_configuration.powerbi_gateway_ec2.instance_name
		4  |   description = local.environment_configuration.powerbi_gateway_ec2.instance_name
		5  |   vpc_id      = data.aws_vpc.shared.id
		6  | 
		7  |   # https://learn.microsoft.com/en-us/data-integration/gateway/service-gateway-communication#ports
		8  |   egress {
		9  |     from_port   = 443
		10 |     to_port     = 443
		11 |     protocol    = "tcp"
		12 |     cidr_blocks = ["0.0.0.0/0"]
		13 |   }
		14 | 
		15 |   egress {
		16 |     from_port   = 5671
		17 |     to_port     = 5672
		18 |     protocol    = "tcp"
		19 |     cidr_blocks = ["0.0.0.0/0"]
		20 |   }
		21 | 
		22 |   egress {
		23 |     from_port   = 9352
		24 |     to_port     = 9354
		25 |     protocol    = "tcp"
		26 |     cidr_blocks = ["0.0.0.0/0"]
		27 |   }
		28 | 
		29 |   tags = local.tags
		30 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: powerbi_gateway
	File: /powerbi-gateway-server.tf:14-59
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		14 | module "powerbi_gateway" {
		15 |   source  = "terraform-aws-modules/ec2-instance/aws"
		16 |   version = "v5.6.0"
		17 | 
		18 |   name = local.environment_configuration.powerbi_gateway_ec2.instance_name
		19 |   # ami                         = data.aws_ami.windows_server_2022.id
		20 |   ami                         = "ami-00ffeb610527f540b" # Hardcoded AMI ID for Windows Server 2022
		21 |   instance_type               = local.environment_configuration.powerbi_gateway_ec2.instance_type
		22 |   key_name                    = aws_key_pair.powerbi_gateway_keypair.key_name
		23 |   monitoring                  = true
		24 |   create_iam_instance_profile = true
		25 |   iam_role_description        = "IAM role for PowerBI Gateway Instance"
		26 |   ignore_ami_changes          = false
		27 |   enable_volume_tags          = false
		28 |   associate_public_ip_address = false
		29 |   iam_role_policies = {
		30 |     SSMCore            = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
		31 |     PowerBI_DataAccess = aws_iam_policy.powerbi_gateway_data_access.arn
		32 |   }
		33 |   root_block_device = [
		34 |     {
		35 |       encrypted   = true
		36 |       volume_type = "gp3"
		37 |       volume_size = 100
		38 |       tags = merge({
		39 |         Name = "${local.environment_configuration.powerbi_gateway_ec2.instance_name}-root-volume"
		40 |       }, local.tags)
		41 |     },
		42 |   ]
		43 | 
		44 |   ebs_block_device = [
		45 |     {
		46 |       volume_type = "gp3"
		47 |       device_name = "/dev/sdf"
		48 |       volume_size = 300
		49 |       encrypted   = true
		50 |       tags = merge({
		51 |         Name = "${local.environment_configuration.powerbi_gateway_ec2.instance_name}-data-volume"
		52 |       }, local.tags)
		53 |     }
		54 |   ]
		55 |   vpc_security_group_ids = [aws_security_group.powerbi_gateway.id]
		56 |   subnet_id              = data.aws_subnet.private_subnets_a.id
		57 | 
		58 |   tags = local.tags
		59 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: airflow_s3_bucket
	File: /s3.tf:5-15
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		5  | module "airflow_s3_bucket" {
		6  |   source = "github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.1.0"
		7  | 
		8  |   providers = {
		9  |     aws.bucket-replication = aws
		10 |   }
		11 | 
		12 |   bucket_prefix = "moj-data-platform-airflow-${local.environment}"
		13 | 
		14 |   tags = local.tags
		15 | }

Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.openmetadata_entra_id_client_id
	File: /secrets.tf:7-11
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		7  | resource "aws_secretsmanager_secret" "openmetadata_entra_id_client_id" {
		8  |   count = terraform.workspace == "data-platform-apps-and-tools-production" ? 1 : 0
		9  | 
		10 |   name = "openmetadata/entra-id/client-id"
		11 | }

Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.openmetadata_entra_id_tenant_id
	File: /secrets.tf:13-17
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		13 | resource "aws_secretsmanager_secret" "openmetadata_entra_id_tenant_id" {
		14 |   count = terraform.workspace == "data-platform-apps-and-tools-production" ? 1 : 0
		15 | 
		16 |   name = "openmetadata/entra-id/tenant-id"
		17 | }

Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.github_app_arc_app_id
	File: /secrets.tf:19-23
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		19 | resource "aws_secretsmanager_secret" "github_app_arc_app_id" {
		20 |   count = terraform.workspace == "data-platform-apps-and-tools-production" ? 1 : 0
		21 | 
		22 |   name = "github/arc/app-id"
		23 | }

Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.github_app_arc_install_id
	File: /secrets.tf:25-29
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		25 | resource "aws_secretsmanager_secret" "github_app_arc_install_id" {
		26 |   count = terraform.workspace == "data-platform-apps-and-tools-production" ? 1 : 0
		27 | 
		28 |   name = "github/arc/install-id"
		29 | }

Check: CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
	FAILED for resource: aws_secretsmanager_secret.github_app_arc_private_key
	File: /secrets.tf:31-35
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-secrets-manager-secret-is-encrypted-using-kms

		31 | resource "aws_secretsmanager_secret" "github_app_arc_private_key" {
		32 |   count = terraform.workspace == "data-platform-apps-and-tools-production" ? 1 : 0
		33 | 
		34 |   name = "github/arc/private-key"
		35 | }

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	FAILED for resource: aws_security_group.powerbi_gateway
	File: /powerbi-gateway-security-group.tf:2-30
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		2  | resource "aws_security_group" "powerbi_gateway" {
		3  |   name        = local.environment_configuration.powerbi_gateway_ec2.instance_name
		4  |   description = local.environment_configuration.powerbi_gateway_ec2.instance_name
		5  |   vpc_id      = data.aws_vpc.shared.id
		6  | 
		7  |   # https://learn.microsoft.com/en-us/data-integration/gateway/service-gateway-communication#ports
		8  |   egress {
		9  |     from_port   = 443
		10 |     to_port     = 443
		11 |     protocol    = "tcp"
		12 |     cidr_blocks = ["0.0.0.0/0"]
		13 |   }
		14 | 
		15 |   egress {
		16 |     from_port   = 5671
		17 |     to_port     = 5672
		18 |     protocol    = "tcp"
		19 |     cidr_blocks = ["0.0.0.0/0"]
		20 |   }
		21 | 
		22 |   egress {
		23 |     from_port   = 9352
		24 |     to_port     = 9354
		25 |     protocol    = "tcp"
		26 |     cidr_blocks = ["0.0.0.0/0"]
		27 |   }
		28 | 
		29 |   tags = local.tags
		30 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.powerbi_gateway_reg_credentials
	File: /powerbi-gateway-secret.tf:1-3
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		1 | resource "aws_secretsmanager_secret" "powerbi_gateway_reg_credentials" {
		2 |   name = "${local.environment_configuration.powerbi_gateway_ec2.instance_name}-credentials"
		3 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.openmetadata_entra_id_client_id
	File: /secrets.tf:7-11
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		7  | resource "aws_secretsmanager_secret" "openmetadata_entra_id_client_id" {
		8  |   count = terraform.workspace == "data-platform-apps-and-tools-production" ? 1 : 0
		9  | 
		10 |   name = "openmetadata/entra-id/client-id"
		11 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.openmetadata_entra_id_tenant_id
	File: /secrets.tf:13-17
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		13 | resource "aws_secretsmanager_secret" "openmetadata_entra_id_tenant_id" {
		14 |   count = terraform.workspace == "data-platform-apps-and-tools-production" ? 1 : 0
		15 | 
		16 |   name = "openmetadata/entra-id/tenant-id"
		17 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.github_app_arc_app_id
	File: /secrets.tf:19-23
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		19 | resource "aws_secretsmanager_secret" "github_app_arc_app_id" {
		20 |   count = terraform.workspace == "data-platform-apps-and-tools-production" ? 1 : 0
		21 | 
		22 |   name = "github/arc/app-id"
		23 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.github_app_arc_install_id
	File: /secrets.tf:25-29
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		25 | resource "aws_secretsmanager_secret" "github_app_arc_install_id" {
		26 |   count = terraform.workspace == "data-platform-apps-and-tools-production" ? 1 : 0
		27 | 
		28 |   name = "github/arc/install-id"
		29 | }

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: aws_secretsmanager_secret.github_app_arc_private_key
	File: /secrets.tf:31-35
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-57

		31 | resource "aws_secretsmanager_secret" "github_app_arc_private_key" {
		32 |   count = terraform.workspace == "data-platform-apps-and-tools-production" ? 1 : 0
		33 | 
		34 |   name = "github/arc/private-key"
		35 | }


checkov_exitcode=1

CTFLint Scan Failed

Show Output 
*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
terraform/environments/data-platform-apps-and-tools

*****************************

Running tflint in terraform/environments/data-platform-apps-and-tools
Excluding the following checks: terraform_unused_declarations
4 issue(s) found:

Warning: Duplicate key: "airflow_execution_role_name", first defined at terraform/environments/data-platform-apps-and-tools/environment-configuration.tf:31,7-34 (terraform_map_duplicate_keys)

  on terraform/environments/data-platform-apps-and-tools/environment-configuration.tf line 35:
  35:       airflow_execution_role_name   = "${local.application_name}-${local.environment}-airflow-execution"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_map_duplicate_keys.md

Warning: Duplicate key: "eks_cluster_name", first defined at terraform/environments/data-platform-apps-and-tools/environment-configuration.tf:17,7-23 (terraform_map_duplicate_keys)

  on terraform/environments/data-platform-apps-and-tools/environment-configuration.tf line 68:
  68:       eks_cluster_name               = "apps-tools-development"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_map_duplicate_keys.md

Warning: Duplicate key: "eks_cluster_name", first defined at terraform/environments/data-platform-apps-and-tools/environment-configuration.tf:105,7-23 (terraform_map_duplicate_keys)

  on terraform/environments/data-platform-apps-and-tools/environment-configuration.tf line 169:
 169:       eks_cluster_name               = "apps-tools-production"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_map_duplicate_keys.md

Warning: Missing version constraint for provider "random" in `required_providers` (terraform_required_providers)

  on terraform/environments/data-platform-apps-and-tools/random.tf line 24:
  24: resource "random_password" "datahub_rds" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

tflint_exitcode=2

Trivy Scan Success

Show Output 
*****************************

Trivy will check the following folders:
terraform/environments/data-platform-apps-and-tools

*****************************

Running Trivy in terraform/environments/data-platform-apps-and-tools
2025-01-07T17:14:50Z	INFO	[vulndb] Need to update DB
2025-01-07T17:14:50Z	INFO	[vulndb] Downloading vulnerability DB...
2025-01-07T17:14:50Z	INFO	[vulndb] Downloading artifact...	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-07T17:14:53Z	INFO	[vulndb] Artifact successfully downloaded	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-07T17:14:53Z	INFO	[vuln] Vulnerability scanning is enabled
2025-01-07T17:14:53Z	INFO	[misconfig] Misconfiguration scanning is enabled
2025-01-07T17:14:53Z	INFO	[misconfig] Need to update the built-in checks
2025-01-07T17:14:53Z	INFO	[misconfig] Downloading the built-in checks...
160.80 KiB / 160.80 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2025-01-07T17:14:53Z	INFO	[secret] Secret scanning is enabled
2025-01-07T17:14:53Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-07T17:14:53Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-07T17:14:55Z	WARN	[pip] Unable to find python `site-packages` directory. License detection is skipped.	err="site-packages directory not found"
2025-01-07T17:14:55Z	INFO	[terraform scanner] Scanning root module	file_path="."
2025-01-07T17:14:55Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="networking"
2025-01-07T17:14:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="data.aws_subnet.private" value="cty.NilVal"
2025-01-07T17:14:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.auth0_log_streams" value="cty.NilVal"
2025-01-07T17:15:06Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.cluster_autoscaler_role.data.aws_iam_policy_document.cluster_autoscaler[0]" err="1 error occurred:\n\t* invalid for-each in data.aws_iam_policy_document.cluster_autoscaler[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T17:15:06Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.cluster_autoscaler_role.data.aws_iam_policy_document.cluster_autoscaler[0]" err="1 error occurred:\n\t* invalid for-each in data.aws_iam_policy_document.cluster_autoscaler[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T17:15:06Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T17:15:06Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T17:15:06Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T17:15:06Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T17:15:06Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T17:15:06Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T17:15:06Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T17:15:06Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T17:15:06Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T17:15:06Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T17:15:06Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T17:15:06Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T17:15:06Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T17:15:06Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datahub_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T17:15:06Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.eks.aws_ec2_tag.cluster_primary_security_group" value="cty.NilVal"
2025-01-07T17:15:06Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.eks.module.kms.data.aws_iam_policy_document.this[0]" err="2 errors occurred:\n\t* invalid for-each in data.aws_iam_policy_document.this[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in data.aws_iam_policy_document.this[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T17:15:06Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.eks.module.kms.data.aws_iam_policy_document.this[0]" err="2 errors occurred:\n\t* invalid for-each in data.aws_iam_policy_document.this[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in data.aws_iam_policy_document.this[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T17:15:06Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.eks.module.kms.data.aws_iam_policy_document.this[0]" err="1 error occurred:\n\t* invalid for-each in data.aws_iam_policy_document.this[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T17:15:06Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.eks.module.kms.data.aws_iam_policy_document.this[0]" err="1 error occurred:\n\t* invalid for-each in data.aws_iam_policy_document.this[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T17:15:06Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.eks.module.eks_managed_node_group[\"general\"].aws_iam_role_policy_attachment.this" value="cty.NilVal"
2025-01-07T17:15:06Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.cluster_autoscaler_role.data.aws_iam_policy_document.cluster_autoscaler[0]" err="1 error occurred:\n\t* invalid for-each in data.aws_iam_policy_document.cluster_autoscaler[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T17:15:06Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.cluster_autoscaler_role.data.aws_iam_policy_document.cluster_autoscaler[0]" err="1 error occurred:\n\t* invalid for-each in data.aws_iam_policy_document.cluster_autoscaler[0].dynamic.statement block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T17:15:07Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.openmetadata_airflow_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T17:15:07Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.openmetadata_airflow_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T17:15:07Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.openmetadata_airflow_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T17:15:07Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.openmetadata_airflow_rds.module.db_instance.aws_db_instance.this[0]" err="2 errors occurred:\n\t* invalid for-each in aws_db_instance.this[0].dynamic.restore_to_point_in_time block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\t* invalid for-each in aws_db_instance.this[0].dynamic.s3_import block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-07T17:15:08Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-public-egress-sgr" range="git::https:/github.com/terraform-aws-modules/terraform-aws-eks?ref=2cb1fac31b0fc2dd6a236b0c0678df75819c5a3b/node_groups.tf:223"
2025-01-07T17:15:08Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-public-egress-sgr" range="terraform-aws-modules/security-group/aws/main.tf:533"
2025-01-07T17:15:08Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-public-egress-sgr" range="terraform-aws-modules/security-group/aws/main.tf:534"
2025-01-07T17:15:08Z	INFO	[terraform executor] Ignore finding	rule="aws-eks-no-public-cluster-access-to-cidr" range="git::https:/github.com/terraform-aws-modules/terraform-aws-eks?ref=2cb1fac31b0fc2dd6a236b0c0678df75819c5a3b/main.tf:38"
2025-01-07T17:15:08Z	INFO	[terraform executor] Ignore finding	rule="aws-eks-no-public-cluster-access" range="git::https:/github.com/terraform-aws-modules/terraform-aws-eks?ref=2cb1fac31b0fc2dd6a236b0c0678df75819c5a3b/main.tf:37"
2025-01-07T17:15:08Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v7.1.0/main.tf:171-179"
2025-01-07T17:15:08Z	INFO	Number of language-specific files	num=1
2025-01-07T17:15:08Z	INFO	[pip] Detecting vulnerabilities...
2025-01-07T17:15:08Z	INFO	Detected config files	num=10
trivy_exitcode=0

@Gary-H9 Gary-H9 mentioned this pull request Jan 7, 2025
Open
@Gary-H9 Gary-H9 self-assigned this Jan 7, 2025
@Gary-H9 Gary-H9 mentioned this pull request Jan 7, 2025
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@modernisation-platform-ci modernisation-platform-ci modernisation-platform-ci requested changes

Requested changes must be addressed to merge this pull request.

Assignees

@Gary-H9 Gary-H9

Labels
environments-repository Used to exclude PRs from this repo in our Slack PR update
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@Gary-H9 @modernisation-platform-ci