add secretsmanager secrets #219

wullub · 2023-10-24T16:48:18Z

add ability to have secretsmanager secrets per ec2 instance.
We currently have secrets stored as encrypted ssm parameters. SSM params have more limited features, e.g. unable to share cross-account. For some secrets this is needed.
adding secrets here is the best way to have secrets for an individual ec2, and permissions such that only the ec2 can access it.

add secretsmanager secrets

github-actions · 2023-10-24T16:52:13Z

`TFSEC Scan` Success

Show Output

*****************************

TFSEC will check the following folders:
.

*****************************

Running TFSEC in .
Excluding the following checks: AWS089, AWS099, AWS009, AWS097, AWS018

======================================================
tfsec is joining the Trivy family

tfsec will continue to remain available 
for the time being, although our engineering 
attention will be directed at Trivy going forward.

You can read more here: 
https://github.com/aquasecurity/tfsec/discussions/1994
======================================================
  timings
  ──────────────────────────────────────────
  disk i/o             488.504µs
  parsing              13.940751ms
  adaptation           163.201µs
  checks               10.87874ms
  total                25.471196ms

  counts
  ──────────────────────────────────────────
  modules downloaded   0
  modules processed    1
  blocks processed     54
  files read           6

  results
  ──────────────────────────────────────────
  passed               2
  ignored              1
  critical             0
  high                 0
  medium               0
  low                  0


No problems detected!

tfsec_exitcode=0

`Checkov Scan` Failed

Show Output

*****************************

Checkov will check the following folders:
.

*****************************

Running Checkov in .
Excluding the following checks: CKV_GIT_1
terraform scan results:

Passed checks: 56, Failed checks: 1, Skipped checks: 13

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: module.ec2_test_instance.aws_secretsmanager_secret.placeholder
	File: /main.tf:232-242

		232 | resource "aws_secretsmanager_secret" "placeholder" {
		233 |   for_each = local.secretsmanager_secrets
		234 | 
		235 |   name        = "/${var.secretsmanager_secrets_prefix}${var.name}/${each.key}"
		236 |   description = each.value.description
		237 |   kms_key_id  = each.value.kms_key_id
		238 | 
		239 |   tags = merge(local.tags, {
		240 |     Name = "${var.name}-${each.key}"
		241 |   })
		242 | }

github_actions scan results:

Passed checks: 176, Failed checks: 0, Skipped checks: 0


checkov_exitcode=1

`CTFLint Scan` Success

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing `terraform` plugin...
Installed `terraform` (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.2.1)
tflint will check the following folders:
.

*****************************

Running tflint in .
tflint_exitcode=0

github-actions · 2023-10-25T09:11:07Z

`TFSEC Scan` Success

Show Output

*****************************

TFSEC will check the following folders:
.

*****************************

Running TFSEC in .
Excluding the following checks: AWS089, AWS099, AWS009, AWS097, AWS018

======================================================
tfsec is joining the Trivy family

tfsec will continue to remain available 
for the time being, although our engineering 
attention will be directed at Trivy going forward.

You can read more here: 
https://github.com/aquasecurity/tfsec/discussions/1994
======================================================
  timings
  ──────────────────────────────────────────
  disk i/o             237.302µs
  parsing              18.858938ms
  adaptation           210.701µs
  checks               16.580222ms
  total                35.887163ms

  counts
  ──────────────────────────────────────────
  modules downloaded   0
  modules processed    1
  blocks processed     54
  files read           6

  results
  ──────────────────────────────────────────
  passed               2
  ignored              1
  critical             0
  high                 0
  medium               0
  low                  0


No problems detected!

tfsec_exitcode=0

`Checkov Scan` Failed

Show Output

*****************************

Checkov will check the following folders:
.

*****************************

Running Checkov in .
Excluding the following checks: CKV_GIT_1
terraform scan results:

Passed checks: 56, Failed checks: 1, Skipped checks: 13

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: module.ec2_test_instance.aws_secretsmanager_secret.placeholder
	File: /main.tf:232-242

		232 | resource "aws_secretsmanager_secret" "placeholder" {
		233 |   for_each = var.secretsmanager_secrets
		234 | 
		235 |   name        = "/${var.secretsmanager_secrets_prefix}${var.name}/${each.key}"
		236 |   description = each.value.description
		237 |   kms_key_id  = each.value.kms_key_id
		238 | 
		239 |   tags = merge(local.tags, {
		240 |     Name = "${var.name}-${each.key}"
		241 |   })
		242 | }

github_actions scan results:

Passed checks: 176, Failed checks: 0, Skipped checks: 0


checkov_exitcode=1

`CTFLint Scan` Success

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing `terraform` plugin...
Installed `terraform` (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.2.1)
tflint will check the following folders:
.

*****************************

Running tflint in .
tflint_exitcode=0

github-actions · 2023-10-25T12:38:48Z

`TFSEC Scan` Success

Show Output

*****************************

TFSEC will check the following folders:
.

*****************************

Running TFSEC in .
Excluding the following checks: AWS089, AWS099, AWS009, AWS097, AWS018

======================================================
tfsec is joining the Trivy family

tfsec will continue to remain available 
for the time being, although our engineering 
attention will be directed at Trivy going forward.

You can read more here: 
https://github.com/aquasecurity/tfsec/discussions/1994
======================================================
  timings
  ──────────────────────────────────────────
  disk i/o             287.606µs
  parsing              10.474413ms
  adaptation           129.001µs
  checks               8.013586ms
  total                18.904606ms

  counts
  ──────────────────────────────────────────
  modules downloaded   0
  modules processed    1
  blocks processed     54
  files read           6

  results
  ──────────────────────────────────────────
  passed               2
  ignored              1
  critical             0
  high                 0
  medium               0
  low                  0


No problems detected!

tfsec_exitcode=0

`Checkov Scan` Failed

Show Output

*****************************

Checkov will check the following folders:
.

*****************************

Running Checkov in .
Excluding the following checks: CKV_GIT_1
terraform scan results:

Passed checks: 56, Failed checks: 1, Skipped checks: 13

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: module.ec2_test_instance.aws_secretsmanager_secret.placeholder
	File: /main.tf:232-242

		232 | resource "aws_secretsmanager_secret" "placeholder" {
		233 |   for_each = var.secretsmanager_secrets
		234 | 
		235 |   name        = "/${var.secretsmanager_secrets_prefix}${var.name}/${each.key}"
		236 |   description = each.value.description
		237 |   kms_key_id  = each.value.kms_key_id
		238 | 
		239 |   tags = merge(local.tags, {
		240 |     Name = "${var.name}-${each.key}"
		241 |   })
		242 | }

github_actions scan results:

Passed checks: 176, Failed checks: 0, Skipped checks: 0


checkov_exitcode=1

`CTFLint Scan` Success

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing `terraform` plugin...
Installed `terraform` (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.2.1)
tflint will check the following folders:
.

*****************************

Running tflint in .
tflint_exitcode=0

github-actions · 2023-10-25T14:21:00Z

`TFSEC Scan` Success

Show Output

*****************************

TFSEC will check the following folders:
.

*****************************

Running TFSEC in .
Excluding the following checks: AWS089, AWS099, AWS009, AWS097, AWS018

======================================================
tfsec is joining the Trivy family

tfsec will continue to remain available 
for the time being, although our engineering 
attention will be directed at Trivy going forward.

You can read more here: 
https://github.com/aquasecurity/tfsec/discussions/1994
======================================================
  timings
  ──────────────────────────────────────────
  disk i/o             342.401µs
  parsing              11.649162ms
  adaptation           176.801µs
  checks               13.229571ms
  total                25.397935ms

  counts
  ──────────────────────────────────────────
  modules downloaded   0
  modules processed    1
  blocks processed     54
  files read           6

  results
  ──────────────────────────────────────────
  passed               2
  ignored              1
  critical             0
  high                 0
  medium               0
  low                  0


No problems detected!

tfsec_exitcode=0

`Checkov Scan` Failed

Show Output

*****************************

Checkov will check the following folders:
.

*****************************

Running Checkov in .
Excluding the following checks: CKV_GIT_1
terraform scan results:

Passed checks: 56, Failed checks: 1, Skipped checks: 13

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: module.ec2_test_instance.aws_secretsmanager_secret.placeholder
	File: /main.tf:232-242

		232 | resource "aws_secretsmanager_secret" "placeholder" {
		233 |   for_each = var.secretsmanager_secrets
		234 | 
		235 |   name        = "/${var.secretsmanager_secrets_prefix}${var.name}/${each.key}"
		236 |   description = each.value.description
		237 |   kms_key_id  = each.value.kms_key_id
		238 | 
		239 |   tags = merge(local.tags, {
		240 |     Name = "${var.name}-${each.key}"
		241 |   })
		242 | }

github_actions scan results:

Passed checks: 176, Failed checks: 0, Skipped checks: 0


checkov_exitcode=1

`CTFLint Scan` Success

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing `terraform` plugin...
Installed `terraform` (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.2.1)
tflint will check the following folders:
.

*****************************

Running tflint in .
tflint_exitcode=0

github-actions · 2023-10-25T14:33:11Z

`TFSEC Scan` Success

Show Output

*****************************

TFSEC will check the following folders:
.

*****************************

Running TFSEC in .
Excluding the following checks: AWS089, AWS099, AWS009, AWS097, AWS018

======================================================
tfsec is joining the Trivy family

tfsec will continue to remain available 
for the time being, although our engineering 
attention will be directed at Trivy going forward.

You can read more here: 
https://github.com/aquasecurity/tfsec/discussions/1994
======================================================
  timings
  ──────────────────────────────────────────
  disk i/o             191.2µs
  parsing              16.222254ms
  adaptation           115.899µs
  checks               7.291279ms
  total                23.820632ms

  counts
  ──────────────────────────────────────────
  modules downloaded   0
  modules processed    1
  blocks processed     54
  files read           6

  results
  ──────────────────────────────────────────
  passed               2
  ignored              1
  critical             0
  high                 0
  medium               0
  low                  0


No problems detected!

tfsec_exitcode=0

`Checkov Scan` Failed

Show Output

*****************************

Checkov will check the following folders:
.

*****************************

Running Checkov in .
Excluding the following checks: CKV_GIT_1
terraform scan results:

Passed checks: 56, Failed checks: 1, Skipped checks: 13

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: module.ec2_test_instance.aws_secretsmanager_secret.placeholder
	File: /main.tf:232-243

		232 | resource "aws_secretsmanager_secret" "placeholder" {
		233 |   #checkov:skip=Check: CKV2_AWS_57: Ensure Secrets Manager secrets should have automatic rotation enabled
		234 |   for_each = var.secretsmanager_secrets
		235 | 
		236 |   name        = "/${var.secretsmanager_secrets_prefix}${var.name}/${each.key}"
		237 |   description = each.value.description
		238 |   kms_key_id  = each.value.kms_key_id
		239 | 
		240 |   tags = merge(local.tags, {
		241 |     Name = "${var.name}-${each.key}"
		242 |   })
		243 | }

github_actions scan results:

Passed checks: 176, Failed checks: 0, Skipped checks: 0


checkov_exitcode=1

`CTFLint Scan` Success

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing `terraform` plugin...
Installed `terraform` (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.2.1)
tflint will check the following folders:
.

*****************************

Running tflint in .
tflint_exitcode=0

github-actions · 2023-10-25T14:36:02Z

`TFSEC Scan` Success

Show Output

*****************************

TFSEC will check the following folders:
.

*****************************

Running TFSEC in .
Excluding the following checks: AWS089, AWS099, AWS009, AWS097, AWS018

======================================================
tfsec is joining the Trivy family

tfsec will continue to remain available 
for the time being, although our engineering 
attention will be directed at Trivy going forward.

You can read more here: 
https://github.com/aquasecurity/tfsec/discussions/1994
======================================================
  timings
  ──────────────────────────────────────────
  disk i/o             475.218µs
  parsing              13.269477ms
  adaptation           346.312µs
  checks               10.483778ms
  total                24.574785ms

  counts
  ──────────────────────────────────────────
  modules downloaded   0
  modules processed    1
  blocks processed     54
  files read           6

  results
  ──────────────────────────────────────────
  passed               5
  ignored              1
  critical             0
  high                 0
  medium               0
  low                  0


No problems detected!

tfsec_exitcode=0

`Checkov Scan` Failed

Show Output

*****************************

Checkov will check the following folders:
.

*****************************

Running Checkov in .
Excluding the following checks: CKV_GIT_1
terraform scan results:

Passed checks: 56, Failed checks: 1, Skipped checks: 13

Check: CKV2_AWS_57: "Ensure Secrets Manager secrets should have automatic rotation enabled"
	FAILED for resource: module.ec2_test_instance.aws_secretsmanager_secret.placeholder
	File: /main.tf:232-243

		232 | resource "aws_secretsmanager_secret" "placeholder" {
		233 |   #checkov:skip=Check: CKV2_AWS_57: Ensure Secrets Manager secrets should have automatic rotation enabled
		234 |   for_each = var.secretsmanager_secrets
		235 | 
		236 |   name        = "/${var.secretsmanager_secrets_prefix}${var.name}/${each.key}"
		237 |   description = each.value.description
		238 |   kms_key_id  = each.value.kms_key_id
		239 | 
		240 |   tags = merge(local.tags, {
		241 |     Name = "${var.name}-${each.key}"
		242 |   })
		243 | }

github_actions scan results:

Passed checks: 176, Failed checks: 0, Skipped checks: 0


checkov_exitcode=1

`CTFLint Scan` Success

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing `terraform` plugin...
Installed `terraform` (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.2.1)
tflint will check the following folders:
.

*****************************

Running tflint in .
tflint_exitcode=0

github-actions · 2023-10-25T14:46:39Z

`TFSEC Scan` Success

Show Output

*****************************

TFSEC will check the following folders:
.

*****************************

Running TFSEC in .
Excluding the following checks: AWS089, AWS099, AWS009, AWS097, AWS018

======================================================
tfsec is joining the Trivy family

tfsec will continue to remain available 
for the time being, although our engineering 
attention will be directed at Trivy going forward.

You can read more here: 
https://github.com/aquasecurity/tfsec/discussions/1994
======================================================
  timings
  ──────────────────────────────────────────
  disk i/o             267.601µs
  parsing              49.817136ms
  adaptation           277.201µs
  checks               9.845127ms
  total                60.207065ms

  counts
  ──────────────────────────────────────────
  modules downloaded   0
  modules processed    1
  blocks processed     54
  files read           6

  results
  ──────────────────────────────────────────
  passed               5
  ignored              1
  critical             0
  high                 0
  medium               0
  low                  0


No problems detected!

tfsec_exitcode=0

`Checkov Scan` Success

Show Output

*****************************

Checkov will check the following folders:
.

*****************************

Running Checkov in .
Excluding the following checks: CKV_GIT_1
terraform scan results:

Passed checks: 56, Failed checks: 0, Skipped checks: 14

github_actions scan results:

Passed checks: 176, Failed checks: 0, Skipped checks: 0


checkov_exitcode=0

`CTFLint Scan` Success

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing `terraform` plugin...
Installed `terraform` (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.2.1)
tflint will check the following folders:
.

*****************************

Running tflint in .
tflint_exitcode=0

github-actions · 2023-10-25T15:14:14Z

`TFSEC Scan` Success

Show Output

*****************************

TFSEC will check the following folders:
.

*****************************

Running TFSEC in .
Excluding the following checks: AWS089, AWS099, AWS009, AWS097, AWS018

======================================================
tfsec is joining the Trivy family

tfsec will continue to remain available 
for the time being, although our engineering 
attention will be directed at Trivy going forward.

You can read more here: 
https://github.com/aquasecurity/tfsec/discussions/1994
======================================================
  timings
  ──────────────────────────────────────────
  disk i/o             288.002µs
  parsing              15.712085ms
  adaptation           267.303µs
  checks               10.464822ms
  total                26.732212ms

  counts
  ──────────────────────────────────────────
  modules downloaded   0
  modules processed    1
  blocks processed     54
  files read           6

  results
  ──────────────────────────────────────────
  passed               5
  ignored              1
  critical             0
  high                 0
  medium               0
  low                  0


No problems detected!

tfsec_exitcode=0

`Checkov Scan` Success

Show Output

*****************************

Checkov will check the following folders:
.

*****************************

Running Checkov in .
Excluding the following checks: CKV_GIT_1
terraform scan results:

Passed checks: 56, Failed checks: 0, Skipped checks: 14

github_actions scan results:

Passed checks: 176, Failed checks: 0, Skipped checks: 0


checkov_exitcode=0

`CTFLint Scan` Success

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing `terraform` plugin...
Installed `terraform` (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.2.1)
tflint will check the following folders:
.

*****************************

Running tflint in .
tflint_exitcode=0

add secretsmanager secrets

ad2ee52

add secretsmanager secrets

wullub requested a review from a team as a code owner October 24, 2023 16:48

Commit changes made by code formatters

2a352ba

Update main.tf

0ded10d

Update main.tf

4b37aa7

Update variables.tf

00454f5

robertsweetman previously approved these changes Oct 25, 2023

View reviewed changes

Update main.tf

90e4868

wullub dismissed robertsweetman’s stale review via 90e4868 October 25, 2023 14:27

Update variables.tf

82782fd

Update main.tf

d60c050

robertsweetman previously approved these changes Oct 25, 2023

View reviewed changes

Update main.tf

9f373c5

wullub dismissed robertsweetman’s stale review via 9f373c5 October 25, 2023 15:10

dms1981 approved these changes Oct 25, 2023

View reviewed changes

wullub merged commit fc43a58 into main Oct 25, 2023
3 of 4 checks passed

wullub deleted the add-secretsmanager-secrets branch October 25, 2023 15:52

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

add secretsmanager secrets #219

add secretsmanager secrets #219

wullub commented Oct 24, 2023 •

edited

Loading

github-actions bot commented Oct 24, 2023

github-actions bot commented Oct 25, 2023

github-actions bot commented Oct 25, 2023

github-actions bot commented Oct 25, 2023

github-actions bot commented Oct 25, 2023

github-actions bot commented Oct 25, 2023

github-actions bot commented Oct 25, 2023

github-actions bot commented Oct 25, 2023

add secretsmanager secrets #219

add secretsmanager secrets #219

Conversation

wullub commented Oct 24, 2023 • edited Loading

github-actions bot commented Oct 24, 2023

TFSEC Scan Success

Checkov Scan Failed

CTFLint Scan Success

github-actions bot commented Oct 25, 2023

TFSEC Scan Success

Checkov Scan Failed

CTFLint Scan Success

github-actions bot commented Oct 25, 2023

TFSEC Scan Success

Checkov Scan Failed

CTFLint Scan Success

github-actions bot commented Oct 25, 2023

TFSEC Scan Success

Checkov Scan Failed

CTFLint Scan Success

github-actions bot commented Oct 25, 2023

TFSEC Scan Success

Checkov Scan Failed

CTFLint Scan Success

github-actions bot commented Oct 25, 2023

TFSEC Scan Success

Checkov Scan Failed

CTFLint Scan Success

github-actions bot commented Oct 25, 2023

TFSEC Scan Success

Checkov Scan Success

CTFLint Scan Success

github-actions bot commented Oct 25, 2023

TFSEC Scan Success

Checkov Scan Success

CTFLint Scan Success

wullub commented Oct 24, 2023 •

edited

Loading

`TFSEC Scan` Success

`Checkov Scan` Failed

`CTFLint Scan` Success

`TFSEC Scan` Success

`Checkov Scan` Failed

`CTFLint Scan` Success

`TFSEC Scan` Success

`Checkov Scan` Failed

`CTFLint Scan` Success

`TFSEC Scan` Success

`Checkov Scan` Failed

`CTFLint Scan` Success

`TFSEC Scan` Success

`Checkov Scan` Failed

`CTFLint Scan` Success

`TFSEC Scan` Success

`Checkov Scan` Failed

`CTFLint Scan` Success

`TFSEC Scan` Success

`Checkov Scan` Success

`CTFLint Scan` Success

`TFSEC Scan` Success

`Checkov Scan` Success

`CTFLint Scan` Success