You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Trivy will check the following folders:
terraform/environments/bootstrap/member-bootstrap
terraform/environments/sprinkler
terraform/github
terraform/modernisation-platform-account
terraform/single-sign-on
Running Trivy in terraform/environments/bootstrap/member-bootstrap
2025-01-23T21:47:23Z INFO [vulndb] Need to update DB
2025-01-23T21:47:23Z INFO [vulndb] Downloading vulnerability DB...
2025-01-23T21:47:23Z INFO [vulndb] Downloading artifact... repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-23T21:47:25Z INFO [vulndb] Artifact successfully downloaded repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-23T21:47:25Z INFO [vuln] Vulnerability scanning is enabled
2025-01-23T21:47:25Z INFO [misconfig] Misconfiguration scanning is enabled
2025-01-23T21:47:25Z INFO [misconfig] Need to update the built-in checks
2025-01-23T21:47:25Z INFO [misconfig] Downloading the built-in checks...
164.50 KiB / 164.50 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2025-01-23T21:47:26Z INFO [secret] Secret scanning is enabled
2025-01-23T21:47:26Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-23T21:47:26Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-23T21:47:27Z INFO [terraform scanner] Scanning root module file_path="."
2025-01-23T21:47:27Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="open modules/iam-assumable-role: no such file or directory"
2025-01-23T21:47:27Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="open modules/iam-assumable-role: no such file or directory"
2025-01-23T21:47:27Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="open modules/iam-assumable-role: no such file or directory"
2025-01-23T21:47:27Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="open modules/iam-assumable-role: no such file or directory"
2025-01-23T21:47:27Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="open modules/iam-assumable-role: no such file or directory"
2025-01-23T21:47:27Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="open modules/iam-assumable-role: no such file or directory"
2025-01-23T21:47:27Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="open modules/iam-assumable-roles: no such file or directory"
2025-01-23T21:47:27Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="open modules/iam-assumable-role: no such file or directory"
2025-01-23T21:47:27Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="open modules/iam-assumable-role: no such file or directory"
2025-01-23T21:47:27Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="open modules/iam-assumable-role: no such file or directory"
2025-01-23T21:47:29Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.pagerduty_core_alerts[0].data.aws_sns_topic.alarm_topics" value="cty.NilVal"
2025-01-23T21:47:29Z INFO Number of language-specific files num=0
2025-01-23T21:47:29Z INFO Detected config files num=3
trivy_exitcode=0
Running Trivy in terraform/environments/sprinkler
2025-01-23T21:47:29Z INFO [vuln] Vulnerability scanning is enabled
2025-01-23T21:47:29Z INFO [misconfig] Misconfiguration scanning is enabled
2025-01-23T21:47:29Z INFO [secret] Secret scanning is enabled
2025-01-23T21:47:29Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-23T21:47:29Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-23T21:47:30Z INFO [terraform scanner] Scanning root module file_path="."
2025-01-23T21:47:30Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="networking"
2025-01-23T21:47:31Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.ram-ec2-retagging[0].data.aws_subnet.host" value="cty.NilVal"
2025-01-23T21:47:31Z INFO Number of language-specific files num=0
2025-01-23T21:47:31Z INFO Detected config files num=1
trivy_exitcode=0
Running Trivy in terraform/github
2025-01-23T21:47:31Z INFO [vuln] Vulnerability scanning is enabled
2025-01-23T21:47:31Z INFO [misconfig] Misconfiguration scanning is enabled
2025-01-23T21:47:31Z INFO [secret] Secret scanning is enabled
2025-01-23T21:47:31Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-23T21:47:31Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-23T21:47:32Z INFO [terraform scanner] Scanning root module file_path="."
2025-01-23T21:47:32Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="github_token"
2025-01-23T21:47:32Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.contributor-access" value="cty.NilVal"
2025-01-23T21:47:33Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.modernisation-platform-environments.github_actions_secret.default" value="cty.NilVal"
2025-01-23T21:47:33Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.modernisation-platform-instance-scheduler.github_actions_secret.default" value="cty.NilVal"
2025-01-23T21:47:33Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.modernisation-platform-terraform-aws-chatbot.github_actions_secret.default" value="cty.NilVal"
2025-01-23T21:47:33Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.modernisation-platform-terraform-aws-data-firehose.github_actions_secret.default" value="cty.NilVal"
2025-01-23T21:47:33Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.modernisation-platform-terraform-dns-certificates.github_actions_secret.default" value="cty.NilVal"
2025-01-23T21:47:34Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.modernisation-platform-terraform-member-vpc.github_actions_secret.default" value="cty.NilVal"
2025-01-23T21:47:34Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.modernisation-platform-terraform-module-template.github_actions_secret.default" value="cty.NilVal"
2025-01-23T21:47:34Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.modernisation-platform-terraform-pagerduty-integration.github_actions_secret.default" value="cty.NilVal"
2025-01-23T21:47:34Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="testing-ci.tf:4-9"
2025-01-23T21:47:34Z INFO Number of language-specific files num=0
2025-01-23T21:47:34Z INFO Detected config files num=3
trivy_exitcode=0
Running Trivy in terraform/modernisation-platform-account
2025-01-23T21:47:34Z INFO [vuln] Vulnerability scanning is enabled
2025-01-23T21:47:34Z INFO [misconfig] Misconfiguration scanning is enabled
2025-01-23T21:47:34Z INFO [secret] Secret scanning is enabled
2025-01-23T21:47:34Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-23T21:47:34Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-23T21:47:35Z INFO [terraform scanner] Scanning root module file_path="."
2025-01-23T21:47:38Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="open modules/iam-account: no such file or directory"
2025-01-23T21:47:38Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="open modules/iam-assumable-roles: no such file or directory"
2025-01-23T21:47:38Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="open modules/iam-group-with-policies: no such file or directory"
2025-01-23T21:47:38Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="open modules/iam-user: no such file or directory"
2025-01-23T21:47:38Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="open modules/iam-user: no such file or directory"
2025-01-23T21:47:38Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="open modules/iam-user: no such file or directory"
2025-01-23T21:47:38Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="open modules/iam-user: no such file or directory"
2025-01-23T21:47:38Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="open modules/iam-user: no such file or directory"
2025-01-23T21:47:38Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="open modules/iam-user: no such file or directory"
2025-01-23T21:47:38Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="open modules/iam-user: no such file or directory"
2025-01-23T21:47:38Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="open modules/iam-user: no such file or directory"
2025-01-23T21:47:38Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="open modules/iam-user: no such file or directory"
2025-01-23T21:47:38Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="open modules/iam-user: no such file or directory"
2025-01-23T21:47:38Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="open modules/iam-user: no such file or directory"
2025-01-23T21:47:40Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="terraform-aws-modules/iam/aws/modules/iam-user/modules/iam-user/main.tf:1-10"
2025-01-23T21:47:40Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="terraform-aws-modules/iam/aws/modules/iam-user/modules/iam-user/main.tf:1-10"
2025-01-23T21:47:40Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="terraform-aws-modules/iam/aws/modules/iam-user/modules/iam-user/main.tf:1-10"
2025-01-23T21:47:40Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="terraform-aws-modules/iam/aws/modules/iam-user/modules/iam-user/main.tf:1-10"
2025-01-23T21:47:40Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="terraform-aws-modules/iam/aws/modules/iam-user/modules/iam-user/main.tf:1-10"
2025-01-23T21:47:40Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="terraform-aws-modules/iam/aws/modules/iam-user/modules/iam-user/main.tf:1-10"
2025-01-23T21:47:40Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="terraform-aws-modules/iam/aws/modules/iam-user/modules/iam-user/main.tf:1-10"
2025-01-23T21:47:40Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="terraform-aws-modules/iam/aws/modules/iam-user/modules/iam-user/main.tf:1-10"
2025-01-23T21:47:40Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="terraform-aws-modules/iam/aws/modules/iam-user/modules/iam-user/main.tf:1-10"
2025-01-23T21:47:40Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="terraform-aws-modules/iam/aws/modules/iam-user/modules/iam-user/main.tf:1-10"
2025-01-23T21:47:40Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="terraform-aws-modules/iam/aws/modules/iam-user/modules/iam-user/main.tf:1-10"
2025-01-23T21:47:40Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="terraform-aws-modules/iam/aws/modules/iam-user/modules/iam-user/main.tf:1-10"
2025-01-23T21:47:40Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="terraform-aws-modules/iam/aws/modules/iam-user/modules/iam-user/main.tf:1-10"
2025-01-23T21:47:40Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="terraform-aws-modules/iam/aws/modules/iam-user/modules/iam-user/main.tf:1-10"
2025-01-23T21:47:40Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="terraform-aws-modules/iam/aws/modules/iam-user/modules/iam-user/main.tf:1-10"
2025-01-23T21:47:40Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="terraform-aws-modules/iam/aws/modules/iam-user/modules/iam-user/main.tf:1-10"
2025-01-23T21:47:40Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="terraform-aws-modules/iam/aws/modules/iam-user/modules/iam-user/main.tf:1-10"
2025-01-23T21:47:40Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="terraform-aws-modules/iam/aws/modules/iam-user/modules/iam-user/main.tf:1-10"
2025-01-23T21:47:40Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="terraform-aws-modules/iam/aws/modules/iam-user/modules/iam-user/main.tf:1-10"
2025-01-23T21:47:40Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="terraform-aws-modules/iam/aws/modules/iam-user/modules/iam-user/main.tf:1-10"
2025-01-23T21:47:40Z INFO [terraform executor] Ignore finding rule="aws-iam-no-user-attached-policies" range="terraform-aws-modules/iam/aws/modules/iam-user/modules/iam-user/main.tf:1-10"
2025-01-23T21:47:40Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=dd8a60be4cc6d726803f49301930795d266188d8/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=8688bc15a08fbf5a4f4eef9b7433c5a417df8df1/main.tf:157-165"
2025-01-23T21:47:40Z INFO [terraform executor] Ignore finding rule="aws-sns-topic-encryption-use-cmk" range="github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=dd8a60be4cc6d726803f49301930795d266188d8/modules/config/main.tf:40"
2025-01-23T21:47:40Z INFO [terraform executor] Ignore finding rule="aws-sns-topic-encryption-use-cmk" range="github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=dd8a60be4cc6d726803f49301930795d266188d8/modules/config/main.tf:40"
2025-01-23T21:47:40Z INFO [terraform executor] Ignore finding rule="aws-sns-topic-encryption-use-cmk" range="github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=dd8a60be4cc6d726803f49301930795d266188d8/modules/config/main.tf:40"
2025-01-23T21:47:40Z INFO [terraform executor] Ignore finding rule="aws-sns-topic-encryption-use-cmk" range="github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=dd8a60be4cc6d726803f49301930795d266188d8/modules/config/main.tf:40"
2025-01-23T21:47:40Z INFO [terraform executor] Ignore finding rule="aws-sns-topic-encryption-use-cmk" range="github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=dd8a60be4cc6d726803f49301930795d266188d8/modules/config/main.tf:40"
2025-01-23T21:47:40Z INFO [terraform executor] Ignore finding rule="aws-iam-enforce-group-mfa" range="git::https:/github.com/terraform-aws-modules/terraform-aws-iam?ref=e803e25ce20a6ebd5579e0896f657fa739f6f03e/modules/iam-group-with-policies/main.tf:5-10"
2025-01-23T21:47:40Z INFO Number of language-specific files num=0
2025-01-23T21:47:40Z INFO Detected config files num=7
trivy_exitcode=0
Running Trivy in terraform/single-sign-on
2025-01-23T21:47:40Z INFO [vuln] Vulnerability scanning is enabled
2025-01-23T21:47:40Z INFO [misconfig] Misconfiguration scanning is enabled
2025-01-23T21:47:40Z INFO [secret] Secret scanning is enabled
2025-01-23T21:47:40Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-23T21:47:40Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-23T21:47:41Z INFO [terraform scanner] Scanning root module file_path="."
2025-01-23T21:47:41Z INFO Number of language-specific files num=0
2025-01-23T21:47:41Z INFO Detected config files num=1
trivy_exitcode=0
</details> #### `Checkov Scan` Success
<details><summary>Show Output</summary>
```hcl
*****************************
Checkov will check the following folders:
terraform/environments/bootstrap/member-bootstrap
terraform/environments/sprinkler
terraform/github
terraform/modernisation-platform-account
terraform/single-sign-on
*****************************
Running Checkov in terraform/environments/bootstrap/member-bootstrap
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2025-01-23 21:47:44,168 [MainThread ] [WARNI] Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-cross-account-access?ref=6819b090bce6d3068d55c7c7b9b3fd18c9dca648:None (for external modules, the --download-external-modules flag is required)
2025-01-23 21:47:44,168 [MainThread ] [WARNI] Failed to download module github.com/ministryofjustice/modernisation-platform-github-oidc-role?ref=62b8a16c73d8e4422cd81923e46948e8f4b5cf48:None (for external modules, the --download-external-modules flag is required)
2025-01-23 21:47:44,168 [MainThread ] [WARNI] Failed to download module github.com/ministryofjustice/modernisation-platform-github-oidc-provider?ref=82f546bd5f002674138a2ccdade7d7618c6758b3:None (for external modules, the --download-external-modules flag is required)
2025-01-23 21:47:44,169 [MainThread ] [WARNI] Failed to download module github.com/terraform-aws-modules/terraform-aws-iam//modules/iam-assumable-role?ref=de95e21a3bc51cd3a44b3b95a4c2f61000649ebb:None (for external modules, the --download-external-modules flag is required)
2025-01-23 21:47:44,169 [MainThread ] [WARNI] Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-pagerduty-integration?ref=0179859e6fafc567843cd55c0b05d325d5012dc4:None (for external modules, the --download-external-modules flag is required)
2025-01-23 21:47:44,169 [MainThread ] [WARNI] Failed to download module github.com/terraform-aws-modules/terraform-aws-iam//modules/iam-assumable-roles?ref=de95e21a3bc51cd3a44b3b95a4c2f61000649ebb:None (for external modules, the --download-external-modules flag is required)
terraform scan results:
Passed checks: 171, Failed checks: 0, Skipped checks: 52
checkov_exitcode=0
*****************************
Running Checkov in terraform/environments/sprinkler
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2025-01-23 21:47:47,141 [MainThread ] [WARNI] Failed to download module github.com/ministryofjustice/modernisation-platform-github-oidc-provider?ref=84a83751b5289f363a728eb181470b59fc5e2899:None (for external modules, the --download-external-modules flag is required)
terraform scan results:
Passed checks: 16, Failed checks: 0, Skipped checks: 2
checkov_exitcode=0
*****************************
Running Checkov in terraform/github
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
terraform scan results:
Passed checks: 99, Failed checks: 0, Skipped checks: 107
checkov_exitcode=0
*****************************
Running Checkov in terraform/modernisation-platform-account
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2025-01-23 21:47:53,361 [MainThread ] [WARNI] Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-iam-superadmins?ref=bea5d084de2f810eee5326562ad6d9d104a2aa05:None (for external modules, the --download-external-modules flag is required)
2025-01-23 21:47:53,361 [MainThread ] [WARNI] Failed to download module terraform-aws-modules/iam/aws//modules/iam-group-with-policies:~> 5.0 (for external modules, the --download-external-modules flag is required)
2025-01-23 21:47:53,361 [MainThread ] [WARNI] Failed to download module github.com/ministryofjustice/modernisation-platform-github-oidc-role?ref=62b8a16c73d8e4422cd81923e46948e8f4b5cf48:None (for external modules, the --download-external-modules flag is required)
2025-01-23 21:47:53,361 [MainThread ] [WARNI] Failed to download module github.com/ministryofjustice/modernisation-platform-github-oidc-provider?ref=82f546bd5f002674138a2ccdade7d7618c6758b3:None (for external modules, the --download-external-modules flag is required)
2025-01-23 21:47:53,361 [MainThread ] [WARNI] Failed to download module github.com/ministryofjustice/terraform-aws-observability-platform-tenant?ref=fbbe5c8282786bcc0a00c969fe598e14f12eea9b:None (for external modules, the --download-external-modules flag is required)
2025-01-23 21:47:53,361 [MainThread ] [WARNI] Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=cadab519b10a7d28dfa3b77d407725db6b37614a:None (for external modules, the --download-external-modules flag is required)
2025-01-23 21:47:53,362 [MainThread ] [WARNI] Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=dd8a60be4cc6d726803f49301930795d266188d8:None (for external modules, the --download-external-modules flag is required)
terraform scan results:
Passed checks: 244, Failed checks: 0, Skipped checks: 30
checkov_exitcode=0
*****************************
Running Checkov in terraform/single-sign-on
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
terraform scan results:
Passed checks: 45, Failed checks: 0, Skipped checks: 0
checkov_exitcode=0
CTFLint Scan Success
Show Output
*****************************
Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version:0.9.1)
tflint will check the following folders:
terraform/environments/bootstrap/member-bootstrap
terraform/environments/sprinkler
terraform/github
terraform/modernisation-platform-account
terraform/single-sign-on
*****************************
Running tflint in terraform/environments/bootstrap/member-bootstrap
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=0*****************************
Running tflint in terraform/environments/sprinkler
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=0*****************************
Running tflint in terraform/github
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=0*****************************
Running tflint in terraform/modernisation-platform-account
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=0*****************************
Running tflint in terraform/single-sign-on
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=0
Trivy Scan Success
Show Output
*****************************
Trivy will check the following folders:
terraform/environments/bootstrap/member-bootstrap
terraform/environments/sprinkler
terraform/github
terraform/modernisation-platform-account
terraform/single-sign-on
*****************************
Running Trivy in terraform/environments/bootstrap/member-bootstrap
2025-01-23T21:47:23Z INFO [vulndb] Need to update DB
2025-01-23T21:47:23Z INFO [vulndb] Downloading vulnerability DB...2025-01-23T21:47:23Z INFO [vulndb] Downloading artifact...repo="public.ecr.aws/aquasecurity/trivy-db:2"2025-01-23T21:47:25Z INFO [vulndb] Artifact successfully downloaded repo="public.ecr.aws/aquasecurity/trivy-db:2"2025-01-23T21:47:25Z INFO [vuln] Vulnerability scanning is enabled
2025-01-23T21:47:25Z INFO [misconfig] Misconfiguration scanning is enabled
2025-01-23T21:47:25Z INFO [misconfig] Need to update the built-in checks
2025-01-23T21:47:25Z INFO [misconfig] Downloading the built-in checks...164.50 KiB /164.50 KiB [------------------------------------------------------] 100.00%? p/s 100ms2025-01-23T21:47:26Z INFO [secret] Secret scanning is enabled
2025-01-23T21:47:26Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-23T21:47:26Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection2025-01-23T21:47:27Z INFO [terraformscanner] Scanning root module file_path="."2025-01-23T21:47:27Z ERROR [terraformevaluator] Failed to load module. Maybe try 'terraform init'?err="open modules/iam-assumable-role: no such file or directory"2025-01-23T21:47:27Z ERROR [terraformevaluator] Failed to load module. Maybe try 'terraform init'?err="open modules/iam-assumable-role: no such file or directory"2025-01-23T21:47:27Z ERROR [terraformevaluator] Failed to load module. Maybe try 'terraform init'?err="open modules/iam-assumable-role: no such file or directory"2025-01-23T21:47:27Z ERROR [terraformevaluator] Failed to load module. Maybe try 'terraform init'?err="open modules/iam-assumable-role: no such file or directory"2025-01-23T21:47:27Z ERROR [terraformevaluator] Failed to load module. Maybe try 'terraform init'?err="open modules/iam-assumable-role: no such file or directory"2025-01-23T21:47:27Z ERROR [terraformevaluator] Failed to load module. Maybe try 'terraform init'?err="open modules/iam-assumable-role: no such file or directory"2025-01-23T21:47:27Z ERROR [terraformevaluator] Failed to load module. Maybe try 'terraform init'?err="open modules/iam-assumable-roles: no such file or directory"2025-01-23T21:47:27Z ERROR [terraformevaluator] Failed to load module. Maybe try 'terraform init'?err="open modules/iam-assumable-role: no such file or directory"2025-01-23T21:47:27Z ERROR [terraformevaluator] Failed to load module. Maybe try 'terraform init'?err="open modules/iam-assumable-role: no such file or directory"2025-01-23T21:47:27Z ERROR [terraformevaluator] Failed to load module. Maybe try 'terraform init'?err="open modules/iam-assumable-role: no such file or directory"2025-01-23T21:47:29Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.pagerduty_core_alerts[0].data.aws_sns_topic.alarm_topics"value="cty.NilVal"2025-01-23T21:47:29Z INFO Number of language-specific files num=02025-01-23T21:47:29Z INFO Detected config files num=3trivy_exitcode=0*****************************
Running Trivy in terraform/environments/sprinkler
2025-01-23T21:47:29Z INFO [vuln] Vulnerability scanning is enabled
2025-01-23T21:47:29Z INFO [misconfig] Misconfiguration scanning is enabled
2025-01-23T21:47:29Z INFO [secret] Secret scanning is enabled
2025-01-23T21:47:29Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-23T21:47:29Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection2025-01-23T21:47:30Z INFO [terraformscanner] Scanning root module file_path="."2025-01-23T21:47:30Z WARN [terraformparser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.module="root"variables="networking"2025-01-23T21:47:31Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.ram-ec2-retagging[0].data.aws_subnet.host"value="cty.NilVal"2025-01-23T21:47:31Z INFO Number of language-specific files num=02025-01-23T21:47:31Z INFO Detected config files num=1trivy_exitcode=0*****************************
Running Trivy in terraform/github
2025-01-23T21:47:31Z INFO [vuln] Vulnerability scanning is enabled
2025-01-23T21:47:31Z INFO [misconfig] Misconfiguration scanning is enabled
2025-01-23T21:47:31Z INFO [secret] Secret scanning is enabled
2025-01-23T21:47:31Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-23T21:47:31Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection2025-01-23T21:47:32Z INFO [terraformscanner] Scanning root module file_path="."2025-01-23T21:47:32Z WARN [terraformparser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.module="root"variables="github_token"2025-01-23T21:47:32Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.contributor-access"value="cty.NilVal"2025-01-23T21:47:33Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.modernisation-platform-environments.github_actions_secret.default"value="cty.NilVal"2025-01-23T21:47:33Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.modernisation-platform-instance-scheduler.github_actions_secret.default"value="cty.NilVal"2025-01-23T21:47:33Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.modernisation-platform-terraform-aws-chatbot.github_actions_secret.default"value="cty.NilVal"2025-01-23T21:47:33Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.modernisation-platform-terraform-aws-data-firehose.github_actions_secret.default"value="cty.NilVal"2025-01-23T21:47:33Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.modernisation-platform-terraform-dns-certificates.github_actions_secret.default"value="cty.NilVal"2025-01-23T21:47:34Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.modernisation-platform-terraform-member-vpc.github_actions_secret.default"value="cty.NilVal"2025-01-23T21:47:34Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.modernisation-platform-terraform-module-template.github_actions_secret.default"value="cty.NilVal"2025-01-23T21:47:34Z ERROR [terraformevaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.block="module.modernisation-platform-terraform-pagerduty-integration.github_actions_secret.default"value="cty.NilVal"2025-01-23T21:47:34Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-user-attached-policies"range="testing-ci.tf:4-9"2025-01-23T21:47:34Z INFO Number of language-specific files num=02025-01-23T21:47:34Z INFO Detected config files num=3trivy_exitcode=0*****************************
Running Trivy in terraform/modernisation-platform-account
2025-01-23T21:47:34Z INFO [vuln] Vulnerability scanning is enabled
2025-01-23T21:47:34Z INFO [misconfig] Misconfiguration scanning is enabled
2025-01-23T21:47:34Z INFO [secret] Secret scanning is enabled
2025-01-23T21:47:34Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-23T21:47:34Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection2025-01-23T21:47:35Z INFO [terraformscanner] Scanning root module file_path="."2025-01-23T21:47:38Z ERROR [terraformevaluator] Failed to load module. Maybe try 'terraform init'?err="open modules/iam-account: no such file or directory"2025-01-23T21:47:38Z ERROR [terraformevaluator] Failed to load module. Maybe try 'terraform init'?err="open modules/iam-assumable-roles: no such file or directory"2025-01-23T21:47:38Z ERROR [terraformevaluator] Failed to load module. Maybe try 'terraform init'?err="open modules/iam-group-with-policies: no such file or directory"2025-01-23T21:47:38Z ERROR [terraformevaluator] Failed to load module. Maybe try 'terraform init'?err="open modules/iam-user: no such file or directory"2025-01-23T21:47:38Z ERROR [terraformevaluator] Failed to load module. Maybe try 'terraform init'?err="open modules/iam-user: no such file or directory"2025-01-23T21:47:38Z ERROR [terraformevaluator] Failed to load module. Maybe try 'terraform init'?err="open modules/iam-user: no such file or directory"2025-01-23T21:47:38Z ERROR [terraformevaluator] Failed to load module. Maybe try 'terraform init'?err="open modules/iam-user: no such file or directory"2025-01-23T21:47:38Z ERROR [terraformevaluator] Failed to load module. Maybe try 'terraform init'?err="open modules/iam-user: no such file or directory"2025-01-23T21:47:38Z ERROR [terraformevaluator] Failed to load module. Maybe try 'terraform init'?err="open modules/iam-user: no such file or directory"2025-01-23T21:47:38Z ERROR [terraformevaluator] Failed to load module. Maybe try 'terraform init'?err="open modules/iam-user: no such file or directory"2025-01-23T21:47:38Z ERROR [terraformevaluator] Failed to load module. Maybe try 'terraform init'?err="open modules/iam-user: no such file or directory"2025-01-23T21:47:38Z ERROR [terraformevaluator] Failed to load module. Maybe try 'terraform init'?err="open modules/iam-user: no such file or directory"2025-01-23T21:47:38Z ERROR [terraformevaluator] Failed to load module. Maybe try 'terraform init'?err="open modules/iam-user: no such file or directory"2025-01-23T21:47:38Z ERROR [terraformevaluator] Failed to load module. Maybe try 'terraform init'?err="open modules/iam-user: no such file or directory"2025-01-23T21:47:40Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-user-attached-policies"range="terraform-aws-modules/iam/aws/modules/iam-user/modules/iam-user/main.tf:1-10"2025-01-23T21:47:40Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-user-attached-policies"range="terraform-aws-modules/iam/aws/modules/iam-user/modules/iam-user/main.tf:1-10"2025-01-23T21:47:40Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-user-attached-policies"range="terraform-aws-modules/iam/aws/modules/iam-user/modules/iam-user/main.tf:1-10"2025-01-23T21:47:40Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-user-attached-policies"range="terraform-aws-modules/iam/aws/modules/iam-user/modules/iam-user/main.tf:1-10"2025-01-23T21:47:40Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-user-attached-policies"range="terraform-aws-modules/iam/aws/modules/iam-user/modules/iam-user/main.tf:1-10"2025-01-23T21:47:40Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-user-attached-policies"range="terraform-aws-modules/iam/aws/modules/iam-user/modules/iam-user/main.tf:1-10"2025-01-23T21:47:40Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-user-attached-policies"range="terraform-aws-modules/iam/aws/modules/iam-user/modules/iam-user/main.tf:1-10"2025-01-23T21:47:40Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-user-attached-policies"range="terraform-aws-modules/iam/aws/modules/iam-user/modules/iam-user/main.tf:1-10"2025-01-23T21:47:40Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-user-attached-policies"range="terraform-aws-modules/iam/aws/modules/iam-user/modules/iam-user/main.tf:1-10"2025-01-23T21:47:40Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-user-attached-policies"range="terraform-aws-modules/iam/aws/modules/iam-user/modules/iam-user/main.tf:1-10"2025-01-23T21:47:40Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-user-attached-policies"range="terraform-aws-modules/iam/aws/modules/iam-user/modules/iam-user/main.tf:1-10"2025-01-23T21:47:40Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-user-attached-policies"range="terraform-aws-modules/iam/aws/modules/iam-user/modules/iam-user/main.tf:1-10"2025-01-23T21:47:40Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-user-attached-policies"range="terraform-aws-modules/iam/aws/modules/iam-user/modules/iam-user/main.tf:1-10"2025-01-23T21:47:40Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-user-attached-policies"range="terraform-aws-modules/iam/aws/modules/iam-user/modules/iam-user/main.tf:1-10"2025-01-23T21:47:40Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-user-attached-policies"range="terraform-aws-modules/iam/aws/modules/iam-user/modules/iam-user/main.tf:1-10"2025-01-23T21:47:40Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-user-attached-policies"range="terraform-aws-modules/iam/aws/modules/iam-user/modules/iam-user/main.tf:1-10"2025-01-23T21:47:40Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-user-attached-policies"range="terraform-aws-modules/iam/aws/modules/iam-user/modules/iam-user/main.tf:1-10"2025-01-23T21:47:40Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-user-attached-policies"range="terraform-aws-modules/iam/aws/modules/iam-user/modules/iam-user/main.tf:1-10"2025-01-23T21:47:40Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-user-attached-policies"range="terraform-aws-modules/iam/aws/modules/iam-user/modules/iam-user/main.tf:1-10"2025-01-23T21:47:40Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-user-attached-policies"range="terraform-aws-modules/iam/aws/modules/iam-user/modules/iam-user/main.tf:1-10"2025-01-23T21:47:40Z INFO [terraformexecutor] Ignore finding rule="aws-iam-no-user-attached-policies"range="terraform-aws-modules/iam/aws/modules/iam-user/modules/iam-user/main.tf:1-10"2025-01-23T21:47:40Z INFO [terraformexecutor] Ignore finding rule="aws-s3-encryption-customer-key"range="github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=dd8a60be4cc6d726803f49301930795d266188d8/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=8688bc15a08fbf5a4f4eef9b7433c5a417df8df1/main.tf:157-165"2025-01-23T21:47:40Z INFO [terraformexecutor] Ignore finding rule="aws-sns-topic-encryption-use-cmk"range="github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=dd8a60be4cc6d726803f49301930795d266188d8/modules/config/main.tf:40"2025-01-23T21:47:40Z INFO [terraformexecutor] Ignore finding rule="aws-sns-topic-encryption-use-cmk"range="github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=dd8a60be4cc6d726803f49301930795d266188d8/modules/config/main.tf:40"2025-01-23T21:47:40Z INFO [terraformexecutor] Ignore finding rule="aws-sns-topic-encryption-use-cmk"range="github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=dd8a60be4cc6d726803f49301930795d266188d8/modules/config/main.tf:40"2025-01-23T21:47:40Z INFO [terraformexecutor] Ignore finding rule="aws-sns-topic-encryption-use-cmk"range="github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=dd8a60be4cc6d726803f49301930795d266188d8/modules/config/main.tf:40"2025-01-23T21:47:40Z INFO [terraformexecutor] Ignore finding rule="aws-sns-topic-encryption-use-cmk"range="github.com/ministryofjustice/modernisation-platform-terraform-baselines?ref=dd8a60be4cc6d726803f49301930795d266188d8/modules/config/main.tf:40"2025-01-23T21:47:40Z INFO [terraformexecutor] Ignore finding rule="aws-iam-enforce-group-mfa"range="git::https:/github.com/terraform-aws-modules/terraform-aws-iam?ref=e803e25ce20a6ebd5579e0896f657fa739f6f03e/modules/iam-group-with-policies/main.tf:5-10"2025-01-23T21:47:40Z INFO Number of language-specific files num=02025-01-23T21:47:40Z INFO Detected config files num=7trivy_exitcode=0*****************************
Running Trivy in terraform/single-sign-on
2025-01-23T21:47:40Z INFO [vuln] Vulnerability scanning is enabled
2025-01-23T21:47:40Z INFO [misconfig] Misconfiguration scanning is enabled
2025-01-23T21:47:40Z INFO [secret] Secret scanning is enabled
2025-01-23T21:47:40Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-23T21:47:40Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection2025-01-23T21:47:41Z INFO [terraformscanner] Scanning root module file_path="."2025-01-23T21:47:41Z INFO Number of language-specific files num=02025-01-23T21:47:41Z INFO Detected config files num=1trivy_exitcode=0
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A reference to the issue / Description of it
#8345
How does this PR fix the problem?
Where roles permit access to the
modernisation-platform-terraform-stateS3 bucket, this PR expands them to allow them toputanddelete.tflock files.This PR also implements small linting fixes where appropriate.
How has this been tested?
Tested through CI pipeline
Deployment Plan / Instructions
Deploy through CI
Checklist (check
xin[ ]of list items)Additional comments (if any)
{Please write here}