Testing new permissions for on-demand backups in Sprinkler only - DO NOT MERGE #8995

mikereiddigital · 2025-01-17T15:28:02Z

This adds permissions to allow the developer policy to create on-demand AWS Backups.

A reference to the issue / Description of it

{Please write here}

How does this PR fix the problem?

{Please write here}

How has this been tested?

Please describe the tests that you ran and provide instructions to reproduce.

{Please write here}

Deployment Plan / Instructions

Will this deployment impact the platform and / or services on it?

{Please write here}

Checklist (check `x` in `[ ]` of list items)

I have performed a self-review of my own code
All checks have passed
I have made corresponding changes to the documentation
Plan and discussed how it should be deployed to PROD (If needed)

Additional comments (if any)

{Please write here}

…nd AWS Backups.

github-actions · 2025-01-17T15:30:17Z

`Trivy Scan` Success

Show Output

```hcl

Trivy will check the following folders:
terraform/environments/bootstrap/single-sign-on

Running Trivy in terraform/environments/bootstrap/single-sign-on
2025-01-17T15:30:07Z INFO [vulndb] Need to update DB
2025-01-17T15:30:07Z INFO [vulndb] Downloading vulnerability DB...
2025-01-17T15:30:07Z INFO [vulndb] Downloading artifact... repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-17T15:30:10Z INFO [vulndb] Artifact successfully downloaded repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-17T15:30:10Z INFO [vuln] Vulnerability scanning is enabled
2025-01-17T15:30:10Z INFO [misconfig] Misconfiguration scanning is enabled
2025-01-17T15:30:10Z INFO [misconfig] Need to update the built-in checks
2025-01-17T15:30:10Z INFO [misconfig] Downloading the built-in checks...
160.80 KiB / 160.80 KiB [---------------------------------------------------------] 100.00% ? p/s 0s2025-01-17T15:30:10Z INFO [secret] Secret scanning is enabled
2025-01-17T15:30:10Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-17T15:30:10Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-17T15:30:11Z INFO [terraform scanner] Scanning root module file_path="."
2025-01-17T15:30:11Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.administator" value="cty.NilVal"
2025-01-17T15:30:11Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.data_engineer" value="cty.NilVal"
2025-01-17T15:30:11Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.developer" value="cty.NilVal"
2025-01-17T15:30:11Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.fleet_manager" value="cty.NilVal"
2025-01-17T15:30:11Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.instance-access" value="cty.NilVal"
2025-01-17T15:30:11Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.instance-management" value="cty.NilVal"
2025-01-17T15:30:11Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.migration" value="cty.NilVal"
2025-01-17T15:30:11Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.mwaa_user" value="cty.NilVal"
2025-01-17T15:30:11Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.powerbi_user" value="cty.NilVal"
2025-01-17T15:30:11Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.quicksight_admin" value="cty.NilVal"
2025-01-17T15:30:11Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.read_only" value="cty.NilVal"
2025-01-17T15:30:11Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.reporting-operations" value="cty.NilVal"
2025-01-17T15:30:11Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.sandbox" value="cty.NilVal"
2025-01-17T15:30:11Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.security_audit" value="cty.NilVal"
2025-01-17T15:30:11Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.view_only" value="cty.NilVal"
2025-01-17T15:30:11Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="data.aws_identitystore_group.member" value="cty.NilVal"
2025-01-17T15:30:12Z INFO Number of language-specific files num=0
2025-01-17T15:30:12Z INFO Detected config files num=2
trivy_exitcode=0

</details> #### `Checkov Scan` Success
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/bootstrap/single-sign-on

*****************************

Running Checkov in terraform/environments/bootstrap/single-sign-on
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
terraform scan results:

Passed checks: 119, Failed checks: 0, Skipped checks: 55


checkov_exitcode=0

`CTFLint Scan` Success

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
terraform/environments/bootstrap/single-sign-on

*****************************

Running tflint in terraform/environments/bootstrap/single-sign-on
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=0

`Trivy Scan` Success

Show Output

*****************************

Trivy will check the following folders:
terraform/environments/bootstrap/single-sign-on

*****************************

Running Trivy in terraform/environments/bootstrap/single-sign-on
2025-01-17T15:30:07Z	INFO	[vulndb] Need to update DB
2025-01-17T15:30:07Z	INFO	[vulndb] Downloading vulnerability DB...
2025-01-17T15:30:07Z	INFO	[vulndb] Downloading artifact...	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-17T15:30:10Z	INFO	[vulndb] Artifact successfully downloaded	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-17T15:30:10Z	INFO	[vuln] Vulnerability scanning is enabled
2025-01-17T15:30:10Z	INFO	[misconfig] Misconfiguration scanning is enabled
2025-01-17T15:30:10Z	INFO	[misconfig] Need to update the built-in checks
2025-01-17T15:30:10Z	INFO	[misconfig] Downloading the built-in checks...
160.80 KiB / 160.80 KiB [---------------------------------------------------------] 100.00% ? p/s 0s2025-01-17T15:30:10Z	INFO	[secret] Secret scanning is enabled
2025-01-17T15:30:10Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-17T15:30:10Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-17T15:30:11Z	INFO	[terraform scanner] Scanning root module	file_path="."
2025-01-17T15:30:11Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.administator" value="cty.NilVal"
2025-01-17T15:30:11Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.data_engineer" value="cty.NilVal"
2025-01-17T15:30:11Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.developer" value="cty.NilVal"
2025-01-17T15:30:11Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.fleet_manager" value="cty.NilVal"
2025-01-17T15:30:11Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.instance-access" value="cty.NilVal"
2025-01-17T15:30:11Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.instance-management" value="cty.NilVal"
2025-01-17T15:30:11Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.migration" value="cty.NilVal"
2025-01-17T15:30:11Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.mwaa_user" value="cty.NilVal"
2025-01-17T15:30:11Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.powerbi_user" value="cty.NilVal"
2025-01-17T15:30:11Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.quicksight_admin" value="cty.NilVal"
2025-01-17T15:30:11Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.read_only" value="cty.NilVal"
2025-01-17T15:30:11Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.reporting-operations" value="cty.NilVal"
2025-01-17T15:30:11Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.sandbox" value="cty.NilVal"
2025-01-17T15:30:11Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.security_audit" value="cty.NilVal"
2025-01-17T15:30:11Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.view_only" value="cty.NilVal"
2025-01-17T15:30:11Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="data.aws_identitystore_group.member" value="cty.NilVal"
2025-01-17T15:30:12Z	INFO	Number of language-specific files	num=0
2025-01-17T15:30:12Z	INFO	Detected config files	num=2
trivy_exitcode=0

github-actions · 2025-01-17T15:30:29Z

`Trivy Scan` Success

Show Output

```hcl

Trivy will check the following folders:
terraform/environments/bootstrap/single-sign-on

Running Trivy in terraform/environments/bootstrap/single-sign-on
2025-01-17T15:30:20Z INFO [vulndb] Need to update DB
2025-01-17T15:30:20Z INFO [vulndb] Downloading vulnerability DB...
2025-01-17T15:30:20Z INFO [vulndb] Downloading artifact... repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-17T15:30:22Z INFO [vulndb] Artifact successfully downloaded repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-17T15:30:22Z INFO [vuln] Vulnerability scanning is enabled
2025-01-17T15:30:22Z INFO [misconfig] Misconfiguration scanning is enabled
2025-01-17T15:30:22Z INFO [misconfig] Need to update the built-in checks
2025-01-17T15:30:22Z INFO [misconfig] Downloading the built-in checks...
160.80 KiB / 160.80 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2025-01-17T15:30:23Z INFO [secret] Secret scanning is enabled
2025-01-17T15:30:23Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-17T15:30:23Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-17T15:30:24Z INFO [terraform scanner] Scanning root module file_path="."
2025-01-17T15:30:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.administator" value="cty.NilVal"
2025-01-17T15:30:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.data_engineer" value="cty.NilVal"
2025-01-17T15:30:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.developer" value="cty.NilVal"
2025-01-17T15:30:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.fleet_manager" value="cty.NilVal"
2025-01-17T15:30:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.instance-access" value="cty.NilVal"
2025-01-17T15:30:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.instance-management" value="cty.NilVal"
2025-01-17T15:30:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.migration" value="cty.NilVal"
2025-01-17T15:30:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.mwaa_user" value="cty.NilVal"
2025-01-17T15:30:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.powerbi_user" value="cty.NilVal"
2025-01-17T15:30:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.quicksight_admin" value="cty.NilVal"
2025-01-17T15:30:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.read_only" value="cty.NilVal"
2025-01-17T15:30:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.reporting-operations" value="cty.NilVal"
2025-01-17T15:30:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.sandbox" value="cty.NilVal"
2025-01-17T15:30:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.security_audit" value="cty.NilVal"
2025-01-17T15:30:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.view_only" value="cty.NilVal"
2025-01-17T15:30:24Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="data.aws_identitystore_group.member" value="cty.NilVal"
2025-01-17T15:30:25Z INFO Number of language-specific files num=0
2025-01-17T15:30:25Z INFO Detected config files num=2
trivy_exitcode=0

</details> #### `Checkov Scan` Success
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/bootstrap/single-sign-on

*****************************

Running Checkov in terraform/environments/bootstrap/single-sign-on
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
terraform scan results:

Passed checks: 119, Failed checks: 0, Skipped checks: 55


checkov_exitcode=0

`CTFLint Scan` Success

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
terraform/environments/bootstrap/single-sign-on

*****************************

Running tflint in terraform/environments/bootstrap/single-sign-on
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=0

`Trivy Scan` Success

Show Output

*****************************

Trivy will check the following folders:
terraform/environments/bootstrap/single-sign-on

*****************************

Running Trivy in terraform/environments/bootstrap/single-sign-on
2025-01-17T15:30:20Z	INFO	[vulndb] Need to update DB
2025-01-17T15:30:20Z	INFO	[vulndb] Downloading vulnerability DB...
2025-01-17T15:30:20Z	INFO	[vulndb] Downloading artifact...	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-17T15:30:22Z	INFO	[vulndb] Artifact successfully downloaded	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-17T15:30:22Z	INFO	[vuln] Vulnerability scanning is enabled
2025-01-17T15:30:22Z	INFO	[misconfig] Misconfiguration scanning is enabled
2025-01-17T15:30:22Z	INFO	[misconfig] Need to update the built-in checks
2025-01-17T15:30:22Z	INFO	[misconfig] Downloading the built-in checks...
160.80 KiB / 160.80 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2025-01-17T15:30:23Z	INFO	[secret] Secret scanning is enabled
2025-01-17T15:30:23Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-17T15:30:23Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-17T15:30:24Z	INFO	[terraform scanner] Scanning root module	file_path="."
2025-01-17T15:30:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.administator" value="cty.NilVal"
2025-01-17T15:30:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.data_engineer" value="cty.NilVal"
2025-01-17T15:30:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.developer" value="cty.NilVal"
2025-01-17T15:30:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.fleet_manager" value="cty.NilVal"
2025-01-17T15:30:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.instance-access" value="cty.NilVal"
2025-01-17T15:30:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.instance-management" value="cty.NilVal"
2025-01-17T15:30:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.migration" value="cty.NilVal"
2025-01-17T15:30:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.mwaa_user" value="cty.NilVal"
2025-01-17T15:30:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.powerbi_user" value="cty.NilVal"
2025-01-17T15:30:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.quicksight_admin" value="cty.NilVal"
2025-01-17T15:30:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.read_only" value="cty.NilVal"
2025-01-17T15:30:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.reporting-operations" value="cty.NilVal"
2025-01-17T15:30:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.sandbox" value="cty.NilVal"
2025-01-17T15:30:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.security_audit" value="cty.NilVal"
2025-01-17T15:30:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.view_only" value="cty.NilVal"
2025-01-17T15:30:24Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="data.aws_identitystore_group.member" value="cty.NilVal"
2025-01-17T15:30:25Z	INFO	Number of language-specific files	num=0
2025-01-17T15:30:25Z	INFO	Detected config files	num=2
trivy_exitcode=0

github-actions · 2025-01-17T15:41:55Z

`Trivy Scan` Success

Show Output

```hcl

Trivy will check the following folders:
terraform/environments/bootstrap/single-sign-on

Running Trivy in terraform/environments/bootstrap/single-sign-on
2025-01-17T15:41:46Z INFO [vulndb] Need to update DB
2025-01-17T15:41:46Z INFO [vulndb] Downloading vulnerability DB...
2025-01-17T15:41:46Z INFO [vulndb] Downloading artifact... repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-17T15:41:49Z INFO [vulndb] Artifact successfully downloaded repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-17T15:41:49Z INFO [vuln] Vulnerability scanning is enabled
2025-01-17T15:41:49Z INFO [misconfig] Misconfiguration scanning is enabled
2025-01-17T15:41:49Z INFO [misconfig] Need to update the built-in checks
2025-01-17T15:41:49Z INFO [misconfig] Downloading the built-in checks...
160.80 KiB / 160.80 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2025-01-17T15:41:49Z INFO [secret] Secret scanning is enabled
2025-01-17T15:41:49Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-17T15:41:49Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-17T15:41:50Z INFO [terraform scanner] Scanning root module file_path="."
2025-01-17T15:41:50Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.administator" value="cty.NilVal"
2025-01-17T15:41:50Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.data_engineer" value="cty.NilVal"
2025-01-17T15:41:50Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.developer" value="cty.NilVal"
2025-01-17T15:41:50Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.fleet_manager" value="cty.NilVal"
2025-01-17T15:41:50Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.instance-access" value="cty.NilVal"
2025-01-17T15:41:50Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.instance-management" value="cty.NilVal"
2025-01-17T15:41:50Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.migration" value="cty.NilVal"
2025-01-17T15:41:50Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.mwaa_user" value="cty.NilVal"
2025-01-17T15:41:50Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.powerbi_user" value="cty.NilVal"
2025-01-17T15:41:50Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.quicksight_admin" value="cty.NilVal"
2025-01-17T15:41:50Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.read_only" value="cty.NilVal"
2025-01-17T15:41:50Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.reporting-operations" value="cty.NilVal"
2025-01-17T15:41:50Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.sandbox" value="cty.NilVal"
2025-01-17T15:41:50Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.security_audit" value="cty.NilVal"
2025-01-17T15:41:50Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.view_only" value="cty.NilVal"
2025-01-17T15:41:50Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="data.aws_identitystore_group.member" value="cty.NilVal"
2025-01-17T15:41:50Z INFO Number of language-specific files num=0
2025-01-17T15:41:50Z INFO Detected config files num=2
trivy_exitcode=0

</details> #### `Checkov Scan` Success
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/bootstrap/single-sign-on

*****************************

Running Checkov in terraform/environments/bootstrap/single-sign-on
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
terraform scan results:

Passed checks: 119, Failed checks: 0, Skipped checks: 55


checkov_exitcode=0

`CTFLint Scan` Success

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
terraform/environments/bootstrap/single-sign-on

*****************************

Running tflint in terraform/environments/bootstrap/single-sign-on
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=0

`Trivy Scan` Success

Show Output

*****************************

Trivy will check the following folders:
terraform/environments/bootstrap/single-sign-on

*****************************

Running Trivy in terraform/environments/bootstrap/single-sign-on
2025-01-17T15:41:46Z	INFO	[vulndb] Need to update DB
2025-01-17T15:41:46Z	INFO	[vulndb] Downloading vulnerability DB...
2025-01-17T15:41:46Z	INFO	[vulndb] Downloading artifact...	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-17T15:41:49Z	INFO	[vulndb] Artifact successfully downloaded	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-17T15:41:49Z	INFO	[vuln] Vulnerability scanning is enabled
2025-01-17T15:41:49Z	INFO	[misconfig] Misconfiguration scanning is enabled
2025-01-17T15:41:49Z	INFO	[misconfig] Need to update the built-in checks
2025-01-17T15:41:49Z	INFO	[misconfig] Downloading the built-in checks...
160.80 KiB / 160.80 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2025-01-17T15:41:49Z	INFO	[secret] Secret scanning is enabled
2025-01-17T15:41:49Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-17T15:41:49Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-17T15:41:50Z	INFO	[terraform scanner] Scanning root module	file_path="."
2025-01-17T15:41:50Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.administator" value="cty.NilVal"
2025-01-17T15:41:50Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.data_engineer" value="cty.NilVal"
2025-01-17T15:41:50Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.developer" value="cty.NilVal"
2025-01-17T15:41:50Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.fleet_manager" value="cty.NilVal"
2025-01-17T15:41:50Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.instance-access" value="cty.NilVal"
2025-01-17T15:41:50Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.instance-management" value="cty.NilVal"
2025-01-17T15:41:50Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.migration" value="cty.NilVal"
2025-01-17T15:41:50Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.mwaa_user" value="cty.NilVal"
2025-01-17T15:41:50Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.powerbi_user" value="cty.NilVal"
2025-01-17T15:41:50Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.quicksight_admin" value="cty.NilVal"
2025-01-17T15:41:50Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.read_only" value="cty.NilVal"
2025-01-17T15:41:50Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.reporting-operations" value="cty.NilVal"
2025-01-17T15:41:50Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.sandbox" value="cty.NilVal"
2025-01-17T15:41:50Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.security_audit" value="cty.NilVal"
2025-01-17T15:41:50Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.view_only" value="cty.NilVal"
2025-01-17T15:41:50Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="data.aws_identitystore_group.member" value="cty.NilVal"
2025-01-17T15:41:50Z	INFO	Number of language-specific files	num=0
2025-01-17T15:41:50Z	INFO	Detected config files	num=2
trivy_exitcode=0

mikereiddigital requested a review from a team as a code owner January 17, 2025 15:28

mikereiddigital requested a deployment to production January 17, 2025 15:28 — with GitHub Actions Waiting

mikereiddigital temporarily deployed to production January 17, 2025 15:28 — with GitHub Actions Inactive

This adds permissions to allow the developer policy to create on-dema…

b571cc1

…nd AWS Backups.

mikereiddigital temporarily deployed to production January 17, 2025 15:30 — with GitHub Actions Inactive

mikereiddigital temporarily deployed to production January 17, 2025 15:31 — with GitHub Actions Inactive

Added backup:StartBackupJob

fa52c34

mikereiddigital force-pushed the issue/8617 branch from c3b42e9 to fa52c34 Compare January 17, 2025 15:39

mikereiddigital temporarily deployed to production January 17, 2025 15:39 — with GitHub Actions Inactive

mikereiddigital temporarily deployed to production January 17, 2025 15:42 — with GitHub Actions Inactive

mikereiddigital deployed to production January 17, 2025 15:43 — with GitHub Actions Active

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Testing new permissions for on-demand backups in Sprinkler only - DO NOT MERGE #8995

Testing new permissions for on-demand backups in Sprinkler only - DO NOT MERGE #8995

mikereiddigital commented Jan 17, 2025

github-actions bot commented Jan 17, 2025

github-actions bot commented Jan 17, 2025

github-actions bot commented Jan 17, 2025

Testing new permissions for on-demand backups in Sprinkler only - DO NOT MERGE #8995

Are you sure you want to change the base?

Testing new permissions for on-demand backups in Sprinkler only - DO NOT MERGE #8995

Conversation

mikereiddigital commented Jan 17, 2025

A reference to the issue / Description of it

How does this PR fix the problem?

How has this been tested?

Deployment Plan / Instructions

Checklist (check x in [ ] of list items)

Additional comments (if any)

github-actions bot commented Jan 17, 2025

Trivy Scan Success

CTFLint Scan Success

Trivy Scan Success

github-actions bot commented Jan 17, 2025

Trivy Scan Success

CTFLint Scan Success

Trivy Scan Success

github-actions bot commented Jan 17, 2025

Trivy Scan Success

CTFLint Scan Success

Trivy Scan Success

Checklist (check `x` in `[ ]` of list items)

`Trivy Scan` Success

`CTFLint Scan` Success

`Trivy Scan` Success

`Trivy Scan` Success

`CTFLint Scan` Success

`Trivy Scan` Success

`Trivy Scan` Success

`CTFLint Scan` Success

`Trivy Scan` Success