Feature/baselines changes 6490

[SteveLinden]

Initial test routines added some time ago. These have not, yet, been thoroughly tested.

[github-actions]

Trivy Scan Failed

Show Output

```hcl

---

Trivy will check the following folders:
modules/cloudtrail test/unit-test

---

Running Trivy in modules/cloudtrail
2024-06-21T09:27:43Z INFO Need to update DB
2024-06-21T09:27:43Z INFO Downloading DB... repository="ghcr.io/aquasecurity/trivy-db:2"
2024-06-21T09:27:44Z INFO Vulnerability scanning is enabled
2024-06-21T09:27:44Z INFO Misconfiguration scanning is enabled
2024-06-21T09:27:44Z INFO Need to update the built-in policies
2024-06-21T09:27:44Z INFO Downloading the built-in policies...
53.79 KiB / 53.79 KiB [-----------------------------------------------------------] 100.00% ? p/s 0s2024-06-21T09:27:45Z INFO Secret scanning is enabled
2024-06-21T09:27:45Z INFO If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-06-21T09:27:45Z INFO Please see also https://aquasecurity.github.io/trivy/v0.52/docs/scanner/secret/#recommendation for faster secret detection
2024-06-21T09:27:45Z INFO Number of language-specific files num=0
2024-06-21T09:27:45Z INFO Detected config files num=2

main.tf (terraform)

Tests: 5 (SUCCESSES: 4, FAILURES: 0, EXCEPTIONS: 1)
Failures: 0 (HIGH: 0, CRITICAL: 0)

trivy_exitcode=0

---

Running Trivy in test/unit-test
2024-06-21T09:27:45Z INFO Vulnerability scanning is enabled
2024-06-21T09:27:45Z INFO Misconfiguration scanning is enabled
2024-06-21T09:27:45Z INFO Secret scanning is enabled
2024-06-21T09:27:45Z INFO If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-06-21T09:27:45Z INFO Please see also https://aquasecurity.github.io/trivy/v0.52/docs/scanner/secret/#recommendation for faster secret detection
2024-06-21T09:27:46Z INFO Number of language-specific files num=0
2024-06-21T09:27:46Z INFO Detected config files num=2

main.tf (terraform)

Tests: 2 (SUCCESSES: 1, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Topic does not have encryption enabled.
════════════════════════════════════════
Topics should be encrypted to protect their contents.

See https://avd.aquasec.com/misconfig/avd-aws-0095
────────────────────────────────────────
main.tf:1-4
────────────────────────────────────────
1 ┌ resource "aws_sns_topic" "test_alarms" {
2 │ #checkov:skip=CKV_AWS_26:"encrypted topics do not work with pagerduty subscription"
3 │ name = "test_alarms"
4 └ }
────────────────────────────────────────

trivy_exitcode=1

</details> #### `Checkov Scan` Success
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
modules/cloudtrail test/unit-test

*****************************

Running Checkov in modules/cloudtrail
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
terraform scan results:

Passed checks: 50, Failed checks: 0, Skipped checks: 0


checkov_exitcode=0

*****************************

Running Checkov in test/unit-test
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2024-06-21 09:27:51,532 [MainThread  ] [WARNI]  Module /github/workspace/modules/coudtrail:latest failed to load via <class 'checkov.terraform.module_loading.loaders.local_path_loader.LocalPathLoader'>
2024-06-21 09:27:51,532 [MainThread  ] [WARNI]  Unable to load module - source: /github/workspace/modules/coudtrail, version: latest, error: /github/workspace/modules/coudtrail
terraform scan results:

Passed checks: 2, Failed checks: 0, Skipped checks: 1


checkov_exitcode=0

CTFLint Scan Success

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.5.0)
tflint will check the following folders:
modules/cloudtrail test/unit-test

*****************************

Running tflint in modules/cloudtrail
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=0

*****************************

Running tflint in test/unit-test
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=0

Trivy Scan Failed

Show Output

*****************************

Trivy will check the following folders:
modules/cloudtrail test/unit-test

*****************************

Running Trivy in modules/cloudtrail
2024-06-21T09:27:43Z	INFO	Need to update DB
2024-06-21T09:27:43Z	INFO	Downloading DB...	repository="ghcr.io/aquasecurity/trivy-db:2"
2024-06-21T09:27:44Z	INFO	Vulnerability scanning is enabled
2024-06-21T09:27:44Z	INFO	Misconfiguration scanning is enabled
2024-06-21T09:27:44Z	INFO	Need to update the built-in policies
2024-06-21T09:27:44Z	INFO	Downloading the built-in policies...
53.79 KiB / 53.79 KiB [-----------------------------------------------------------] 100.00% ? p/s 0s2024-06-21T09:27:45Z	INFO	Secret scanning is enabled
2024-06-21T09:27:45Z	INFO	If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-06-21T09:27:45Z	INFO	Please see also https://aquasecurity.github.io/trivy/v0.52/docs/scanner/secret/#recommendation for faster secret detection
2024-06-21T09:27:45Z	INFO	Number of language-specific files	num=0
2024-06-21T09:27:45Z	INFO	Detected config files	num=2

main.tf (terraform)
===================
Tests: 5 (SUCCESSES: 4, FAILURES: 0, EXCEPTIONS: 1)
Failures: 0 (HIGH: 0, CRITICAL: 0)

trivy_exitcode=0

*****************************

Running Trivy in test/unit-test
2024-06-21T09:27:45Z	INFO	Vulnerability scanning is enabled
2024-06-21T09:27:45Z	INFO	Misconfiguration scanning is enabled
2024-06-21T09:27:45Z	INFO	Secret scanning is enabled
2024-06-21T09:27:45Z	INFO	If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-06-21T09:27:45Z	INFO	Please see also https://aquasecurity.github.io/trivy/v0.52/docs/scanner/secret/#recommendation for faster secret detection
2024-06-21T09:27:46Z	INFO	Number of language-specific files	num=0
2024-06-21T09:27:46Z	INFO	Detected config files	num=2

main.tf (terraform)
===================
Tests: 2 (SUCCESSES: 1, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Topic does not have encryption enabled.
════════════════════════════════════════
Topics should be encrypted to protect their contents.

See https://avd.aquasec.com/misconfig/avd-aws-0095
────────────────────────────────────────
 main.tf:1-4
────────────────────────────────────────
   1 ┌ resource "aws_sns_topic" "test_alarms" {
   2 │   #checkov:skip=CKV_AWS_26:"encrypted topics do not work with pagerduty subscription"
   3 │   name = "test_alarms"
   4 └ }
────────────────────────────────────────


trivy_exitcode=1