Stop checkov "300" error through code

[SteveLinden]

Expected Behavior

At present we have the following in place on the modernisation-platform-terraform-s3-bucket in two places #checkov:skip=CKV_AWS_300: "Ensure S3 lifecycle configuration sets period for aborting failed uploads"

We want to add the code to remove this skip

Actual Behavior

At present an error for the top section
"Check: CKV_AWS_300: “Ensure S3 lifecycle configuration sets period for aborting failed uploads”
FAILED for resource: aws_s3_bucket_lifecycle_configuration.default
File: /main.tf:49-113"
appears. A similar one appears for the lower section.

With the skip in place this stops the check being undertaken and the error does not appear.

There is code in place on the "top" section (line 67 -76) but it does not appear to work currently. This needs to be fixed or replaced.

Steps to Reproduce the Problem

To reproduce the error the skips would need to be reviewed and a PR raised. It's not advisable to do this!

Version

No response

Modules

No response

Account

No response

[dms1981]

This doesn't need to be fixed does it? It looks like a known issue in Checkov: bridgecrewio/checkov#5363

You can see it being handled in code like so:

      abort_incomplete_multipart_upload {
        days_after_initiation = lookup(rule.value, "abort_incomplete_multipart_upload_days", "7")
      }

https://github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket/blob/main/main.tf#L52

[dms1981]

That being the case I'd say this just needs a skip statement. Maybe with a comment to review it later.

[SteveLinden]

Replaced the comment (fits on one line on my resolution) with this and noted the above URL below

#checkov:skip=CKV_AWS_300: "Ensure S3 lifecycle configuration sets period for aborting failed uploads - There is a known checkov error needs to be checked for resolution"
"# URL for error bridgecrewio/checkov#5363"

Added quotes around the second comment in here to prevent the URL listing the site

[SteveLinden]

Did not make the above changes as the current fix requirement cannot be satisfied. We should maybe review this when a fix is implemented on checkov for this feature.

[SteveLinden]

Moved into backlog

[SimonPPledger]

Looks like this has now been resolved, so we can remove the 'skip'

[dms1981]

Agreed @SimonPPledger - I've checked the Chekov issue and it's resolved, so any future failures may be legit. I'll close this issue.