You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Please check the plan carefully before deploying these changes.
⚠️ Making changes to the terraform/environments/bootstrap/member-bootstrap/iam.tf file will alter the IAM permissions for all members on the MP platform. In particular the member-access policy which defines the permissions members have for building IaC in their environments or the github OIDC role that defines the permissions for their application CI/CD pipelines. Please ensure that any permissions changes have been agreed with the wider team.
Trivy will check the following folders:
terraform/environments/bootstrap/member-bootstrap
Running Trivy in terraform/environments/bootstrap/member-bootstrap
2024-05-14T15:38:36Z INFO Need to update DB
2024-05-14T15:38:36Z INFO Downloading DB... repository="ghcr.io/aquasecurity/trivy-db:2"
2024-05-14T15:38:38Z INFO Vulnerability scanning is enabled
2024-05-14T15:38:38Z INFO Misconfiguration scanning is enabled
2024-05-14T15:38:38Z INFO Need to update the built-in policies
2024-05-14T15:38:38Z INFO Downloading the built-in policies...
50.41 KiB / 50.41 KiB [-----------------------------------------------------------] 100.00% ? p/s 0s2024-05-14T15:38:38Z INFO Secret scanning is enabled
2024-05-14T15:38:38Z INFO If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-05-14T15:38:38Z INFO Please see also https://aquasecurity.github.io/trivy/v0.51/docs/scanner/secret/#recommendation for faster secret detection
2024-05-14T15:38:44Z INFO Number of language-specific files num=0
2024-05-14T15:38:44Z INFO Detected config files num=5
</details> #### `Checkov Scan` Success
<details><summary>Show Output</summary>
```hcl
*****************************
Checkov will check the following folders:
terraform/environments/bootstrap/member-bootstrap
*****************************
Running Checkov in terraform/environments/bootstrap/member-bootstrap
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2024-05-14 15:38:46,821 [MainThread ] [WARNI] Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-cross-account-access?ref=6819b090bce6d3068d55c7c7b9b3fd18c9dca648:None (for external modules, the --download-external-modules flag is required)
2024-05-14 15:38:46,822 [MainThread ] [WARNI] Failed to download module github.com/ministryofjustice/modernisation-platform-github-oidc-role?ref=c3bde7c787038ff5536bfb1b73781072edbb74da:None (for external modules, the --download-external-modules flag is required)
2024-05-14 15:38:46,822 [MainThread ] [WARNI] Failed to download module github.com/ministryofjustice/modernisation-platform-github-oidc-provider?ref=82f546bd5f002674138a2ccdade7d7618c6758b3:None (for external modules, the --download-external-modules flag is required)
2024-05-14 15:38:46,822 [MainThread ] [WARNI] Failed to download module terraform-aws-modules/iam/aws//modules/iam-assumable-role:~> 5 (for external modules, the --download-external-modules flag is required)
2024-05-14 15:38:46,822 [MainThread ] [WARNI] Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-pagerduty-integration?ref=0179859e6fafc567843cd55c0b05d325d5012dc4:None (for external modules, the --download-external-modules flag is required)
2024-05-14 15:38:46,822 [MainThread ] [WARNI] Failed to download module terraform-aws-modules/iam/aws//modules/iam-assumable-roles:~> 5 (for external modules, the --download-external-modules flag is required)
terraform scan results:
Passed checks: 129, Failed checks: 0, Skipped checks: 51
checkov_exitcode=0
CTFLint Scan Success
Show Output
*****************************
Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version:0.5.0)
tflint will check the following folders:
terraform/environments/bootstrap/member-bootstrap
*****************************
Running tflint in terraform/environments/bootstrap/member-bootstrap
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=0
Trivy Scan Success
Show Output
*****************************
Trivy will check the following folders:
terraform/environments/bootstrap/member-bootstrap
*****************************
Running Trivy in terraform/environments/bootstrap/member-bootstrap
2024-05-14T15:38:36Z INFO Need to update DB
2024-05-14T15:38:36Z INFO Downloading DB...repository="ghcr.io/aquasecurity/trivy-db:2"2024-05-14T15:38:38Z INFO Vulnerability scanning is enabled
2024-05-14T15:38:38Z INFO Misconfiguration scanning is enabled
2024-05-14T15:38:38Z INFO Need to update the built-in policies
2024-05-14T15:38:38Z INFO Downloading the built-in policies...50.41 KiB /50.41 KiB [-----------------------------------------------------------] 100.00%? p/s 0s2024-05-14T15:38:38Z INFO Secret scanning is enabled
2024-05-14T15:38:38Z INFO If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-05-14T15:38:38Z INFO Please see also https://aquasecurity.github.io/trivy/v0.51/docs/scanner/secret/#recommendation for faster secret detection2024-05-14T15:38:44Z INFO Number of language-specific files num=02024-05-14T15:38:44Z INFO Detected config files num=5
github.com/ministryofjustice/modernisation-platform-github-oidc-role?ref=c3bde7c787038ff5536bfb1b73781072edbb74da/main.tf (terraform)
=====================================================================================================================================
Tests:3 (SUCCESSES:0, FAILURES:0, EXCEPTIONS:3)
Failures:0 (HIGH:0, CRITICAL:0)
iam.tf (terraform)
==================
Tests:162 (SUCCESSES:0, FAILURES:0, EXCEPTIONS:162)
Failures:0 (HIGH:0, CRITICAL:0)
instance-scheduler.tf (terraform)
=================================
Tests:13 (SUCCESSES:0, FAILURES:0, EXCEPTIONS:13)
Failures:0 (HIGH:0, CRITICAL:0)
ssm.tf (terraform)
==================
Tests:8 (SUCCESSES:0, FAILURES:0, EXCEPTIONS:8)
Failures:0 (HIGH:0, CRITICAL:0)
trivy_exitcode=0
dms1981
changed the title
Added macie2 to MemberInfrastructureAccess do macie is available everywhere
Added macie2 to MemberInfrastructureAccess so macie is available everywhere
May 15, 2024
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
dms1981
changed the title
A reference to the issue / Description of it
To set up macie access for everyone, everywhere