Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix Unit-Tests #117

Closed
wants to merge 6 commits into from
Closed

Fix Unit-Tests #117

wants to merge 6 commits into from

Conversation

ASTRobinson
Copy link
Contributor

wip

@ASTRobinson ASTRobinson requested a review from a team as a code owner October 2, 2024 20:03
@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Oct 2, 2024

Trivy Scan Success

Show Output ```hcl

Trivy will check the following folders:
test/unit-test

Running Trivy in test/unit-test
2024-10-02T20:05:48Z INFO [db] Need to update DB
2024-10-02T20:05:48Z INFO [db] Downloading DB... repository="ghcr.io/aquasecurity/trivy-db:2"
2024-10-02T20:05:50Z INFO [vuln] Vulnerability scanning is enabled
2024-10-02T20:05:50Z INFO [misconfig] Misconfiguration scanning is enabled
2024-10-02T20:05:50Z INFO Need to update the built-in policies
2024-10-02T20:05:50Z INFO Downloading the built-in policies...
74.86 KiB / 74.86 KiB [-----------------------------------------------------------] 100.00% ? p/s 0s2024-10-02T20:05:50Z INFO [secret] Secret scanning is enabled
2024-10-02T20:05:50Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-02T20:05:50Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.55/docs/scanner/secret#recommendation for faster secret detection
2024-10-02T20:05:50Z INFO [terraform scanner] Scanning root module file_path="."
2024-10-02T20:05:50Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="networking"
2024-10-02T20:05:51Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-02T20:05:51Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-02T20:05:51Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-02T20:05:51Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-02T20:05:51Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-02T20:05:51Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-02T20:05:51Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-02T20:05:51Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-02T20:05:51Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-02T20:05:51Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-02T20:05:51Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-02T20:05:51Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-02T20:05:51Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:97-99"
2024-10-02T20:05:51Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:133"
2024-10-02T20:05:51Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:97-99"
2024-10-02T20:05:51Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:133"
2024-10-02T20:05:51Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z INFO [terraform executor] Ignore finding rule="aws-lambda-enable-tracing" range="../../main.tf:59-96"
2024-10-02T20:05:51Z INFO [terraform executor] Ignore finding rule="aws-lambda-enable-tracing" range="../../main.tf:59-96"
2024-10-02T20:05:51Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-bucket-encryption" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=8688bc1/main.tf:8-19"
2024-10-02T20:05:51Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-versioning" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=8688bc1/main.tf:170"
2024-10-02T20:05:51Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=8688bc1/main.tf:157-165"
2024-10-02T20:05:51Z INFO Number of language-specific files num=0
2024-10-02T20:05:51Z INFO Detected config files num=4
trivy_exitcode=0

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
test/unit-test

*****************************

Running Checkov in test/unit-test
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2024-10-02 20:05:53,726 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=8688bc1:None (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 76, Failed checks: 2, Skipped checks: 12

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: module.lambda_function_in_vpc.aws_lambda_function.this
	File: /../../main.tf:59-96
	Calling File: /main.tf:161-177
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		59 | resource "aws_lambda_function" "this" { #tfsec:ignore:aws-lambda-enable-tracing
		60 |   #checkov:skip=CKV_AWS_116
		61 |   #checkov:skip=CKV_AWS_117
		62 |   #checkov:skip=CKV_AWS_272 "Code signing not required"
		63 |   #checkov:skip=CKV_AWS_173 "These lambda envvars aren't sensitive and don't need a cmk. Default AWS KMS key is sufficient"
		64 |   function_name                  = var.function_name
		65 |   description                    = var.description
		66 |   reserved_concurrent_executions = var.reserved_concurrent_executions
		67 |   image_uri                      = var.image_uri
		68 |   filename                       = var.filename
		69 |   handler                        = var.handler
		70 |   runtime                        = var.runtime
		71 |   source_code_hash               = var.source_code_hash
		72 |   package_type                   = var.package_type
		73 |   role                           = var.create_role ? aws_iam_role.this[0].arn : var.lambda_role
		74 |   timeout                        = var.timeout
		75 |   memory_size                    = var.memory_size
		76 | 
		77 |   dynamic "tracing_config" {
		78 |     for_each = var.tracing_mode != null ? [1] : []
		79 |     content {
		80 |       mode = var.tracing_mode
		81 |     }
		82 |   }
		83 |   dynamic "environment" {
		84 |     for_each = length(keys(var.environment_variables)) > 0 ? [1] : []
		85 |     content {
		86 |       variables = var.environment_variables
		87 |     }
		88 |   }
		89 |   dynamic "vpc_config" {
		90 |     for_each = var.vpc_subnet_ids != null && var.vpc_security_group_ids != null ? [true] : []
		91 |     content {
		92 |       security_group_ids = var.vpc_security_group_ids
		93 |       subnet_ids         = var.vpc_subnet_ids
		94 |     }
		95 |   }
		96 | }

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: module.module_test.aws_lambda_function.this
	File: /../../main.tf:59-96
	Calling File: /main.tf:2-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		59 | resource "aws_lambda_function" "this" { #tfsec:ignore:aws-lambda-enable-tracing
		60 |   #checkov:skip=CKV_AWS_116
		61 |   #checkov:skip=CKV_AWS_117
		62 |   #checkov:skip=CKV_AWS_272 "Code signing not required"
		63 |   #checkov:skip=CKV_AWS_173 "These lambda envvars aren't sensitive and don't need a cmk. Default AWS KMS key is sufficient"
		64 |   function_name                  = var.function_name
		65 |   description                    = var.description
		66 |   reserved_concurrent_executions = var.reserved_concurrent_executions
		67 |   image_uri                      = var.image_uri
		68 |   filename                       = var.filename
		69 |   handler                        = var.handler
		70 |   runtime                        = var.runtime
		71 |   source_code_hash               = var.source_code_hash
		72 |   package_type                   = var.package_type
		73 |   role                           = var.create_role ? aws_iam_role.this[0].arn : var.lambda_role
		74 |   timeout                        = var.timeout
		75 |   memory_size                    = var.memory_size
		76 | 
		77 |   dynamic "tracing_config" {
		78 |     for_each = var.tracing_mode != null ? [1] : []
		79 |     content {
		80 |       mode = var.tracing_mode
		81 |     }
		82 |   }
		83 |   dynamic "environment" {
		84 |     for_each = length(keys(var.environment_variables)) > 0 ? [1] : []
		85 |     content {
		86 |       variables = var.environment_variables
		87 |     }
		88 |   }
		89 |   dynamic "vpc_config" {
		90 |     for_each = var.vpc_subnet_ids != null && var.vpc_security_group_ids != null ? [true] : []
		91 |     content {
		92 |       security_group_ids = var.vpc_security_group_ids
		93 |       subnet_ids         = var.vpc_subnet_ids
		94 |     }
		95 |   }
		96 | }


checkov_exitcode=1

CTFLint Scan Failed

Show Output 
*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
test/unit-test

*****************************

Running tflint in test/unit-test
Excluding the following checks: terraform_unused_declarations
3 issue(s) found:

Warning: Missing version constraint for provider "http" in `required_providers` (terraform_required_providers)

  on test/unit-test/locals.tf line 7:
   7: data "http" "environments_file" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on test/unit-test/main.tf line 147:
 147:       "${module.s3-bucket.bucket.arn}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: Missing version constraint for provider "archive" in `required_providers` (terraform_required_providers)

  on test/unit-test/main.tf line 226:
 226: data "archive_file" "lambda-zip" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

tflint_exitcode=2

Trivy Scan Success

Show Output 
*****************************

Trivy will check the following folders:
test/unit-test

*****************************

Running Trivy in test/unit-test
2024-10-02T20:05:48Z	INFO	[db] Need to update DB
2024-10-02T20:05:48Z	INFO	[db] Downloading DB...	repository="ghcr.io/aquasecurity/trivy-db:2"
2024-10-02T20:05:50Z	INFO	[vuln] Vulnerability scanning is enabled
2024-10-02T20:05:50Z	INFO	[misconfig] Misconfiguration scanning is enabled
2024-10-02T20:05:50Z	INFO	Need to update the built-in policies
2024-10-02T20:05:50Z	INFO	Downloading the built-in policies...
74.86 KiB / 74.86 KiB [-----------------------------------------------------------] 100.00% ? p/s 0s2024-10-02T20:05:50Z	INFO	[secret] Secret scanning is enabled
2024-10-02T20:05:50Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-02T20:05:50Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.55/docs/scanner/secret#recommendation for faster secret detection
2024-10-02T20:05:50Z	INFO	[terraform scanner] Scanning root module	file_path="."
2024-10-02T20:05:50Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="networking"
2024-10-02T20:05:51Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-02T20:05:51Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-02T20:05:51Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-02T20:05:51Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-02T20:05:51Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-02T20:05:51Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-02T20:05:51Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-02T20:05:51Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-02T20:05:51Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-02T20:05:51Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-02T20:05:51Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-02T20:05:51Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-02T20:05:51Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:97-99"
2024-10-02T20:05:51Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:133"
2024-10-02T20:05:51Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:97-99"
2024-10-02T20:05:51Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:133"
2024-10-02T20:05:51Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:05:51Z	INFO	[terraform executor] Ignore finding	rule="aws-lambda-enable-tracing" range="../../main.tf:59-96"
2024-10-02T20:05:51Z	INFO	[terraform executor] Ignore finding	rule="aws-lambda-enable-tracing" range="../../main.tf:59-96"
2024-10-02T20:05:51Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-bucket-encryption" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=8688bc1/main.tf:8-19"
2024-10-02T20:05:51Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-versioning" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=8688bc1/main.tf:170"
2024-10-02T20:05:51Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=8688bc1/main.tf:157-165"
2024-10-02T20:05:51Z	INFO	Number of language-specific files	num=0
2024-10-02T20:05:51Z	INFO	Detected config files	num=4
trivy_exitcode=0

@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Oct 2, 2024

Trivy Scan Success

Show Output ```hcl

Trivy will check the following folders:
test/unit-test

Running Trivy in test/unit-test
2024-10-02T20:07:42Z INFO [db] Need to update DB
2024-10-02T20:07:42Z INFO [db] Downloading DB... repository="ghcr.io/aquasecurity/trivy-db:2"
2024-10-02T20:07:44Z INFO [vuln] Vulnerability scanning is enabled
2024-10-02T20:07:44Z INFO [misconfig] Misconfiguration scanning is enabled
2024-10-02T20:07:44Z INFO Need to update the built-in policies
2024-10-02T20:07:44Z INFO Downloading the built-in policies...
74.86 KiB / 74.86 KiB [-----------------------------------------------------------] 100.00% ? p/s 0s2024-10-02T20:07:44Z INFO [secret] Secret scanning is enabled
2024-10-02T20:07:44Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-02T20:07:44Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.55/docs/scanner/secret#recommendation for faster secret detection
2024-10-02T20:07:45Z INFO [terraform scanner] Scanning root module file_path="."
2024-10-02T20:07:45Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="networking"
2024-10-02T20:07:45Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-02T20:07:45Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-02T20:07:45Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-02T20:07:45Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-02T20:07:45Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-02T20:07:45Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-02T20:07:45Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-02T20:07:45Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-02T20:07:45Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-02T20:07:45Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-02T20:07:45Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-02T20:07:45Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-02T20:07:45Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:97-99"
2024-10-02T20:07:45Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:133"
2024-10-02T20:07:45Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:97-99"
2024-10-02T20:07:45Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:133"
2024-10-02T20:07:45Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z INFO [terraform executor] Ignore finding rule="aws-lambda-enable-tracing" range="../../main.tf:59-96"
2024-10-02T20:07:45Z INFO [terraform executor] Ignore finding rule="aws-lambda-enable-tracing" range="../../main.tf:59-96"
2024-10-02T20:07:45Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-bucket-encryption" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=8688bc1/main.tf:8-19"
2024-10-02T20:07:45Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-versioning" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=8688bc1/main.tf:170"
2024-10-02T20:07:45Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=8688bc1/main.tf:157-165"
2024-10-02T20:07:45Z INFO Number of language-specific files num=0
2024-10-02T20:07:45Z INFO Detected config files num=4
trivy_exitcode=0

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
test/unit-test

*****************************

Running Checkov in test/unit-test
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2024-10-02 20:07:47,898 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=8688bc1:None (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 76, Failed checks: 2, Skipped checks: 12

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: module.lambda_function_in_vpc.aws_lambda_function.this
	File: /../../main.tf:59-96
	Calling File: /main.tf:161-177
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		59 | resource "aws_lambda_function" "this" { #tfsec:ignore:aws-lambda-enable-tracing
		60 |   #checkov:skip=CKV_AWS_116
		61 |   #checkov:skip=CKV_AWS_117
		62 |   #checkov:skip=CKV_AWS_272 "Code signing not required"
		63 |   #checkov:skip=CKV_AWS_173 "These lambda envvars aren't sensitive and don't need a cmk. Default AWS KMS key is sufficient"
		64 |   function_name                  = var.function_name
		65 |   description                    = var.description
		66 |   reserved_concurrent_executions = var.reserved_concurrent_executions
		67 |   image_uri                      = var.image_uri
		68 |   filename                       = var.filename
		69 |   handler                        = var.handler
		70 |   runtime                        = var.runtime
		71 |   source_code_hash               = var.source_code_hash
		72 |   package_type                   = var.package_type
		73 |   role                           = var.create_role ? aws_iam_role.this[0].arn : var.lambda_role
		74 |   timeout                        = var.timeout
		75 |   memory_size                    = var.memory_size
		76 | 
		77 |   dynamic "tracing_config" {
		78 |     for_each = var.tracing_mode != null ? [1] : []
		79 |     content {
		80 |       mode = var.tracing_mode
		81 |     }
		82 |   }
		83 |   dynamic "environment" {
		84 |     for_each = length(keys(var.environment_variables)) > 0 ? [1] : []
		85 |     content {
		86 |       variables = var.environment_variables
		87 |     }
		88 |   }
		89 |   dynamic "vpc_config" {
		90 |     for_each = var.vpc_subnet_ids != null && var.vpc_security_group_ids != null ? [true] : []
		91 |     content {
		92 |       security_group_ids = var.vpc_security_group_ids
		93 |       subnet_ids         = var.vpc_subnet_ids
		94 |     }
		95 |   }
		96 | }

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: module.module_test.aws_lambda_function.this
	File: /../../main.tf:59-96
	Calling File: /main.tf:2-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		59 | resource "aws_lambda_function" "this" { #tfsec:ignore:aws-lambda-enable-tracing
		60 |   #checkov:skip=CKV_AWS_116
		61 |   #checkov:skip=CKV_AWS_117
		62 |   #checkov:skip=CKV_AWS_272 "Code signing not required"
		63 |   #checkov:skip=CKV_AWS_173 "These lambda envvars aren't sensitive and don't need a cmk. Default AWS KMS key is sufficient"
		64 |   function_name                  = var.function_name
		65 |   description                    = var.description
		66 |   reserved_concurrent_executions = var.reserved_concurrent_executions
		67 |   image_uri                      = var.image_uri
		68 |   filename                       = var.filename
		69 |   handler                        = var.handler
		70 |   runtime                        = var.runtime
		71 |   source_code_hash               = var.source_code_hash
		72 |   package_type                   = var.package_type
		73 |   role                           = var.create_role ? aws_iam_role.this[0].arn : var.lambda_role
		74 |   timeout                        = var.timeout
		75 |   memory_size                    = var.memory_size
		76 | 
		77 |   dynamic "tracing_config" {
		78 |     for_each = var.tracing_mode != null ? [1] : []
		79 |     content {
		80 |       mode = var.tracing_mode
		81 |     }
		82 |   }
		83 |   dynamic "environment" {
		84 |     for_each = length(keys(var.environment_variables)) > 0 ? [1] : []
		85 |     content {
		86 |       variables = var.environment_variables
		87 |     }
		88 |   }
		89 |   dynamic "vpc_config" {
		90 |     for_each = var.vpc_subnet_ids != null && var.vpc_security_group_ids != null ? [true] : []
		91 |     content {
		92 |       security_group_ids = var.vpc_security_group_ids
		93 |       subnet_ids         = var.vpc_subnet_ids
		94 |     }
		95 |   }
		96 | }


checkov_exitcode=1

CTFLint Scan Failed

Show Output 
*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
test/unit-test

*****************************

Running tflint in test/unit-test
Excluding the following checks: terraform_unused_declarations
3 issue(s) found:

Warning: Missing version constraint for provider "http" in `required_providers` (terraform_required_providers)

  on test/unit-test/locals.tf line 7:
   7: data "http" "environments_file" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on test/unit-test/main.tf line 147:
 147:       "${module.s3-bucket.bucket.arn}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: Missing version constraint for provider "archive" in `required_providers` (terraform_required_providers)

  on test/unit-test/main.tf line 226:
 226: data "archive_file" "lambda-zip" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

tflint_exitcode=2

Trivy Scan Success

Show Output 
*****************************

Trivy will check the following folders:
test/unit-test

*****************************

Running Trivy in test/unit-test
2024-10-02T20:07:42Z	INFO	[db] Need to update DB
2024-10-02T20:07:42Z	INFO	[db] Downloading DB...	repository="ghcr.io/aquasecurity/trivy-db:2"
2024-10-02T20:07:44Z	INFO	[vuln] Vulnerability scanning is enabled
2024-10-02T20:07:44Z	INFO	[misconfig] Misconfiguration scanning is enabled
2024-10-02T20:07:44Z	INFO	Need to update the built-in policies
2024-10-02T20:07:44Z	INFO	Downloading the built-in policies...
74.86 KiB / 74.86 KiB [-----------------------------------------------------------] 100.00% ? p/s 0s2024-10-02T20:07:44Z	INFO	[secret] Secret scanning is enabled
2024-10-02T20:07:44Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-02T20:07:44Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.55/docs/scanner/secret#recommendation for faster secret detection
2024-10-02T20:07:45Z	INFO	[terraform scanner] Scanning root module	file_path="."
2024-10-02T20:07:45Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="networking"
2024-10-02T20:07:45Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-02T20:07:45Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-02T20:07:45Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-02T20:07:45Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-02T20:07:45Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-02T20:07:45Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-02T20:07:45Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-02T20:07:45Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-02T20:07:45Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-02T20:07:45Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-02T20:07:45Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-02T20:07:45Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-02T20:07:45Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:97-99"
2024-10-02T20:07:45Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:133"
2024-10-02T20:07:45Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:97-99"
2024-10-02T20:07:45Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:133"
2024-10-02T20:07:45Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:07:45Z	INFO	[terraform executor] Ignore finding	rule="aws-lambda-enable-tracing" range="../../main.tf:59-96"
2024-10-02T20:07:45Z	INFO	[terraform executor] Ignore finding	rule="aws-lambda-enable-tracing" range="../../main.tf:59-96"
2024-10-02T20:07:45Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-bucket-encryption" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=8688bc1/main.tf:8-19"
2024-10-02T20:07:45Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-versioning" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=8688bc1/main.tf:170"
2024-10-02T20:07:45Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=8688bc1/main.tf:157-165"
2024-10-02T20:07:45Z	INFO	Number of language-specific files	num=0
2024-10-02T20:07:45Z	INFO	Detected config files	num=4
trivy_exitcode=0

@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Oct 2, 2024

Trivy Scan Success

Show Output ```hcl

Trivy will check the following folders:
test/unit-test

Running Trivy in test/unit-test
2024-10-02T20:17:13Z INFO [db] Need to update DB
2024-10-02T20:17:13Z INFO [db] Downloading DB... repository="ghcr.io/aquasecurity/trivy-db:2"
2024-10-02T20:17:15Z INFO [vuln] Vulnerability scanning is enabled
2024-10-02T20:17:15Z INFO [misconfig] Misconfiguration scanning is enabled
2024-10-02T20:17:15Z INFO Need to update the built-in policies
2024-10-02T20:17:15Z INFO Downloading the built-in policies...
74.86 KiB / 74.86 KiB [-----------------------------------------------------------] 100.00% ? p/s 0s2024-10-02T20:17:16Z INFO [secret] Secret scanning is enabled
2024-10-02T20:17:16Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-02T20:17:16Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.55/docs/scanner/secret#recommendation for faster secret detection
2024-10-02T20:17:16Z INFO [terraform scanner] Scanning root module file_path="."
2024-10-02T20:17:16Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="networking"
2024-10-02T20:17:17Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-02T20:17:17Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-02T20:17:17Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-02T20:17:17Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-02T20:17:17Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-02T20:17:17Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-02T20:17:17Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-02T20:17:17Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-02T20:17:17Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-02T20:17:17Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-02T20:17:17Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-02T20:17:17Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-02T20:17:17Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:97-99"
2024-10-02T20:17:17Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:133"
2024-10-02T20:17:17Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:97-99"
2024-10-02T20:17:17Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:133"
2024-10-02T20:17:17Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z INFO [terraform executor] Ignore finding rule="aws-lambda-enable-tracing" range="../../main.tf:59-96"
2024-10-02T20:17:17Z INFO [terraform executor] Ignore finding rule="aws-lambda-enable-tracing" range="../../main.tf:59-96"
2024-10-02T20:17:17Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-bucket-encryption" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=8688bc1/main.tf:8-19"
2024-10-02T20:17:17Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-versioning" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=8688bc1/main.tf:170"
2024-10-02T20:17:17Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=8688bc1/main.tf:157-165"
2024-10-02T20:17:17Z INFO Number of language-specific files num=0
2024-10-02T20:17:17Z INFO Detected config files num=4
trivy_exitcode=0

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
test/unit-test

*****************************

Running Checkov in test/unit-test
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2024-10-02 20:17:20,290 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=8688bc1:None (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 76, Failed checks: 2, Skipped checks: 12

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: module.lambda_function_in_vpc.aws_lambda_function.this
	File: /../../main.tf:59-96
	Calling File: /main.tf:161-177
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		59 | resource "aws_lambda_function" "this" { #tfsec:ignore:aws-lambda-enable-tracing
		60 |   #checkov:skip=CKV_AWS_116
		61 |   #checkov:skip=CKV_AWS_117
		62 |   #checkov:skip=CKV_AWS_272 "Code signing not required"
		63 |   #checkov:skip=CKV_AWS_173 "These lambda envvars aren't sensitive and don't need a cmk. Default AWS KMS key is sufficient"
		64 |   function_name                  = var.function_name
		65 |   description                    = var.description
		66 |   reserved_concurrent_executions = var.reserved_concurrent_executions
		67 |   image_uri                      = var.image_uri
		68 |   filename                       = var.filename
		69 |   handler                        = var.handler
		70 |   runtime                        = var.runtime
		71 |   source_code_hash               = var.source_code_hash
		72 |   package_type                   = var.package_type
		73 |   role                           = var.create_role ? aws_iam_role.this[0].arn : var.lambda_role
		74 |   timeout                        = var.timeout
		75 |   memory_size                    = var.memory_size
		76 | 
		77 |   dynamic "tracing_config" {
		78 |     for_each = var.tracing_mode != null ? [1] : []
		79 |     content {
		80 |       mode = var.tracing_mode
		81 |     }
		82 |   }
		83 |   dynamic "environment" {
		84 |     for_each = length(keys(var.environment_variables)) > 0 ? [1] : []
		85 |     content {
		86 |       variables = var.environment_variables
		87 |     }
		88 |   }
		89 |   dynamic "vpc_config" {
		90 |     for_each = var.vpc_subnet_ids != null && var.vpc_security_group_ids != null ? [true] : []
		91 |     content {
		92 |       security_group_ids = var.vpc_security_group_ids
		93 |       subnet_ids         = var.vpc_subnet_ids
		94 |     }
		95 |   }
		96 | }

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: module.module_test.aws_lambda_function.this
	File: /../../main.tf:59-96
	Calling File: /main.tf:2-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		59 | resource "aws_lambda_function" "this" { #tfsec:ignore:aws-lambda-enable-tracing
		60 |   #checkov:skip=CKV_AWS_116
		61 |   #checkov:skip=CKV_AWS_117
		62 |   #checkov:skip=CKV_AWS_272 "Code signing not required"
		63 |   #checkov:skip=CKV_AWS_173 "These lambda envvars aren't sensitive and don't need a cmk. Default AWS KMS key is sufficient"
		64 |   function_name                  = var.function_name
		65 |   description                    = var.description
		66 |   reserved_concurrent_executions = var.reserved_concurrent_executions
		67 |   image_uri                      = var.image_uri
		68 |   filename                       = var.filename
		69 |   handler                        = var.handler
		70 |   runtime                        = var.runtime
		71 |   source_code_hash               = var.source_code_hash
		72 |   package_type                   = var.package_type
		73 |   role                           = var.create_role ? aws_iam_role.this[0].arn : var.lambda_role
		74 |   timeout                        = var.timeout
		75 |   memory_size                    = var.memory_size
		76 | 
		77 |   dynamic "tracing_config" {
		78 |     for_each = var.tracing_mode != null ? [1] : []
		79 |     content {
		80 |       mode = var.tracing_mode
		81 |     }
		82 |   }
		83 |   dynamic "environment" {
		84 |     for_each = length(keys(var.environment_variables)) > 0 ? [1] : []
		85 |     content {
		86 |       variables = var.environment_variables
		87 |     }
		88 |   }
		89 |   dynamic "vpc_config" {
		90 |     for_each = var.vpc_subnet_ids != null && var.vpc_security_group_ids != null ? [true] : []
		91 |     content {
		92 |       security_group_ids = var.vpc_security_group_ids
		93 |       subnet_ids         = var.vpc_subnet_ids
		94 |     }
		95 |   }
		96 | }


checkov_exitcode=1

CTFLint Scan Failed

Show Output 
*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
test/unit-test

*****************************

Running tflint in test/unit-test
Excluding the following checks: terraform_unused_declarations
3 issue(s) found:

Warning: Missing version constraint for provider "http" in `required_providers` (terraform_required_providers)

  on test/unit-test/locals.tf line 7:
   7: data "http" "environments_file" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on test/unit-test/main.tf line 147:
 147:       "${module.s3-bucket.bucket.arn}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: Missing version constraint for provider "archive" in `required_providers` (terraform_required_providers)

  on test/unit-test/main.tf line 226:
 226: data "archive_file" "lambda-zip" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

tflint_exitcode=2

Trivy Scan Success

Show Output 
*****************************

Trivy will check the following folders:
test/unit-test

*****************************

Running Trivy in test/unit-test
2024-10-02T20:17:13Z	INFO	[db] Need to update DB
2024-10-02T20:17:13Z	INFO	[db] Downloading DB...	repository="ghcr.io/aquasecurity/trivy-db:2"
2024-10-02T20:17:15Z	INFO	[vuln] Vulnerability scanning is enabled
2024-10-02T20:17:15Z	INFO	[misconfig] Misconfiguration scanning is enabled
2024-10-02T20:17:15Z	INFO	Need to update the built-in policies
2024-10-02T20:17:15Z	INFO	Downloading the built-in policies...
74.86 KiB / 74.86 KiB [-----------------------------------------------------------] 100.00% ? p/s 0s2024-10-02T20:17:16Z	INFO	[secret] Secret scanning is enabled
2024-10-02T20:17:16Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-02T20:17:16Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.55/docs/scanner/secret#recommendation for faster secret detection
2024-10-02T20:17:16Z	INFO	[terraform scanner] Scanning root module	file_path="."
2024-10-02T20:17:16Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="networking"
2024-10-02T20:17:17Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-02T20:17:17Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-02T20:17:17Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-02T20:17:17Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-02T20:17:17Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-02T20:17:17Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-02T20:17:17Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-02T20:17:17Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-02T20:17:17Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-02T20:17:17Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-02T20:17:17Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-02T20:17:17Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-02T20:17:17Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:97-99"
2024-10-02T20:17:17Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:133"
2024-10-02T20:17:17Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:97-99"
2024-10-02T20:17:17Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:133"
2024-10-02T20:17:17Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:17:17Z	INFO	[terraform executor] Ignore finding	rule="aws-lambda-enable-tracing" range="../../main.tf:59-96"
2024-10-02T20:17:17Z	INFO	[terraform executor] Ignore finding	rule="aws-lambda-enable-tracing" range="../../main.tf:59-96"
2024-10-02T20:17:17Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-bucket-encryption" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=8688bc1/main.tf:8-19"
2024-10-02T20:17:17Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-versioning" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=8688bc1/main.tf:170"
2024-10-02T20:17:17Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=8688bc1/main.tf:157-165"
2024-10-02T20:17:17Z	INFO	Number of language-specific files	num=0
2024-10-02T20:17:17Z	INFO	Detected config files	num=4
trivy_exitcode=0

@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Oct 2, 2024

Trivy Scan Success

Show Output ```hcl

Trivy will check the following folders:
test/unit-test

Running Trivy in test/unit-test
2024-10-02T20:35:35Z INFO [db] Need to update DB
2024-10-02T20:35:35Z INFO [db] Downloading DB... repository="ghcr.io/aquasecurity/trivy-db:2"
2024-10-02T20:35:37Z INFO [vuln] Vulnerability scanning is enabled
2024-10-02T20:35:37Z INFO [misconfig] Misconfiguration scanning is enabled
2024-10-02T20:35:37Z INFO Need to update the built-in policies
2024-10-02T20:35:37Z INFO Downloading the built-in policies...
74.86 KiB / 74.86 KiB [-----------------------------------------------------------] 100.00% ? p/s 0s2024-10-02T20:35:37Z INFO [secret] Secret scanning is enabled
2024-10-02T20:35:37Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-02T20:35:37Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.55/docs/scanner/secret#recommendation for faster secret detection
2024-10-02T20:35:38Z INFO [terraform scanner] Scanning root module file_path="."
2024-10-02T20:35:38Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="networking"
2024-10-02T20:35:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-02T20:35:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-02T20:35:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-02T20:35:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-02T20:35:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-02T20:35:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-02T20:35:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-02T20:35:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-02T20:35:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-02T20:35:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-02T20:35:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-02T20:35:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-02T20:35:38Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:97-99"
2024-10-02T20:35:38Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:133"
2024-10-02T20:35:38Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:97-99"
2024-10-02T20:35:38Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:133"
2024-10-02T20:35:38Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z INFO [terraform executor] Ignore finding rule="aws-lambda-enable-tracing" range="../../main.tf:59-96"
2024-10-02T20:35:38Z INFO [terraform executor] Ignore finding rule="aws-lambda-enable-tracing" range="../../main.tf:59-96"
2024-10-02T20:35:38Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-bucket-encryption" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=52a40b0dd18aaef0d7c5565d93cc8997aad79636/main.tf:16-27"
2024-10-02T20:35:38Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-versioning" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=52a40b0dd18aaef0d7c5565d93cc8997aad79636/main.tf:202"
2024-10-02T20:35:38Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=52a40b0dd18aaef0d7c5565d93cc8997aad79636/main.tf:187-197"
2024-10-02T20:35:38Z INFO Number of language-specific files num=0
2024-10-02T20:35:38Z INFO Detected config files num=4
trivy_exitcode=0

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
test/unit-test

*****************************

Running Checkov in test/unit-test
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2024-10-02 20:35:40,837 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=52a40b0dd18aaef0d7c5565d93cc8997aad79636:None (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 76, Failed checks: 2, Skipped checks: 12

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: module.lambda_function_in_vpc.aws_lambda_function.this
	File: /../../main.tf:59-96
	Calling File: /main.tf:161-177
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		59 | resource "aws_lambda_function" "this" { #tfsec:ignore:aws-lambda-enable-tracing
		60 |   #checkov:skip=CKV_AWS_116
		61 |   #checkov:skip=CKV_AWS_117
		62 |   #checkov:skip=CKV_AWS_272 "Code signing not required"
		63 |   #checkov:skip=CKV_AWS_173 "These lambda envvars aren't sensitive and don't need a cmk. Default AWS KMS key is sufficient"
		64 |   function_name                  = var.function_name
		65 |   description                    = var.description
		66 |   reserved_concurrent_executions = var.reserved_concurrent_executions
		67 |   image_uri                      = var.image_uri
		68 |   filename                       = var.filename
		69 |   handler                        = var.handler
		70 |   runtime                        = var.runtime
		71 |   source_code_hash               = var.source_code_hash
		72 |   package_type                   = var.package_type
		73 |   role                           = var.create_role ? aws_iam_role.this[0].arn : var.lambda_role
		74 |   timeout                        = var.timeout
		75 |   memory_size                    = var.memory_size
		76 | 
		77 |   dynamic "tracing_config" {
		78 |     for_each = var.tracing_mode != null ? [1] : []
		79 |     content {
		80 |       mode = var.tracing_mode
		81 |     }
		82 |   }
		83 |   dynamic "environment" {
		84 |     for_each = length(keys(var.environment_variables)) > 0 ? [1] : []
		85 |     content {
		86 |       variables = var.environment_variables
		87 |     }
		88 |   }
		89 |   dynamic "vpc_config" {
		90 |     for_each = var.vpc_subnet_ids != null && var.vpc_security_group_ids != null ? [true] : []
		91 |     content {
		92 |       security_group_ids = var.vpc_security_group_ids
		93 |       subnet_ids         = var.vpc_subnet_ids
		94 |     }
		95 |   }
		96 | }

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: module.module_test.aws_lambda_function.this
	File: /../../main.tf:59-96
	Calling File: /main.tf:2-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		59 | resource "aws_lambda_function" "this" { #tfsec:ignore:aws-lambda-enable-tracing
		60 |   #checkov:skip=CKV_AWS_116
		61 |   #checkov:skip=CKV_AWS_117
		62 |   #checkov:skip=CKV_AWS_272 "Code signing not required"
		63 |   #checkov:skip=CKV_AWS_173 "These lambda envvars aren't sensitive and don't need a cmk. Default AWS KMS key is sufficient"
		64 |   function_name                  = var.function_name
		65 |   description                    = var.description
		66 |   reserved_concurrent_executions = var.reserved_concurrent_executions
		67 |   image_uri                      = var.image_uri
		68 |   filename                       = var.filename
		69 |   handler                        = var.handler
		70 |   runtime                        = var.runtime
		71 |   source_code_hash               = var.source_code_hash
		72 |   package_type                   = var.package_type
		73 |   role                           = var.create_role ? aws_iam_role.this[0].arn : var.lambda_role
		74 |   timeout                        = var.timeout
		75 |   memory_size                    = var.memory_size
		76 | 
		77 |   dynamic "tracing_config" {
		78 |     for_each = var.tracing_mode != null ? [1] : []
		79 |     content {
		80 |       mode = var.tracing_mode
		81 |     }
		82 |   }
		83 |   dynamic "environment" {
		84 |     for_each = length(keys(var.environment_variables)) > 0 ? [1] : []
		85 |     content {
		86 |       variables = var.environment_variables
		87 |     }
		88 |   }
		89 |   dynamic "vpc_config" {
		90 |     for_each = var.vpc_subnet_ids != null && var.vpc_security_group_ids != null ? [true] : []
		91 |     content {
		92 |       security_group_ids = var.vpc_security_group_ids
		93 |       subnet_ids         = var.vpc_subnet_ids
		94 |     }
		95 |   }
		96 | }


checkov_exitcode=1

CTFLint Scan Failed

Show Output 
*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
test/unit-test

*****************************

Running tflint in test/unit-test
Excluding the following checks: terraform_unused_declarations
3 issue(s) found:

Warning: Missing version constraint for provider "http" in `required_providers` (terraform_required_providers)

  on test/unit-test/locals.tf line 7:
   7: data "http" "environments_file" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on test/unit-test/main.tf line 147:
 147:       "${module.s3-bucket.bucket.arn}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: Missing version constraint for provider "archive" in `required_providers` (terraform_required_providers)

  on test/unit-test/main.tf line 226:
 226: data "archive_file" "lambda-zip" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

tflint_exitcode=2

Trivy Scan Success

Show Output 
*****************************

Trivy will check the following folders:
test/unit-test

*****************************

Running Trivy in test/unit-test
2024-10-02T20:35:35Z	INFO	[db] Need to update DB
2024-10-02T20:35:35Z	INFO	[db] Downloading DB...	repository="ghcr.io/aquasecurity/trivy-db:2"
2024-10-02T20:35:37Z	INFO	[vuln] Vulnerability scanning is enabled
2024-10-02T20:35:37Z	INFO	[misconfig] Misconfiguration scanning is enabled
2024-10-02T20:35:37Z	INFO	Need to update the built-in policies
2024-10-02T20:35:37Z	INFO	Downloading the built-in policies...
74.86 KiB / 74.86 KiB [-----------------------------------------------------------] 100.00% ? p/s 0s2024-10-02T20:35:37Z	INFO	[secret] Secret scanning is enabled
2024-10-02T20:35:37Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-02T20:35:37Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.55/docs/scanner/secret#recommendation for faster secret detection
2024-10-02T20:35:38Z	INFO	[terraform scanner] Scanning root module	file_path="."
2024-10-02T20:35:38Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="networking"
2024-10-02T20:35:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-02T20:35:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-02T20:35:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-02T20:35:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-02T20:35:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-02T20:35:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-02T20:35:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-02T20:35:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-02T20:35:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-02T20:35:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-02T20:35:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-02T20:35:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-02T20:35:38Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:97-99"
2024-10-02T20:35:38Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:133"
2024-10-02T20:35:38Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:97-99"
2024-10-02T20:35:38Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:133"
2024-10-02T20:35:38Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T20:35:38Z	INFO	[terraform executor] Ignore finding	rule="aws-lambda-enable-tracing" range="../../main.tf:59-96"
2024-10-02T20:35:38Z	INFO	[terraform executor] Ignore finding	rule="aws-lambda-enable-tracing" range="../../main.tf:59-96"
2024-10-02T20:35:38Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-bucket-encryption" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=52a40b0dd18aaef0d7c5565d93cc8997aad79636/main.tf:16-27"
2024-10-02T20:35:38Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-versioning" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=52a40b0dd18aaef0d7c5565d93cc8997aad79636/main.tf:202"
2024-10-02T20:35:38Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=52a40b0dd18aaef0d7c5565d93cc8997aad79636/main.tf:187-197"
2024-10-02T20:35:38Z	INFO	Number of language-specific files	num=0
2024-10-02T20:35:38Z	INFO	Detected config files	num=4
trivy_exitcode=0

@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Oct 2, 2024

Trivy Scan Success

Show Output ```hcl

Trivy will check the following folders:
test/unit-test

Running Trivy in test/unit-test
2024-10-02T21:31:38Z INFO [db] Need to update DB
2024-10-02T21:31:38Z INFO [db] Downloading DB... repository="ghcr.io/aquasecurity/trivy-db:2"
2024-10-02T21:31:40Z INFO [vuln] Vulnerability scanning is enabled
2024-10-02T21:31:40Z INFO [misconfig] Misconfiguration scanning is enabled
2024-10-02T21:31:40Z INFO Need to update the built-in policies
2024-10-02T21:31:40Z INFO Downloading the built-in policies...
74.86 KiB / 74.86 KiB [-----------------------------------------------------------] 100.00% ? p/s 0s2024-10-02T21:31:41Z INFO [secret] Secret scanning is enabled
2024-10-02T21:31:41Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-02T21:31:41Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.55/docs/scanner/secret#recommendation for faster secret detection
2024-10-02T21:31:41Z INFO [terraform scanner] Scanning root module file_path="."
2024-10-02T21:31:41Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="networking"
2024-10-02T21:31:42Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-02T21:31:42Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-02T21:31:42Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-02T21:31:42Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-02T21:31:42Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-02T21:31:42Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-02T21:31:42Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-02T21:31:42Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-02T21:31:42Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-02T21:31:42Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-02T21:31:42Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-02T21:31:42Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-02T21:31:42Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-bucket-encryption" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=52a40b0dd18aaef0d7c5565d93cc8997aad79636/main.tf:16-27"
2024-10-02T21:31:42Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-versioning" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=52a40b0dd18aaef0d7c5565d93cc8997aad79636/main.tf:202"
2024-10-02T21:31:42Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=52a40b0dd18aaef0d7c5565d93cc8997aad79636/main.tf:187-197"
2024-10-02T21:31:42Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:97-99"
2024-10-02T21:31:42Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:133"
2024-10-02T21:31:42Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:97-99"
2024-10-02T21:31:42Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:133"
2024-10-02T21:31:42Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z INFO [terraform executor] Ignore finding rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z INFO [terraform executor] Ignore finding rule="aws-lambda-enable-tracing" range="../../main.tf:59-96"
2024-10-02T21:31:42Z INFO [terraform executor] Ignore finding rule="aws-lambda-enable-tracing" range="../../main.tf:59-96"
2024-10-02T21:31:42Z INFO Number of language-specific files num=0
2024-10-02T21:31:42Z INFO Detected config files num=4
trivy_exitcode=0

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
test/unit-test

*****************************

Running Checkov in test/unit-test
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2024-10-02 21:31:45,606 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=52a40b0dd18aaef0d7c5565d93cc8997aad79636:None (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 76, Failed checks: 2, Skipped checks: 12

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: module.lambda_function_in_vpc.aws_lambda_function.this
	File: /../../main.tf:59-96
	Calling File: /main.tf:161-177
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		59 | resource "aws_lambda_function" "this" { #tfsec:ignore:aws-lambda-enable-tracing
		60 |   #checkov:skip=CKV_AWS_116
		61 |   #checkov:skip=CKV_AWS_117
		62 |   #checkov:skip=CKV_AWS_272 "Code signing not required"
		63 |   #checkov:skip=CKV_AWS_173 "These lambda envvars aren't sensitive and don't need a cmk. Default AWS KMS key is sufficient"
		64 |   function_name                  = var.function_name
		65 |   description                    = var.description
		66 |   reserved_concurrent_executions = var.reserved_concurrent_executions
		67 |   image_uri                      = var.image_uri
		68 |   filename                       = var.filename
		69 |   handler                        = var.handler
		70 |   runtime                        = var.runtime
		71 |   source_code_hash               = var.source_code_hash
		72 |   package_type                   = var.package_type
		73 |   role                           = var.create_role ? aws_iam_role.this[0].arn : var.lambda_role
		74 |   timeout                        = var.timeout
		75 |   memory_size                    = var.memory_size
		76 | 
		77 |   dynamic "tracing_config" {
		78 |     for_each = var.tracing_mode != null ? [1] : []
		79 |     content {
		80 |       mode = var.tracing_mode
		81 |     }
		82 |   }
		83 |   dynamic "environment" {
		84 |     for_each = length(keys(var.environment_variables)) > 0 ? [1] : []
		85 |     content {
		86 |       variables = var.environment_variables
		87 |     }
		88 |   }
		89 |   dynamic "vpc_config" {
		90 |     for_each = var.vpc_subnet_ids != null && var.vpc_security_group_ids != null ? [true] : []
		91 |     content {
		92 |       security_group_ids = var.vpc_security_group_ids
		93 |       subnet_ids         = var.vpc_subnet_ids
		94 |     }
		95 |   }
		96 | }

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: module.module_test.aws_lambda_function.this
	File: /../../main.tf:59-96
	Calling File: /main.tf:2-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		59 | resource "aws_lambda_function" "this" { #tfsec:ignore:aws-lambda-enable-tracing
		60 |   #checkov:skip=CKV_AWS_116
		61 |   #checkov:skip=CKV_AWS_117
		62 |   #checkov:skip=CKV_AWS_272 "Code signing not required"
		63 |   #checkov:skip=CKV_AWS_173 "These lambda envvars aren't sensitive and don't need a cmk. Default AWS KMS key is sufficient"
		64 |   function_name                  = var.function_name
		65 |   description                    = var.description
		66 |   reserved_concurrent_executions = var.reserved_concurrent_executions
		67 |   image_uri                      = var.image_uri
		68 |   filename                       = var.filename
		69 |   handler                        = var.handler
		70 |   runtime                        = var.runtime
		71 |   source_code_hash               = var.source_code_hash
		72 |   package_type                   = var.package_type
		73 |   role                           = var.create_role ? aws_iam_role.this[0].arn : var.lambda_role
		74 |   timeout                        = var.timeout
		75 |   memory_size                    = var.memory_size
		76 | 
		77 |   dynamic "tracing_config" {
		78 |     for_each = var.tracing_mode != null ? [1] : []
		79 |     content {
		80 |       mode = var.tracing_mode
		81 |     }
		82 |   }
		83 |   dynamic "environment" {
		84 |     for_each = length(keys(var.environment_variables)) > 0 ? [1] : []
		85 |     content {
		86 |       variables = var.environment_variables
		87 |     }
		88 |   }
		89 |   dynamic "vpc_config" {
		90 |     for_each = var.vpc_subnet_ids != null && var.vpc_security_group_ids != null ? [true] : []
		91 |     content {
		92 |       security_group_ids = var.vpc_security_group_ids
		93 |       subnet_ids         = var.vpc_subnet_ids
		94 |     }
		95 |   }
		96 | }


checkov_exitcode=1

CTFLint Scan Failed

Show Output 
*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
test/unit-test

*****************************

Running tflint in test/unit-test
Excluding the following checks: terraform_unused_declarations
3 issue(s) found:

Warning: Missing version constraint for provider "http" in `required_providers` (terraform_required_providers)

  on test/unit-test/locals.tf line 7:
   7: data "http" "environments_file" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on test/unit-test/main.tf line 147:
 147:       "${module.s3-bucket.bucket.arn}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: Missing version constraint for provider "archive" in `required_providers` (terraform_required_providers)

  on test/unit-test/main.tf line 226:
 226: data "archive_file" "lambda-zip" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

tflint_exitcode=2

Trivy Scan Success

Show Output 
*****************************

Trivy will check the following folders:
test/unit-test

*****************************

Running Trivy in test/unit-test
2024-10-02T21:31:38Z	INFO	[db] Need to update DB
2024-10-02T21:31:38Z	INFO	[db] Downloading DB...	repository="ghcr.io/aquasecurity/trivy-db:2"
2024-10-02T21:31:40Z	INFO	[vuln] Vulnerability scanning is enabled
2024-10-02T21:31:40Z	INFO	[misconfig] Misconfiguration scanning is enabled
2024-10-02T21:31:40Z	INFO	Need to update the built-in policies
2024-10-02T21:31:40Z	INFO	Downloading the built-in policies...
74.86 KiB / 74.86 KiB [-----------------------------------------------------------] 100.00% ? p/s 0s2024-10-02T21:31:41Z	INFO	[secret] Secret scanning is enabled
2024-10-02T21:31:41Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-02T21:31:41Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.55/docs/scanner/secret#recommendation for faster secret detection
2024-10-02T21:31:41Z	INFO	[terraform scanner] Scanning root module	file_path="."
2024-10-02T21:31:41Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="networking"
2024-10-02T21:31:42Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-02T21:31:42Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-02T21:31:42Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-02T21:31:42Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-02T21:31:42Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-02T21:31:42Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-02T21:31:42Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-02T21:31:42Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-02T21:31:42Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-02T21:31:42Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-02T21:31:42Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-02T21:31:42Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-02T21:31:42Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-bucket-encryption" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=52a40b0dd18aaef0d7c5565d93cc8997aad79636/main.tf:16-27"
2024-10-02T21:31:42Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-versioning" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=52a40b0dd18aaef0d7c5565d93cc8997aad79636/main.tf:202"
2024-10-02T21:31:42Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=52a40b0dd18aaef0d7c5565d93cc8997aad79636/main.tf:187-197"
2024-10-02T21:31:42Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:97-99"
2024-10-02T21:31:42Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:133"
2024-10-02T21:31:42Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:97-99"
2024-10-02T21:31:42Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:133"
2024-10-02T21:31:42Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z	INFO	[terraform executor] Ignore finding	rule="aws-iam-no-policy-wildcards" range="main.tf:68-150"
2024-10-02T21:31:42Z	INFO	[terraform executor] Ignore finding	rule="aws-lambda-enable-tracing" range="../../main.tf:59-96"
2024-10-02T21:31:42Z	INFO	[terraform executor] Ignore finding	rule="aws-lambda-enable-tracing" range="../../main.tf:59-96"
2024-10-02T21:31:42Z	INFO	Number of language-specific files	num=0
2024-10-02T21:31:42Z	INFO	Detected config files	num=4
trivy_exitcode=0

@ASTRobinson ASTRobinson changed the title bump python version Fix Unit-Tests Oct 2, 2024
@ASTRobinson ASTRobinson closed this Oct 3, 2024
@ASTRobinson ASTRobinson reopened this Oct 3, 2024
@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Oct 3, 2024

Trivy Scan Success

Show Output ```hcl

Trivy will check the following folders:
test/unit-test

Running Trivy in test/unit-test
2024-10-03T12:25:32Z INFO [vulndb] Need to update DB
2024-10-03T12:25:32Z INFO [vulndb] Downloading vulnerability DB...
2024-10-03T12:25:32Z INFO [vulndb] Downloading artifact... repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-03T12:25:34Z INFO [vulndb] Artifact successfully downloaded repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-03T12:25:34Z INFO [vuln] Vulnerability scanning is enabled
2024-10-03T12:25:34Z INFO [misconfig] Misconfiguration scanning is enabled
2024-10-03T12:25:34Z INFO [misconfig] Need to update the built-in checks
2024-10-03T12:25:34Z INFO [misconfig] Downloading the built-in checks...
156.02 KiB / 156.02 KiB [---------------------------------------------------------] 100.00% ? p/s 0s2024-10-03T12:25:34Z INFO [secret] Secret scanning is enabled
2024-10-03T12:25:34Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-03T12:25:34Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-10-03T12:25:35Z INFO [terraform scanner] Scanning root module file_path="."
2024-10-03T12:25:35Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="networking"
2024-10-03T12:25:36Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-03T12:25:36Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-03T12:25:36Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-03T12:25:36Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-03T12:25:36Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-03T12:25:36Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-03T12:25:36Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-03T12:25:36Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-03T12:25:36Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-03T12:25:36Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-03T12:25:36Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-03T12:25:36Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-03T12:25:36Z INFO [terraform executor] Ignore finding rule="aws-lambda-enable-tracing" range="../../main.tf:59-96"
2024-10-03T12:25:36Z INFO [terraform executor] Ignore finding rule="aws-s3-enable-versioning" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=52a40b0dd18aaef0d7c5565d93cc8997aad79636/main.tf:202"
2024-10-03T12:25:36Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=52a40b0dd18aaef0d7c5565d93cc8997aad79636/main.tf:187-197"
2024-10-03T12:25:36Z INFO Number of language-specific files num=0
2024-10-03T12:25:36Z INFO Detected config files num=3
trivy_exitcode=0

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
test/unit-test

*****************************

Running Checkov in test/unit-test
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2024-10-03 12:25:39,147 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=52a40b0dd18aaef0d7c5565d93cc8997aad79636:None (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 76, Failed checks: 2, Skipped checks: 12

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: module.lambda_function_in_vpc.aws_lambda_function.this
	File: /../../main.tf:59-96
	Calling File: /main.tf:161-177
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		59 | resource "aws_lambda_function" "this" { #tfsec:ignore:aws-lambda-enable-tracing
		60 |   #checkov:skip=CKV_AWS_116
		61 |   #checkov:skip=CKV_AWS_117
		62 |   #checkov:skip=CKV_AWS_272 "Code signing not required"
		63 |   #checkov:skip=CKV_AWS_173 "These lambda envvars aren't sensitive and don't need a cmk. Default AWS KMS key is sufficient"
		64 |   function_name                  = var.function_name
		65 |   description                    = var.description
		66 |   reserved_concurrent_executions = var.reserved_concurrent_executions
		67 |   image_uri                      = var.image_uri
		68 |   filename                       = var.filename
		69 |   handler                        = var.handler
		70 |   runtime                        = var.runtime
		71 |   source_code_hash               = var.source_code_hash
		72 |   package_type                   = var.package_type
		73 |   role                           = var.create_role ? aws_iam_role.this[0].arn : var.lambda_role
		74 |   timeout                        = var.timeout
		75 |   memory_size                    = var.memory_size
		76 | 
		77 |   dynamic "tracing_config" {
		78 |     for_each = var.tracing_mode != null ? [1] : []
		79 |     content {
		80 |       mode = var.tracing_mode
		81 |     }
		82 |   }
		83 |   dynamic "environment" {
		84 |     for_each = length(keys(var.environment_variables)) > 0 ? [1] : []
		85 |     content {
		86 |       variables = var.environment_variables
		87 |     }
		88 |   }
		89 |   dynamic "vpc_config" {
		90 |     for_each = var.vpc_subnet_ids != null && var.vpc_security_group_ids != null ? [true] : []
		91 |     content {
		92 |       security_group_ids = var.vpc_security_group_ids
		93 |       subnet_ids         = var.vpc_subnet_ids
		94 |     }
		95 |   }
		96 | }

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: module.module_test.aws_lambda_function.this
	File: /../../main.tf:59-96
	Calling File: /main.tf:2-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		59 | resource "aws_lambda_function" "this" { #tfsec:ignore:aws-lambda-enable-tracing
		60 |   #checkov:skip=CKV_AWS_116
		61 |   #checkov:skip=CKV_AWS_117
		62 |   #checkov:skip=CKV_AWS_272 "Code signing not required"
		63 |   #checkov:skip=CKV_AWS_173 "These lambda envvars aren't sensitive and don't need a cmk. Default AWS KMS key is sufficient"
		64 |   function_name                  = var.function_name
		65 |   description                    = var.description
		66 |   reserved_concurrent_executions = var.reserved_concurrent_executions
		67 |   image_uri                      = var.image_uri
		68 |   filename                       = var.filename
		69 |   handler                        = var.handler
		70 |   runtime                        = var.runtime
		71 |   source_code_hash               = var.source_code_hash
		72 |   package_type                   = var.package_type
		73 |   role                           = var.create_role ? aws_iam_role.this[0].arn : var.lambda_role
		74 |   timeout                        = var.timeout
		75 |   memory_size                    = var.memory_size
		76 | 
		77 |   dynamic "tracing_config" {
		78 |     for_each = var.tracing_mode != null ? [1] : []
		79 |     content {
		80 |       mode = var.tracing_mode
		81 |     }
		82 |   }
		83 |   dynamic "environment" {
		84 |     for_each = length(keys(var.environment_variables)) > 0 ? [1] : []
		85 |     content {
		86 |       variables = var.environment_variables
		87 |     }
		88 |   }
		89 |   dynamic "vpc_config" {
		90 |     for_each = var.vpc_subnet_ids != null && var.vpc_security_group_ids != null ? [true] : []
		91 |     content {
		92 |       security_group_ids = var.vpc_security_group_ids
		93 |       subnet_ids         = var.vpc_subnet_ids
		94 |     }
		95 |   }
		96 | }


checkov_exitcode=1

CTFLint Scan Failed

Show Output 
*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
test/unit-test

*****************************

Running tflint in test/unit-test
Excluding the following checks: terraform_unused_declarations
3 issue(s) found:

Warning: Missing version constraint for provider "http" in `required_providers` (terraform_required_providers)

  on test/unit-test/locals.tf line 7:
   7: data "http" "environments_file" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on test/unit-test/main.tf line 147:
 147:       "${module.s3-bucket.bucket.arn}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_deprecated_interpolation.md

Warning: Missing version constraint for provider "archive" in `required_providers` (terraform_required_providers)

  on test/unit-test/main.tf line 226:
 226: data "archive_file" "lambda-zip" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

tflint_exitcode=2

Trivy Scan Success

Show Output 
*****************************

Trivy will check the following folders:
test/unit-test

*****************************

Running Trivy in test/unit-test
2024-10-03T12:25:32Z	INFO	[vulndb] Need to update DB
2024-10-03T12:25:32Z	INFO	[vulndb] Downloading vulnerability DB...
2024-10-03T12:25:32Z	INFO	[vulndb] Downloading artifact...	repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-03T12:25:34Z	INFO	[vulndb] Artifact successfully downloaded	repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-03T12:25:34Z	INFO	[vuln] Vulnerability scanning is enabled
2024-10-03T12:25:34Z	INFO	[misconfig] Misconfiguration scanning is enabled
2024-10-03T12:25:34Z	INFO	[misconfig] Need to update the built-in checks
2024-10-03T12:25:34Z	INFO	[misconfig] Downloading the built-in checks...
156.02 KiB / 156.02 KiB [---------------------------------------------------------] 100.00% ? p/s 0s2024-10-03T12:25:34Z	INFO	[secret] Secret scanning is enabled
2024-10-03T12:25:34Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-03T12:25:34Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-10-03T12:25:35Z	INFO	[terraform scanner] Scanning root module	file_path="."
2024-10-03T12:25:35Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="networking"
2024-10-03T12:25:36Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-03T12:25:36Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-03T12:25:36Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-03T12:25:36Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-03T12:25:36Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-03T12:25:36Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-03T12:25:36Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.expiration" value="cty.NilVal"
2024-10-03T12:25:36Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.transition" value="cty.NilVal"
2024-10-03T12:25:36Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.noncurrent_version_expiration" value="cty.NilVal"
2024-10-03T12:25:36Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.noncurrent_version_transition" value="cty.NilVal"
2024-10-03T12:25:36Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.principals" value="cty.NilVal"
2024-10-03T12:25:36Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.s3-bucket.dynamic.condition" value="cty.NilVal"
2024-10-03T12:25:36Z	INFO	[terraform executor] Ignore finding	rule="aws-lambda-enable-tracing" range="../../main.tf:59-96"
2024-10-03T12:25:36Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-enable-versioning" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=52a40b0dd18aaef0d7c5565d93cc8997aad79636/main.tf:202"
2024-10-03T12:25:36Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=52a40b0dd18aaef0d7c5565d93cc8997aad79636/main.tf:187-197"
2024-10-03T12:25:36Z	INFO	Number of language-specific files	num=0
2024-10-03T12:25:36Z	INFO	Detected config files	num=3
trivy_exitcode=0

@ASTRobinson ASTRobinson closed this Oct 3, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@ASTRobinson