Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add "bug-test" VPC for testing bug 8874 #9101

Draft
wants to merge 8 commits into
base: main
Choose a base branch
from
Draft

Add "bug-test" VPC for testing bug 8874 #9101

wants to merge 8 commits into from

Conversation

richgreen-moj
Copy link
Contributor

A reference to the issue / Description of it

{Please write here}

How does this PR fix the problem?

{Please write here}

How has this been tested?

Please describe the tests that you ran and provide instructions to reproduce.

{Please write here}

Deployment Plan / Instructions

Will this deployment impact the platform and / or services on it?

{Please write here}

Checklist (check x in [ ] of list items)

  • I have performed a self-review of my own code
  • All checks have passed
  • I have made corresponding changes to the documentation
  • Plan and discussed how it should be deployed to PROD (If needed)

Additional comments (if any)

{Please write here}

@github-actions github-actions bot added onboarding Tasks to onboard teams networking labels Jan 27, 2025
@github-actions GitHub Actions
Copy link
Contributor

Please check the plan carefully before deploying these changes.

⚠️ Making changes to the environments-networks/*.json files will affect the networking of MP AWS accounts, in particular which VPC/Subnet is being shared in to which environment. For more guidance consult the documentation.

@github-actions GitHub Actions
Copy link
Contributor

Trivy Scan Success

Show Output ```hcl

Trivy will check the following folders:

</details> #### `Checkov Scan` Success
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:

CTFLint Scan Success

Show Output 
*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:

Trivy Scan Success

Show Output 
*****************************

Trivy will check the following folders:

@github-actions GitHub Actions
Copy link
Contributor

Please check the plan carefully before deploying these changes.

⚠️ Making changes to the environments-networks/*.json files will affect the networking of MP AWS accounts, in particular which VPC/Subnet is being shared in to which environment. For more guidance consult the documentation.

@github-actions GitHub Actions
Copy link
Contributor

Trivy Scan Success

Show Output ```hcl

Trivy will check the following folders:

</details> #### `Checkov Scan` Success
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:

CTFLint Scan Success

Show Output 
*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:

Trivy Scan Success

Show Output 
*****************************

Trivy will check the following folders:

@github-actions GitHub Actions
Copy link
Contributor

Please check the plan carefully before deploying these changes.

⚠️ Making changes to the environments-networks/*.json files will affect the networking of MP AWS accounts, in particular which VPC/Subnet is being shared in to which environment. For more guidance consult the documentation.

@github-actions GitHub Actions
Copy link
Contributor

Trivy Scan Success

Show Output ```hcl

Trivy will check the following folders:

</details> #### `Checkov Scan` Success
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:

CTFLint Scan Success

Show Output 
*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:

Trivy Scan Success

Show Output 
*****************************

Trivy will check the following folders:

@github-actions GitHub Actions
Copy link
Contributor

Please check the plan carefully before deploying these changes.

⚠️ Making changes to the environments-networks/*.json files will affect the networking of MP AWS accounts, in particular which VPC/Subnet is being shared in to which environment. For more guidance consult the documentation.

@github-actions GitHub Actions
Copy link
Contributor

Terraform Plan Summary

core-vpc-production
Plan: 36 to add, 0 to change, 36 to destroy.

github-actions[bot]
github-actions bot requested changes Jan 29, 2025
View reviewed changes
Copy link
Contributor

@github-actions github-actions bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Warning - Large Number of Resources to be Destroyed.

core-vpc-production
Plan: 36 to add, 0 to change, 36 to destroy.
Please review the plan and confirm the changes are expected.

github-actions[bot]
github-actions bot requested changes Jan 29, 2025
View reviewed changes
Copy link
Contributor

@github-actions github-actions bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Warning - Large Number of Resources to be Destroyed.

core-vpc-test
Plan: 36 to add, 0 to change, 36 to destroy.
Please review the plan and confirm the changes are expected.

@github-actions GitHub Actions
Copy link
Contributor

Terraform Plan Summary

core-vpc-test
Plan: 36 to add, 0 to change, 36 to destroy.

github-actions[bot]
github-actions bot requested changes Jan 29, 2025
View reviewed changes
Copy link
Contributor

@github-actions github-actions bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Warning - Large Number of Resources to be Destroyed.

core-vpc-development
Plan: 36 to add, 0 to change, 36 to destroy.
Please review the plan and confirm the changes are expected.

@github-actions GitHub Actions
Copy link
Contributor

Terraform Plan Summary

core-vpc-development
Plan: 36 to add, 0 to change, 36 to destroy.

github-actions[bot]
github-actions bot requested changes Jan 29, 2025
View reviewed changes
Copy link
Contributor

@github-actions github-actions bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Warning - Large Number of Resources to be Destroyed.

core-vpc-preproduction
Plan: 36 to add, 0 to change, 36 to destroy.
Please review the plan and confirm the changes are expected.

@github-actions GitHub Actions
Copy link
Contributor

Terraform Plan Summary

core-vpc-preproduction
Plan: 36 to add, 0 to change, 36 to destroy.

@github-actions GitHub Actions
Copy link
Contributor

Trivy Scan Success

Show Output ```hcl

Trivy will check the following folders:
terraform/environments/core-vpc

Running Trivy in terraform/environments/core-vpc
2025-01-29T08:42:29Z INFO [vulndb] Need to update DB
2025-01-29T08:42:29Z INFO [vulndb] Downloading vulnerability DB...
2025-01-29T08:42:29Z INFO [vulndb] Downloading artifact... repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-29T08:42:32Z INFO [vulndb] Artifact successfully downloaded repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-29T08:42:32Z INFO [vuln] Vulnerability scanning is enabled
2025-01-29T08:42:32Z INFO [misconfig] Misconfiguration scanning is enabled
2025-01-29T08:42:32Z INFO [misconfig] Need to update the built-in checks
2025-01-29T08:42:32Z INFO [misconfig] Downloading the built-in checks...
164.50 KiB / 164.50 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2025-01-29T08:42:32Z INFO [secret] Secret scanning is enabled
2025-01-29T08:42:32Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-29T08:42:32Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-29T08:42:33Z INFO [terraform scanner] Scanning root module file_path="."
2025-01-29T08:42:33Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_iam_role.member-delegation" value="cty.NilVal"
2025-01-29T08:42:33Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_iam_role_policy.member-delegation" value="cty.NilVal"
2025-01-29T08:42:33Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_route.transit_gateway" value="cty.NilVal"
2025-01-29T08:42:33Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.dns-zone" value="cty.NilVal"
2025-01-29T08:42:33Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.dns_zone_extend" value="cty.NilVal"
2025-01-29T08:42:33Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.dns_zone_extend_private" value="cty.NilVal"
2025-01-29T08:42:33Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.r53_dns_firewall" value="cty.NilVal"
2025-01-29T08:42:33Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.resource-share" value="cty.NilVal"
2025-01-29T08:42:33Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.vpc" value="cty.NilVal"
2025-01-29T08:42:33Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.vpc_attachment" value="cty.NilVal"
2025-01-29T08:42:33Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.vpc_nacls" value="cty.NilVal"
2025-01-29T08:42:34Z INFO [terraform executor] Ignore finding rule="aws-sns-enable-topic-encryption" range="monitoring.tf:9-15"
2025-01-29T08:42:34Z INFO Number of language-specific files num=0
2025-01-29T08:42:34Z INFO Detected config files num=2
trivy_exitcode=0

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/core-vpc

*****************************

Running Checkov in terraform/environments/core-vpc
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2025-01-29 08:42:36,856 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-pagerduty-integration?ref=0179859e6fafc567843cd55c0b05d325d5012dc4:None (for external modules, the --download-external-modules flag is required)
2025-01-29 08:42:36,857 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/terraform-aws-observability-platform-tenant?ref=fbbe5c8282786bcc0a00c969fe598e14f12eea9b:None (for external modules, the --download-external-modules flag is required)
2025-01-29 08:42:36,857 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-member-vpc?ref=bug/8874-tgw-circular-dependency:None (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 305, Failed checks: 2, Skipped checks: 135

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: vpc
	File: /vpc.tf:92-105
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		92  | module "vpc" {
		93  |   for_each             = local.vpcs[terraform.workspace]
		94  |   source               = "github.com/ministryofjustice/modernisation-platform-terraform-member-vpc?ref=bug/8874-tgw-circular-dependency"
		95  |   additional_endpoints = each.value.options.additional_endpoints
		96  |   subnet_sets          = { for key, subnet in each.value.cidr.subnet_sets : key => subnet.cidr }
		97  | 
		98  |   # VPC Flow Logs
		99  |   vpc_flow_log_iam_role       = aws_iam_role.vpc_flow_log.arn
		100 |   flow_log_s3_destination_arn = local.is-production ? local.core_logging_bucket_arns["vpc-flow-logs"] : ""
		101 | 
		102 |   # Tags
		103 |   tags_common = local.tags
		104 |   tags_prefix = each.key
		105 | }

Check: CKV_TF_2: "Ensure Terraform module sources use a tag with a version number"
	FAILED for resource: vpc
	File: /vpc.tf:92-105
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-tag

		92  | module "vpc" {
		93  |   for_each             = local.vpcs[terraform.workspace]
		94  |   source               = "github.com/ministryofjustice/modernisation-platform-terraform-member-vpc?ref=bug/8874-tgw-circular-dependency"
		95  |   additional_endpoints = each.value.options.additional_endpoints
		96  |   subnet_sets          = { for key, subnet in each.value.cidr.subnet_sets : key => subnet.cidr }
		97  | 
		98  |   # VPC Flow Logs
		99  |   vpc_flow_log_iam_role       = aws_iam_role.vpc_flow_log.arn
		100 |   flow_log_s3_destination_arn = local.is-production ? local.core_logging_bucket_arns["vpc-flow-logs"] : ""
		101 | 
		102 |   # Tags
		103 |   tags_common = local.tags
		104 |   tags_prefix = each.key
		105 | }


checkov_exitcode=1

CTFLint Scan Success

Show Output 
*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
terraform/environments/core-vpc

*****************************

Running tflint in terraform/environments/core-vpc
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=0

Trivy Scan Success

Show Output 
*****************************

Trivy will check the following folders:
terraform/environments/core-vpc

*****************************

Running Trivy in terraform/environments/core-vpc
2025-01-29T08:42:29Z	INFO	[vulndb] Need to update DB
2025-01-29T08:42:29Z	INFO	[vulndb] Downloading vulnerability DB...
2025-01-29T08:42:29Z	INFO	[vulndb] Downloading artifact...	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-29T08:42:32Z	INFO	[vulndb] Artifact successfully downloaded	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-29T08:42:32Z	INFO	[vuln] Vulnerability scanning is enabled
2025-01-29T08:42:32Z	INFO	[misconfig] Misconfiguration scanning is enabled
2025-01-29T08:42:32Z	INFO	[misconfig] Need to update the built-in checks
2025-01-29T08:42:32Z	INFO	[misconfig] Downloading the built-in checks...
164.50 KiB / 164.50 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2025-01-29T08:42:32Z	INFO	[secret] Secret scanning is enabled
2025-01-29T08:42:32Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-29T08:42:32Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-29T08:42:33Z	INFO	[terraform scanner] Scanning root module	file_path="."
2025-01-29T08:42:33Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_iam_role.member-delegation" value="cty.NilVal"
2025-01-29T08:42:33Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_iam_role_policy.member-delegation" value="cty.NilVal"
2025-01-29T08:42:33Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_route.transit_gateway" value="cty.NilVal"
2025-01-29T08:42:33Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.dns-zone" value="cty.NilVal"
2025-01-29T08:42:33Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.dns_zone_extend" value="cty.NilVal"
2025-01-29T08:42:33Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.dns_zone_extend_private" value="cty.NilVal"
2025-01-29T08:42:33Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.r53_dns_firewall" value="cty.NilVal"
2025-01-29T08:42:33Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.resource-share" value="cty.NilVal"
2025-01-29T08:42:33Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.vpc" value="cty.NilVal"
2025-01-29T08:42:33Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.vpc_attachment" value="cty.NilVal"
2025-01-29T08:42:33Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.vpc_nacls" value="cty.NilVal"
2025-01-29T08:42:34Z	INFO	[terraform executor] Ignore finding	rule="aws-sns-enable-topic-encryption" range="monitoring.tf:9-15"
2025-01-29T08:42:34Z	INFO	Number of language-specific files	num=0
2025-01-29T08:42:34Z	INFO	Detected config files	num=2
trivy_exitcode=0

@github-actions GitHub Actions
Copy link
Contributor

Please check the plan carefully before deploying these changes.

⚠️ Making changes to the environments-networks/*.json files will affect the networking of MP AWS accounts, in particular which VPC/Subnet is being shared in to which environment. For more guidance consult the documentation.

github-actions[bot]
github-actions bot requested changes Jan 29, 2025
View reviewed changes
Copy link
Contributor

@github-actions github-actions bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Warning - Large Number of Resources to be Destroyed.

core-vpc-preproduction
Plan: 144 to add, 0 to change, 144 to destroy.
Please review the plan and confirm the changes are expected.

@github-actions GitHub Actions
Copy link
Contributor

Terraform Plan Summary

core-vpc-preproduction
Plan: 144 to add, 0 to change, 144 to destroy.

github-actions[bot]
github-actions bot requested changes Jan 29, 2025
View reviewed changes
Copy link
Contributor

@github-actions github-actions bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Warning - Large Number of Resources to be Destroyed.

core-vpc-development
Plan: 144 to add, 0 to change, 144 to destroy.
Please review the plan and confirm the changes are expected.

@github-actions GitHub Actions
Copy link
Contributor

Terraform Plan Summary

core-vpc-development
Plan: 144 to add, 0 to change, 144 to destroy.

github-actions[bot]
github-actions bot requested changes Jan 29, 2025
View reviewed changes
Copy link
Contributor

@github-actions github-actions bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Warning - Large Number of Resources to be Destroyed.

core-vpc-test
Plan: 144 to add, 0 to change, 144 to destroy.
Please review the plan and confirm the changes are expected.

@github-actions GitHub Actions
Copy link
Contributor

Terraform Plan Summary

core-vpc-test
Plan: 144 to add, 0 to change, 144 to destroy.

github-actions[bot]
github-actions bot requested changes Jan 29, 2025
View reviewed changes
Copy link
Contributor

@github-actions github-actions bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Warning - Large Number of Resources to be Destroyed.

core-vpc-production
Plan: 144 to add, 0 to change, 144 to destroy.
Please review the plan and confirm the changes are expected.

@github-actions GitHub Actions
Copy link
Contributor

Terraform Plan Summary

core-vpc-production
Plan: 144 to add, 0 to change, 144 to destroy.

@github-actions GitHub Actions
Copy link
Contributor

Trivy Scan Success

Show Output ```hcl

Trivy will check the following folders:
terraform/environments/core-vpc
terraform/modules/ram-resource-share

Running Trivy in terraform/environments/core-vpc
2025-01-29T11:03:35Z INFO [vulndb] Need to update DB
2025-01-29T11:03:35Z INFO [vulndb] Downloading vulnerability DB...
2025-01-29T11:03:35Z INFO [vulndb] Downloading artifact... repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-29T11:03:38Z INFO [vulndb] Artifact successfully downloaded repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-29T11:03:38Z INFO [vuln] Vulnerability scanning is enabled
2025-01-29T11:03:38Z INFO [misconfig] Misconfiguration scanning is enabled
2025-01-29T11:03:38Z INFO [misconfig] Need to update the built-in checks
2025-01-29T11:03:38Z INFO [misconfig] Downloading the built-in checks...
164.50 KiB / 164.50 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2025-01-29T11:03:38Z INFO [secret] Secret scanning is enabled
2025-01-29T11:03:38Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-29T11:03:38Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-29T11:03:39Z INFO [terraform scanner] Scanning root module file_path="."
2025-01-29T11:03:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_iam_role.member-delegation" value="cty.NilVal"
2025-01-29T11:03:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_iam_role_policy.member-delegation" value="cty.NilVal"
2025-01-29T11:03:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_route.transit_gateway" value="cty.NilVal"
2025-01-29T11:03:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.dns-zone" value="cty.NilVal"
2025-01-29T11:03:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.dns_zone_extend" value="cty.NilVal"
2025-01-29T11:03:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.dns_zone_extend_private" value="cty.NilVal"
2025-01-29T11:03:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.r53_dns_firewall" value="cty.NilVal"
2025-01-29T11:03:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.resource-share" value="cty.NilVal"
2025-01-29T11:03:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.vpc" value="cty.NilVal"
2025-01-29T11:03:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.vpc_attachment" value="cty.NilVal"
2025-01-29T11:03:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.vpc_nacls" value="cty.NilVal"
2025-01-29T11:03:41Z INFO [terraform executor] Ignore finding rule="aws-sns-enable-topic-encryption" range="monitoring.tf:9-15"
2025-01-29T11:03:41Z INFO Number of language-specific files num=0
2025-01-29T11:03:41Z INFO Detected config files num=2
trivy_exitcode=0

Running Trivy in terraform/modules/ram-resource-share
2025-01-29T11:03:41Z INFO [vuln] Vulnerability scanning is enabled
2025-01-29T11:03:41Z INFO [misconfig] Misconfiguration scanning is enabled
2025-01-29T11:03:41Z INFO [secret] Secret scanning is enabled
2025-01-29T11:03:41Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-29T11:03:41Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-29T11:03:42Z INFO [terraform scanner] Scanning root module file_path="."
2025-01-29T11:03:42Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="resource_arns, tags_common, tags_prefix"
2025-01-29T11:03:42Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ram_resource_association.default" value="cty.NilVal"
2025-01-29T11:03:42Z INFO Number of language-specific files num=0
2025-01-29T11:03:42Z INFO Detected config files num=1
trivy_exitcode=0

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/core-vpc
terraform/modules/ram-resource-share

*****************************

Running Checkov in terraform/environments/core-vpc
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2025-01-29 11:03:45,632 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-pagerduty-integration?ref=0179859e6fafc567843cd55c0b05d325d5012dc4:None (for external modules, the --download-external-modules flag is required)
2025-01-29 11:03:45,633 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/terraform-aws-observability-platform-tenant?ref=fbbe5c8282786bcc0a00c969fe598e14f12eea9b:None (for external modules, the --download-external-modules flag is required)
2025-01-29 11:03:45,633 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-member-vpc?ref=bug/8874-tgw-circular-dependency:None (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 305, Failed checks: 2, Skipped checks: 135

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: vpc
	File: /vpc.tf:92-105
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		92  | module "vpc" {
		93  |   for_each             = local.vpcs[terraform.workspace]
		94  |   source               = "github.com/ministryofjustice/modernisation-platform-terraform-member-vpc?ref=bug/8874-tgw-circular-dependency"
		95  |   additional_endpoints = each.value.options.additional_endpoints
		96  |   subnet_sets          = { for key, subnet in each.value.cidr.subnet_sets : key => subnet.cidr }
		97  | 
		98  |   # VPC Flow Logs
		99  |   vpc_flow_log_iam_role       = aws_iam_role.vpc_flow_log.arn
		100 |   flow_log_s3_destination_arn = local.is-production ? local.core_logging_bucket_arns["vpc-flow-logs"] : ""
		101 | 
		102 |   # Tags
		103 |   tags_common = local.tags
		104 |   tags_prefix = each.key
		105 | }

Check: CKV_TF_2: "Ensure Terraform module sources use a tag with a version number"
	FAILED for resource: vpc
	File: /vpc.tf:92-105
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-tag

		92  | module "vpc" {
		93  |   for_each             = local.vpcs[terraform.workspace]
		94  |   source               = "github.com/ministryofjustice/modernisation-platform-terraform-member-vpc?ref=bug/8874-tgw-circular-dependency"
		95  |   additional_endpoints = each.value.options.additional_endpoints
		96  |   subnet_sets          = { for key, subnet in each.value.cidr.subnet_sets : key => subnet.cidr }
		97  | 
		98  |   # VPC Flow Logs
		99  |   vpc_flow_log_iam_role       = aws_iam_role.vpc_flow_log.arn
		100 |   flow_log_s3_destination_arn = local.is-production ? local.core_logging_bucket_arns["vpc-flow-logs"] : ""
		101 | 
		102 |   # Tags
		103 |   tags_common = local.tags
		104 |   tags_prefix = each.key
		105 | }


checkov_exitcode=1

*****************************

Running Checkov in terraform/modules/ram-resource-share
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39

checkov_exitcode=1

CTFLint Scan Success

Show Output 
*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
terraform/environments/core-vpc
terraform/modules/ram-resource-share

*****************************

Running tflint in terraform/environments/core-vpc
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=0

*****************************

Running tflint in terraform/modules/ram-resource-share
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=0

Trivy Scan Success

Show Output 
*****************************

Trivy will check the following folders:
terraform/environments/core-vpc
terraform/modules/ram-resource-share

*****************************

Running Trivy in terraform/environments/core-vpc
2025-01-29T11:03:35Z	INFO	[vulndb] Need to update DB
2025-01-29T11:03:35Z	INFO	[vulndb] Downloading vulnerability DB...
2025-01-29T11:03:35Z	INFO	[vulndb] Downloading artifact...	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-29T11:03:38Z	INFO	[vulndb] Artifact successfully downloaded	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-29T11:03:38Z	INFO	[vuln] Vulnerability scanning is enabled
2025-01-29T11:03:38Z	INFO	[misconfig] Misconfiguration scanning is enabled
2025-01-29T11:03:38Z	INFO	[misconfig] Need to update the built-in checks
2025-01-29T11:03:38Z	INFO	[misconfig] Downloading the built-in checks...
164.50 KiB / 164.50 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2025-01-29T11:03:38Z	INFO	[secret] Secret scanning is enabled
2025-01-29T11:03:38Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-29T11:03:38Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-29T11:03:39Z	INFO	[terraform scanner] Scanning root module	file_path="."
2025-01-29T11:03:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_iam_role.member-delegation" value="cty.NilVal"
2025-01-29T11:03:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_iam_role_policy.member-delegation" value="cty.NilVal"
2025-01-29T11:03:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_route.transit_gateway" value="cty.NilVal"
2025-01-29T11:03:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.dns-zone" value="cty.NilVal"
2025-01-29T11:03:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.dns_zone_extend" value="cty.NilVal"
2025-01-29T11:03:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.dns_zone_extend_private" value="cty.NilVal"
2025-01-29T11:03:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.r53_dns_firewall" value="cty.NilVal"
2025-01-29T11:03:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.resource-share" value="cty.NilVal"
2025-01-29T11:03:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.vpc" value="cty.NilVal"
2025-01-29T11:03:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.vpc_attachment" value="cty.NilVal"
2025-01-29T11:03:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.vpc_nacls" value="cty.NilVal"
2025-01-29T11:03:41Z	INFO	[terraform executor] Ignore finding	rule="aws-sns-enable-topic-encryption" range="monitoring.tf:9-15"
2025-01-29T11:03:41Z	INFO	Number of language-specific files	num=0
2025-01-29T11:03:41Z	INFO	Detected config files	num=2
trivy_exitcode=0

*****************************

Running Trivy in terraform/modules/ram-resource-share
2025-01-29T11:03:41Z	INFO	[vuln] Vulnerability scanning is enabled
2025-01-29T11:03:41Z	INFO	[misconfig] Misconfiguration scanning is enabled
2025-01-29T11:03:41Z	INFO	[secret] Secret scanning is enabled
2025-01-29T11:03:41Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-29T11:03:41Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-29T11:03:42Z	INFO	[terraform scanner] Scanning root module	file_path="."
2025-01-29T11:03:42Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="resource_arns, tags_common, tags_prefix"
2025-01-29T11:03:42Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ram_resource_association.default" value="cty.NilVal"
2025-01-29T11:03:42Z	INFO	Number of language-specific files	num=0
2025-01-29T11:03:42Z	INFO	Detected config files	num=1
trivy_exitcode=0

@github-actions GitHub Actions
Copy link
Contributor

Please check the plan carefully before deploying these changes.

⚠️ Making changes to the environments-networks/*.json files will affect the networking of MP AWS accounts, in particular which VPC/Subnet is being shared in to which environment. For more guidance consult the documentation.

@github-actions GitHub Actions
Copy link
Contributor

Please check the plan carefully before deploying these changes.

⚠️ Making changes to the environments-networks/*.json files will affect the networking of MP AWS accounts, in particular which VPC/Subnet is being shared in to which environment. For more guidance consult the documentation.

@github-actions GitHub Actions
Copy link
Contributor

Trivy Scan Success

Show Output ```hcl

Trivy will check the following folders:
terraform/environments/core-vpc
terraform/modules/ram-resource-share
terraform/modules/vpc-nacls

Running Trivy in terraform/environments/core-vpc
2025-01-29T15:57:06Z INFO [vulndb] Need to update DB
2025-01-29T15:57:06Z INFO [vulndb] Downloading vulnerability DB...
2025-01-29T15:57:06Z INFO [vulndb] Downloading artifact... repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-29T15:57:08Z INFO [vulndb] Artifact successfully downloaded repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-29T15:57:08Z INFO [vuln] Vulnerability scanning is enabled
2025-01-29T15:57:08Z INFO [misconfig] Misconfiguration scanning is enabled
2025-01-29T15:57:08Z INFO [misconfig] Need to update the built-in checks
2025-01-29T15:57:08Z INFO [misconfig] Downloading the built-in checks...
164.50 KiB / 164.50 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2025-01-29T15:57:08Z INFO [secret] Secret scanning is enabled
2025-01-29T15:57:08Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-29T15:57:08Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-29T15:57:10Z INFO [terraform scanner] Scanning root module file_path="."
2025-01-29T15:57:10Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_iam_role.member-delegation" value="cty.NilVal"
2025-01-29T15:57:10Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_iam_role_policy.member-delegation" value="cty.NilVal"
2025-01-29T15:57:10Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_route.transit_gateway" value="cty.NilVal"
2025-01-29T15:57:10Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.dns-zone" value="cty.NilVal"
2025-01-29T15:57:10Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.dns_zone_extend" value="cty.NilVal"
2025-01-29T15:57:10Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.dns_zone_extend_private" value="cty.NilVal"
2025-01-29T15:57:10Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.r53_dns_firewall" value="cty.NilVal"
2025-01-29T15:57:10Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.resource-share" value="cty.NilVal"
2025-01-29T15:57:10Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.vpc" value="cty.NilVal"
2025-01-29T15:57:10Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.vpc_attachment" value="cty.NilVal"
2025-01-29T15:57:10Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.vpc_nacls" value="cty.NilVal"
2025-01-29T15:57:10Z INFO [terraform executor] Ignore finding rule="aws-sns-enable-topic-encryption" range="monitoring.tf:9-15"
2025-01-29T15:57:10Z INFO Number of language-specific files num=0
2025-01-29T15:57:10Z INFO Detected config files num=2
trivy_exitcode=0

Running Trivy in terraform/modules/ram-resource-share
2025-01-29T15:57:10Z INFO [vuln] Vulnerability scanning is enabled
2025-01-29T15:57:10Z INFO [misconfig] Misconfiguration scanning is enabled
2025-01-29T15:57:10Z INFO [secret] Secret scanning is enabled
2025-01-29T15:57:10Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-29T15:57:10Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-29T15:57:12Z INFO [terraform scanner] Scanning root module file_path="."
2025-01-29T15:57:12Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="resource_arns, tags_common, tags_prefix"
2025-01-29T15:57:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ram_resource_association.default" value="cty.NilVal"
2025-01-29T15:57:12Z INFO Number of language-specific files num=0
2025-01-29T15:57:12Z INFO Detected config files num=1
trivy_exitcode=0

Running Trivy in terraform/modules/vpc-nacls
2025-01-29T15:57:12Z INFO [vuln] Vulnerability scanning is enabled
2025-01-29T15:57:12Z INFO [misconfig] Misconfiguration scanning is enabled
2025-01-29T15:57:12Z INFO [secret] Secret scanning is enabled
2025-01-29T15:57:12Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-29T15:57:12Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-29T15:57:13Z INFO [terraform scanner] Scanning root module file_path="."
2025-01-29T15:57:13Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="data_subnet_ids, private_subnet_ids, protected_subnet_ids, public_subnet_ids, tags_prefix, vpc_cidr, vpc_id, vpc_name"
2025-01-29T15:57:13Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-29T15:57:13Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-29T15:57:13Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-29T15:57:13Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-29T15:57:13Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-29T15:57:13Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-29T15:57:13Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-29T15:57:13Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-29T15:57:13Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-29T15:57:13Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-29T15:57:13Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-29T15:57:13Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-29T15:57:13Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-29T15:57:13Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-29T15:57:13Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-29T15:57:13Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-29T15:57:13Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-29T15:57:13Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-29T15:57:13Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-29T15:57:13Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-29T15:57:13Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-29T15:57:13Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-29T15:57:13Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-29T15:57:13Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-29T15:57:13Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-29T15:57:13Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-29T15:57:13Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-29T15:57:13Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-29T15:57:13Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-29T15:57:13Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-29T15:57:13Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:95"
2025-01-29T15:57:13Z INFO Number of language-specific files num=0
2025-01-29T15:57:13Z INFO Detected config files num=2
trivy_exitcode=0

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/core-vpc
terraform/modules/ram-resource-share
terraform/modules/vpc-nacls

*****************************

Running Checkov in terraform/environments/core-vpc
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2025-01-29 15:57:16,422 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-pagerduty-integration?ref=0179859e6fafc567843cd55c0b05d325d5012dc4:None (for external modules, the --download-external-modules flag is required)
2025-01-29 15:57:16,422 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/terraform-aws-observability-platform-tenant?ref=fbbe5c8282786bcc0a00c969fe598e14f12eea9b:None (for external modules, the --download-external-modules flag is required)
2025-01-29 15:57:16,596 [MainThread  ] [WARNI]  Module /Users/richard.green/Documents/GitHub/modernisation-platform-terraform-member-vpc:latest failed to load via <class 'checkov.terraform.module_loading.loaders.local_path_loader.LocalPathLoader'>
2025-01-29 15:57:16,596 [MainThread  ] [WARNI]  Unable to load module - source: /Users/richard.green/Documents/GitHub/modernisation-platform-terraform-member-vpc, version: latest, error: /Users/richard.green/Documents/GitHub/modernisation-platform-terraform-member-vpc
terraform scan results:

Passed checks: 128, Failed checks: 2, Skipped checks: 27

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: vpc
	File: /vpc.tf:92-106
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		92  | module "vpc" {
		93  |   for_each = local.vpcs[terraform.workspace]
		94  |   # source               = "github.com/ministryofjustice/modernisation-platform-terraform-member-vpc?ref=bug/8874-tgw-circular-dependency"
		95  |   source               = "/Users/richard.green/Documents/GitHub/modernisation-platform-terraform-member-vpc"
		96  |   additional_endpoints = each.value.options.additional_endpoints
		97  |   subnet_sets          = { for key, subnet in each.value.cidr.subnet_sets : key => subnet.cidr }
		98  | 
		99  |   # VPC Flow Logs
		100 |   vpc_flow_log_iam_role       = aws_iam_role.vpc_flow_log.arn
		101 |   flow_log_s3_destination_arn = local.is-production ? local.core_logging_bucket_arns["vpc-flow-logs"] : ""
		102 | 
		103 |   # Tags
		104 |   tags_common = local.tags
		105 |   tags_prefix = each.key
		106 | }

Check: CKV_TF_2: "Ensure Terraform module sources use a tag with a version number"
	FAILED for resource: vpc
	File: /vpc.tf:92-106
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-tag

		92  | module "vpc" {
		93  |   for_each = local.vpcs[terraform.workspace]
		94  |   # source               = "github.com/ministryofjustice/modernisation-platform-terraform-member-vpc?ref=bug/8874-tgw-circular-dependency"
		95  |   source               = "/Users/richard.green/Documents/GitHub/modernisation-platform-terraform-member-vpc"
		96  |   additional_endpoints = each.value.options.additional_endpoints
		97  |   subnet_sets          = { for key, subnet in each.value.cidr.subnet_sets : key => subnet.cidr }
		98  | 
		99  |   # VPC Flow Logs
		100 |   vpc_flow_log_iam_role       = aws_iam_role.vpc_flow_log.arn
		101 |   flow_log_s3_destination_arn = local.is-production ? local.core_logging_bucket_arns["vpc-flow-logs"] : ""
		102 | 
		103 |   # Tags
		104 |   tags_common = local.tags
		105 |   tags_prefix = each.key
		106 | }


checkov_exitcode=1

*****************************

Running Checkov in terraform/modules/ram-resource-share
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39

checkov_exitcode=1

*****************************

Running Checkov in terraform/modules/vpc-nacls
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
terraform scan results:

Passed checks: 76, Failed checks: 0, Skipped checks: 20


checkov_exitcode=1

CTFLint Scan Success

Show Output 
*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
terraform/environments/core-vpc
terraform/modules/ram-resource-share
terraform/modules/vpc-nacls

*****************************

Running tflint in terraform/environments/core-vpc
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=0

*****************************

Running tflint in terraform/modules/ram-resource-share
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=0

*****************************

Running tflint in terraform/modules/vpc-nacls
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=0

Trivy Scan Success

Show Output 
*****************************

Trivy will check the following folders:
terraform/environments/core-vpc
terraform/modules/ram-resource-share
terraform/modules/vpc-nacls

*****************************

Running Trivy in terraform/environments/core-vpc
2025-01-29T15:57:06Z	INFO	[vulndb] Need to update DB
2025-01-29T15:57:06Z	INFO	[vulndb] Downloading vulnerability DB...
2025-01-29T15:57:06Z	INFO	[vulndb] Downloading artifact...	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-29T15:57:08Z	INFO	[vulndb] Artifact successfully downloaded	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-29T15:57:08Z	INFO	[vuln] Vulnerability scanning is enabled
2025-01-29T15:57:08Z	INFO	[misconfig] Misconfiguration scanning is enabled
2025-01-29T15:57:08Z	INFO	[misconfig] Need to update the built-in checks
2025-01-29T15:57:08Z	INFO	[misconfig] Downloading the built-in checks...
164.50 KiB / 164.50 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2025-01-29T15:57:08Z	INFO	[secret] Secret scanning is enabled
2025-01-29T15:57:08Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-29T15:57:08Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-29T15:57:10Z	INFO	[terraform scanner] Scanning root module	file_path="."
2025-01-29T15:57:10Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_iam_role.member-delegation" value="cty.NilVal"
2025-01-29T15:57:10Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_iam_role_policy.member-delegation" value="cty.NilVal"
2025-01-29T15:57:10Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_route.transit_gateway" value="cty.NilVal"
2025-01-29T15:57:10Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.dns-zone" value="cty.NilVal"
2025-01-29T15:57:10Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.dns_zone_extend" value="cty.NilVal"
2025-01-29T15:57:10Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.dns_zone_extend_private" value="cty.NilVal"
2025-01-29T15:57:10Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.r53_dns_firewall" value="cty.NilVal"
2025-01-29T15:57:10Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.resource-share" value="cty.NilVal"
2025-01-29T15:57:10Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.vpc" value="cty.NilVal"
2025-01-29T15:57:10Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.vpc_attachment" value="cty.NilVal"
2025-01-29T15:57:10Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.vpc_nacls" value="cty.NilVal"
2025-01-29T15:57:10Z	INFO	[terraform executor] Ignore finding	rule="aws-sns-enable-topic-encryption" range="monitoring.tf:9-15"
2025-01-29T15:57:10Z	INFO	Number of language-specific files	num=0
2025-01-29T15:57:10Z	INFO	Detected config files	num=2
trivy_exitcode=0

*****************************

Running Trivy in terraform/modules/ram-resource-share
2025-01-29T15:57:10Z	INFO	[vuln] Vulnerability scanning is enabled
2025-01-29T15:57:10Z	INFO	[misconfig] Misconfiguration scanning is enabled
2025-01-29T15:57:10Z	INFO	[secret] Secret scanning is enabled
2025-01-29T15:57:10Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-29T15:57:10Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-29T15:57:12Z	INFO	[terraform scanner] Scanning root module	file_path="."
2025-01-29T15:57:12Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="resource_arns, tags_common, tags_prefix"
2025-01-29T15:57:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ram_resource_association.default" value="cty.NilVal"
2025-01-29T15:57:12Z	INFO	Number of language-specific files	num=0
2025-01-29T15:57:12Z	INFO	Detected config files	num=1
trivy_exitcode=0

*****************************

Running Trivy in terraform/modules/vpc-nacls
2025-01-29T15:57:12Z	INFO	[vuln] Vulnerability scanning is enabled
2025-01-29T15:57:12Z	INFO	[misconfig] Misconfiguration scanning is enabled
2025-01-29T15:57:12Z	INFO	[secret] Secret scanning is enabled
2025-01-29T15:57:12Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-29T15:57:12Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-29T15:57:13Z	INFO	[terraform scanner] Scanning root module	file_path="."
2025-01-29T15:57:13Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="data_subnet_ids, private_subnet_ids, protected_subnet_ids, public_subnet_ids, tags_prefix, vpc_cidr, vpc_id, vpc_name"
2025-01-29T15:57:13Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-29T15:57:13Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-29T15:57:13Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-29T15:57:13Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-29T15:57:13Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-29T15:57:13Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-29T15:57:13Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-29T15:57:13Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-29T15:57:13Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-29T15:57:13Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-29T15:57:13Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-29T15:57:13Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-29T15:57:13Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-29T15:57:13Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-29T15:57:13Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-29T15:57:13Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-29T15:57:13Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-29T15:57:13Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-29T15:57:13Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-29T15:57:13Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-29T15:57:13Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-29T15:57:13Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-29T15:57:13Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-29T15:57:13Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-29T15:57:13Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-29T15:57:13Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-29T15:57:13Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-29T15:57:13Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-29T15:57:13Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-29T15:57:13Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-29T15:57:13Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:95"
2025-01-29T15:57:13Z	INFO	Number of language-specific files	num=0
2025-01-29T15:57:13Z	INFO	Detected config files	num=2
trivy_exitcode=0

github-actions[bot]
github-actions bot requested changes Jan 29, 2025
View reviewed changes
Copy link
Contributor

@github-actions github-actions bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Warning - Large Number of Resources to be Destroyed.

core-vpc-test
Plan: 144 to add, 0 to change, 144 to destroy.
Please review the plan and confirm the changes are expected.

@github-actions GitHub Actions
Copy link
Contributor

Terraform Plan Summary

core-vpc-test
Plan: 144 to add, 0 to change, 144 to destroy.

github-actions[bot]
github-actions bot requested changes Jan 29, 2025
View reviewed changes
Copy link
Contributor

@github-actions github-actions bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Warning - Large Number of Resources to be Destroyed.

core-vpc-preproduction
Plan: 144 to add, 0 to change, 144 to destroy.
Please review the plan and confirm the changes are expected.

@github-actions GitHub Actions
Copy link
Contributor

Terraform Plan Summary

core-vpc-preproduction
Plan: 144 to add, 0 to change, 144 to destroy.

github-actions[bot]
github-actions bot requested changes Jan 29, 2025
View reviewed changes
Copy link
Contributor

@github-actions github-actions bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Warning - Large Number of Resources to be Destroyed.

core-vpc-production
Plan: 144 to add, 0 to change, 144 to destroy.
Please review the plan and confirm the changes are expected.

@github-actions GitHub Actions
Copy link
Contributor

Terraform Plan Summary

core-vpc-production
Plan: 144 to add, 0 to change, 144 to destroy.

github-actions[bot]
github-actions bot requested changes Jan 29, 2025
View reviewed changes
Copy link
Contributor

@github-actions github-actions bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Warning - Large Number of Resources to be Destroyed.

core-vpc-development
Plan: 144 to add, 0 to change, 144 to destroy.
Please review the plan and confirm the changes are expected.

@github-actions GitHub Actions
Copy link
Contributor

Terraform Plan Summary

core-vpc-development
Plan: 144 to add, 0 to change, 144 to destroy.

@github-actions GitHub Actions
Copy link
Contributor

Trivy Scan Success

Show Output ```hcl

Trivy will check the following folders:
terraform/environments/core-vpc
terraform/modules/ram-resource-share
terraform/modules/vpc-nacls

Running Trivy in terraform/environments/core-vpc
2025-01-29T15:58:35Z INFO [vulndb] Need to update DB
2025-01-29T15:58:35Z INFO [vulndb] Downloading vulnerability DB...
2025-01-29T15:58:35Z INFO [vulndb] Downloading artifact... repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-29T15:58:37Z INFO [vulndb] Artifact successfully downloaded repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-29T15:58:37Z INFO [vuln] Vulnerability scanning is enabled
2025-01-29T15:58:37Z INFO [misconfig] Misconfiguration scanning is enabled
2025-01-29T15:58:37Z INFO [misconfig] Need to update the built-in checks
2025-01-29T15:58:37Z INFO [misconfig] Downloading the built-in checks...
164.50 KiB / 164.50 KiB [---------------------------------------------------------] 100.00% ? p/s 0s2025-01-29T15:58:37Z INFO [secret] Secret scanning is enabled
2025-01-29T15:58:37Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-29T15:58:37Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-29T15:58:38Z INFO [terraform scanner] Scanning root module file_path="."
2025-01-29T15:58:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_iam_role.member-delegation" value="cty.NilVal"
2025-01-29T15:58:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_iam_role_policy.member-delegation" value="cty.NilVal"
2025-01-29T15:58:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_route.transit_gateway" value="cty.NilVal"
2025-01-29T15:58:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.dns-zone" value="cty.NilVal"
2025-01-29T15:58:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.dns_zone_extend" value="cty.NilVal"
2025-01-29T15:58:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.dns_zone_extend_private" value="cty.NilVal"
2025-01-29T15:58:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.r53_dns_firewall" value="cty.NilVal"
2025-01-29T15:58:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.resource-share" value="cty.NilVal"
2025-01-29T15:58:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.vpc" value="cty.NilVal"
2025-01-29T15:58:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.vpc_attachment" value="cty.NilVal"
2025-01-29T15:58:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.vpc_nacls" value="cty.NilVal"
2025-01-29T15:58:39Z INFO [terraform executor] Ignore finding rule="aws-sns-enable-topic-encryption" range="monitoring.tf:9-15"
2025-01-29T15:58:39Z INFO Number of language-specific files num=0
2025-01-29T15:58:39Z INFO Detected config files num=2
trivy_exitcode=0

Running Trivy in terraform/modules/ram-resource-share
2025-01-29T15:58:39Z INFO [vuln] Vulnerability scanning is enabled
2025-01-29T15:58:39Z INFO [misconfig] Misconfiguration scanning is enabled
2025-01-29T15:58:39Z INFO [secret] Secret scanning is enabled
2025-01-29T15:58:39Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-29T15:58:39Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-29T15:58:40Z INFO [terraform scanner] Scanning root module file_path="."
2025-01-29T15:58:40Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="resource_arns, tags_common, tags_prefix"
2025-01-29T15:58:40Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ram_resource_association.default" value="cty.NilVal"
2025-01-29T15:58:40Z INFO Number of language-specific files num=0
2025-01-29T15:58:40Z INFO Detected config files num=1
trivy_exitcode=0

Running Trivy in terraform/modules/vpc-nacls
2025-01-29T15:58:40Z INFO [vuln] Vulnerability scanning is enabled
2025-01-29T15:58:40Z INFO [misconfig] Misconfiguration scanning is enabled
2025-01-29T15:58:40Z INFO [secret] Secret scanning is enabled
2025-01-29T15:58:40Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-29T15:58:40Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-29T15:58:41Z INFO [terraform scanner] Scanning root module file_path="."
2025-01-29T15:58:41Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="data_subnet_ids, private_subnet_ids, protected_subnet_ids, public_subnet_ids, tags_prefix, vpc_cidr, vpc_id, vpc_name"
2025-01-29T15:58:42Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-29T15:58:42Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-29T15:58:42Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-29T15:58:42Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-29T15:58:42Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-29T15:58:42Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-29T15:58:42Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-29T15:58:42Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-29T15:58:42Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-29T15:58:42Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-29T15:58:42Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-29T15:58:42Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-29T15:58:42Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-29T15:58:42Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-29T15:58:42Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-29T15:58:42Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-29T15:58:42Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-29T15:58:42Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-29T15:58:42Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-29T15:58:42Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-29T15:58:42Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-29T15:58:42Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-29T15:58:42Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-29T15:58:42Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-29T15:58:42Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-29T15:58:42Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-29T15:58:42Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-29T15:58:42Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-29T15:58:42Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-29T15:58:42Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-29T15:58:42Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:95"
2025-01-29T15:58:42Z INFO Number of language-specific files num=0
2025-01-29T15:58:42Z INFO Detected config files num=2
trivy_exitcode=0

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/core-vpc
terraform/modules/ram-resource-share
terraform/modules/vpc-nacls

*****************************

Running Checkov in terraform/environments/core-vpc
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2025-01-29 15:58:44,972 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-pagerduty-integration?ref=0179859e6fafc567843cd55c0b05d325d5012dc4:None (for external modules, the --download-external-modules flag is required)
2025-01-29 15:58:44,972 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/terraform-aws-observability-platform-tenant?ref=fbbe5c8282786bcc0a00c969fe598e14f12eea9b:None (for external modules, the --download-external-modules flag is required)
2025-01-29 15:58:44,972 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-member-vpc?ref=bug/8874-tgw-circular-dependency:None (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 128, Failed checks: 2, Skipped checks: 27

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: vpc
	File: /vpc.tf:92-105
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		92  | module "vpc" {
		93  |   for_each             = local.vpcs[terraform.workspace]
		94  |   source               = "github.com/ministryofjustice/modernisation-platform-terraform-member-vpc?ref=bug/8874-tgw-circular-dependency"
		95  |   additional_endpoints = each.value.options.additional_endpoints
		96  |   subnet_sets          = { for key, subnet in each.value.cidr.subnet_sets : key => subnet.cidr }
		97  | 
		98  |   # VPC Flow Logs
		99  |   vpc_flow_log_iam_role       = aws_iam_role.vpc_flow_log.arn
		100 |   flow_log_s3_destination_arn = local.is-production ? local.core_logging_bucket_arns["vpc-flow-logs"] : ""
		101 | 
		102 |   # Tags
		103 |   tags_common = local.tags
		104 |   tags_prefix = each.key
		105 | }

Check: CKV_TF_2: "Ensure Terraform module sources use a tag with a version number"
	FAILED for resource: vpc
	File: /vpc.tf:92-105
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-tag

		92  | module "vpc" {
		93  |   for_each             = local.vpcs[terraform.workspace]
		94  |   source               = "github.com/ministryofjustice/modernisation-platform-terraform-member-vpc?ref=bug/8874-tgw-circular-dependency"
		95  |   additional_endpoints = each.value.options.additional_endpoints
		96  |   subnet_sets          = { for key, subnet in each.value.cidr.subnet_sets : key => subnet.cidr }
		97  | 
		98  |   # VPC Flow Logs
		99  |   vpc_flow_log_iam_role       = aws_iam_role.vpc_flow_log.arn
		100 |   flow_log_s3_destination_arn = local.is-production ? local.core_logging_bucket_arns["vpc-flow-logs"] : ""
		101 | 
		102 |   # Tags
		103 |   tags_common = local.tags
		104 |   tags_prefix = each.key
		105 | }


checkov_exitcode=1

*****************************

Running Checkov in terraform/modules/ram-resource-share
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39

checkov_exitcode=1

*****************************

Running Checkov in terraform/modules/vpc-nacls
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
terraform scan results:

Passed checks: 76, Failed checks: 0, Skipped checks: 20


checkov_exitcode=1

CTFLint Scan Success

Show Output 
*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
terraform/environments/core-vpc
terraform/modules/ram-resource-share
terraform/modules/vpc-nacls

*****************************

Running tflint in terraform/environments/core-vpc
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=0

*****************************

Running tflint in terraform/modules/ram-resource-share
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=0

*****************************

Running tflint in terraform/modules/vpc-nacls
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=0

Trivy Scan Success

Show Output 
*****************************

Trivy will check the following folders:
terraform/environments/core-vpc
terraform/modules/ram-resource-share
terraform/modules/vpc-nacls

*****************************

Running Trivy in terraform/environments/core-vpc
2025-01-29T15:58:35Z	INFO	[vulndb] Need to update DB
2025-01-29T15:58:35Z	INFO	[vulndb] Downloading vulnerability DB...
2025-01-29T15:58:35Z	INFO	[vulndb] Downloading artifact...	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-29T15:58:37Z	INFO	[vulndb] Artifact successfully downloaded	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-29T15:58:37Z	INFO	[vuln] Vulnerability scanning is enabled
2025-01-29T15:58:37Z	INFO	[misconfig] Misconfiguration scanning is enabled
2025-01-29T15:58:37Z	INFO	[misconfig] Need to update the built-in checks
2025-01-29T15:58:37Z	INFO	[misconfig] Downloading the built-in checks...
164.50 KiB / 164.50 KiB [---------------------------------------------------------] 100.00% ? p/s 0s2025-01-29T15:58:37Z	INFO	[secret] Secret scanning is enabled
2025-01-29T15:58:37Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-29T15:58:37Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-29T15:58:38Z	INFO	[terraform scanner] Scanning root module	file_path="."
2025-01-29T15:58:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_iam_role.member-delegation" value="cty.NilVal"
2025-01-29T15:58:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_iam_role_policy.member-delegation" value="cty.NilVal"
2025-01-29T15:58:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_route.transit_gateway" value="cty.NilVal"
2025-01-29T15:58:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.dns-zone" value="cty.NilVal"
2025-01-29T15:58:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.dns_zone_extend" value="cty.NilVal"
2025-01-29T15:58:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.dns_zone_extend_private" value="cty.NilVal"
2025-01-29T15:58:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.r53_dns_firewall" value="cty.NilVal"
2025-01-29T15:58:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.resource-share" value="cty.NilVal"
2025-01-29T15:58:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.vpc" value="cty.NilVal"
2025-01-29T15:58:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.vpc_attachment" value="cty.NilVal"
2025-01-29T15:58:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.vpc_nacls" value="cty.NilVal"
2025-01-29T15:58:39Z	INFO	[terraform executor] Ignore finding	rule="aws-sns-enable-topic-encryption" range="monitoring.tf:9-15"
2025-01-29T15:58:39Z	INFO	Number of language-specific files	num=0
2025-01-29T15:58:39Z	INFO	Detected config files	num=2
trivy_exitcode=0

*****************************

Running Trivy in terraform/modules/ram-resource-share
2025-01-29T15:58:39Z	INFO	[vuln] Vulnerability scanning is enabled
2025-01-29T15:58:39Z	INFO	[misconfig] Misconfiguration scanning is enabled
2025-01-29T15:58:39Z	INFO	[secret] Secret scanning is enabled
2025-01-29T15:58:39Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-29T15:58:39Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-29T15:58:40Z	INFO	[terraform scanner] Scanning root module	file_path="."
2025-01-29T15:58:40Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="resource_arns, tags_common, tags_prefix"
2025-01-29T15:58:40Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ram_resource_association.default" value="cty.NilVal"
2025-01-29T15:58:40Z	INFO	Number of language-specific files	num=0
2025-01-29T15:58:40Z	INFO	Detected config files	num=1
trivy_exitcode=0

*****************************

Running Trivy in terraform/modules/vpc-nacls
2025-01-29T15:58:40Z	INFO	[vuln] Vulnerability scanning is enabled
2025-01-29T15:58:40Z	INFO	[misconfig] Misconfiguration scanning is enabled
2025-01-29T15:58:40Z	INFO	[secret] Secret scanning is enabled
2025-01-29T15:58:40Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-29T15:58:40Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-29T15:58:41Z	INFO	[terraform scanner] Scanning root module	file_path="."
2025-01-29T15:58:41Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="data_subnet_ids, private_subnet_ids, protected_subnet_ids, public_subnet_ids, tags_prefix, vpc_cidr, vpc_id, vpc_name"
2025-01-29T15:58:42Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-29T15:58:42Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-29T15:58:42Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-29T15:58:42Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-29T15:58:42Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-29T15:58:42Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-29T15:58:42Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-29T15:58:42Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-29T15:58:42Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-29T15:58:42Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-29T15:58:42Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-29T15:58:42Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-29T15:58:42Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-29T15:58:42Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-29T15:58:42Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-29T15:58:42Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-29T15:58:42Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-29T15:58:42Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-29T15:58:42Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-29T15:58:42Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-29T15:58:42Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-29T15:58:42Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-29T15:58:42Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-29T15:58:42Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-29T15:58:42Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-29T15:58:42Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-29T15:58:42Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-29T15:58:42Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-29T15:58:42Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-29T15:58:42Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-29T15:58:42Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:95"
2025-01-29T15:58:42Z	INFO	Number of language-specific files	num=0
2025-01-29T15:58:42Z	INFO	Detected config files	num=2
trivy_exitcode=0

@github-actions GitHub Actions
Copy link
Contributor

Please check the plan carefully before deploying these changes.

⚠️ Making changes to the environments-networks/*.json files will affect the networking of MP AWS accounts, in particular which VPC/Subnet is being shared in to which environment. For more guidance consult the documentation.

github-actions[bot]
github-actions bot requested changes Jan 30, 2025
View reviewed changes
Copy link
Contributor

@github-actions github-actions bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Warning - Large Number of Resources to be Destroyed.

core-vpc-production
Plan: 153 to add, 0 to change, 162 to destroy.
Please review the plan and confirm the changes are expected.

@github-actions GitHub Actions
Copy link
Contributor

Terraform Plan Summary

core-vpc-production
Plan: 153 to add, 0 to change, 162 to destroy.

github-actions[bot]
github-actions bot requested changes Jan 30, 2025
View reviewed changes
Copy link
Contributor

@github-actions github-actions bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Warning - Large Number of Resources to be Destroyed.

core-vpc-preproduction
Plan: 153 to add, 0 to change, 162 to destroy.
Please review the plan and confirm the changes are expected.

@github-actions GitHub Actions
Copy link
Contributor

Terraform Plan Summary

core-vpc-preproduction
Plan: 153 to add, 0 to change, 162 to destroy.

github-actions[bot]
github-actions bot requested changes Jan 30, 2025
View reviewed changes
Copy link
Contributor

@github-actions github-actions bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Warning - Large Number of Resources to be Destroyed.

core-vpc-test
Plan: 153 to add, 0 to change, 162 to destroy.
Please review the plan and confirm the changes are expected.

@github-actions GitHub Actions
Copy link
Contributor

Terraform Plan Summary

core-vpc-test
Plan: 153 to add, 0 to change, 162 to destroy.

github-actions[bot]
github-actions bot requested changes Jan 30, 2025
View reviewed changes
Copy link
Contributor

@github-actions github-actions bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Warning - Large Number of Resources to be Destroyed.

core-vpc-development
Plan: 153 to add, 0 to change, 162 to destroy.
Please review the plan and confirm the changes are expected.

@github-actions GitHub Actions
Copy link
Contributor

Terraform Plan Summary

core-vpc-development
Plan: 153 to add, 0 to change, 162 to destroy.

@github-actions GitHub Actions
Copy link
Contributor

Trivy Scan Success

Show Output ```hcl

Trivy will check the following folders:
terraform/environments/core-vpc
terraform/modules/ram-resource-share
terraform/modules/vpc-nacls

Running Trivy in terraform/environments/core-vpc
2025-01-30T12:32:30Z INFO [vulndb] Need to update DB
2025-01-30T12:32:30Z INFO [vulndb] Downloading vulnerability DB...
2025-01-30T12:32:30Z INFO [vulndb] Downloading artifact... repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-30T12:32:32Z INFO [vulndb] Artifact successfully downloaded repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-30T12:32:32Z INFO [vuln] Vulnerability scanning is enabled
2025-01-30T12:32:32Z INFO [misconfig] Misconfiguration scanning is enabled
2025-01-30T12:32:32Z INFO [misconfig] Need to update the built-in checks
2025-01-30T12:32:32Z INFO [misconfig] Downloading the built-in checks...
162.46 KiB / 162.46 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2025-01-30T12:32:33Z INFO [secret] Secret scanning is enabled
2025-01-30T12:32:33Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-30T12:32:33Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-30T12:32:34Z INFO [terraform scanner] Scanning root module file_path="."
2025-01-30T12:32:34Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_iam_role.member-delegation" value="cty.NilVal"
2025-01-30T12:32:34Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_iam_role_policy.member-delegation" value="cty.NilVal"
2025-01-30T12:32:34Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_route.transit_gateway" value="cty.NilVal"
2025-01-30T12:32:34Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.dns-zone" value="cty.NilVal"
2025-01-30T12:32:34Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.dns_zone_extend" value="cty.NilVal"
2025-01-30T12:32:34Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.dns_zone_extend_private" value="cty.NilVal"
2025-01-30T12:32:34Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.r53_dns_firewall" value="cty.NilVal"
2025-01-30T12:32:34Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.resource-share" value="cty.NilVal"
2025-01-30T12:32:34Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.vpc" value="cty.NilVal"
2025-01-30T12:32:34Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.vpc_attachment" value="cty.NilVal"
2025-01-30T12:32:34Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.vpc_nacls" value="cty.NilVal"
2025-01-30T12:32:35Z INFO [terraform executor] Ignore finding rule="aws-sns-enable-topic-encryption" range="monitoring.tf:9-15"
2025-01-30T12:32:35Z INFO Number of language-specific files num=0
2025-01-30T12:32:35Z INFO Detected config files num=2
trivy_exitcode=0

Running Trivy in terraform/modules/ram-resource-share
2025-01-30T12:32:35Z INFO [vuln] Vulnerability scanning is enabled
2025-01-30T12:32:35Z INFO [misconfig] Misconfiguration scanning is enabled
2025-01-30T12:32:35Z INFO [secret] Secret scanning is enabled
2025-01-30T12:32:35Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-30T12:32:35Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-30T12:32:36Z INFO [terraform scanner] Scanning root module file_path="."
2025-01-30T12:32:36Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="resource_arns, tags_common, tags_prefix"
2025-01-30T12:32:36Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ram_resource_association.default" value="cty.NilVal"
2025-01-30T12:32:36Z INFO Number of language-specific files num=0
2025-01-30T12:32:36Z INFO Detected config files num=1
trivy_exitcode=0

Running Trivy in terraform/modules/vpc-nacls
2025-01-30T12:32:36Z INFO [vuln] Vulnerability scanning is enabled
2025-01-30T12:32:36Z INFO [misconfig] Misconfiguration scanning is enabled
2025-01-30T12:32:36Z INFO [secret] Secret scanning is enabled
2025-01-30T12:32:36Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-30T12:32:36Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-30T12:32:37Z INFO [terraform scanner] Scanning root module file_path="."
2025-01-30T12:32:37Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="data_subnet_ids, private_subnet_ids, protected_subnet_ids, public_subnet_ids, tags_prefix, vpc_cidr, vpc_id, vpc_name"
2025-01-30T12:32:38Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-30T12:32:38Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-30T12:32:38Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-30T12:32:38Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-30T12:32:38Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-30T12:32:38Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-30T12:32:38Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-30T12:32:38Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-30T12:32:38Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-30T12:32:38Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-30T12:32:38Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-30T12:32:38Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-30T12:32:38Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-30T12:32:38Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-30T12:32:38Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-30T12:32:38Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-30T12:32:38Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-30T12:32:38Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-30T12:32:38Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-30T12:32:38Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-30T12:32:38Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-30T12:32:38Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-30T12:32:38Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-30T12:32:38Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-30T12:32:38Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-30T12:32:38Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-30T12:32:38Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-30T12:32:38Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-30T12:32:38Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-30T12:32:38Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-30T12:32:38Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-excessive-port-access" range="main.tf:95"
2025-01-30T12:32:38Z INFO Number of language-specific files num=0
2025-01-30T12:32:38Z INFO Detected config files num=2
trivy_exitcode=0

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/core-vpc
terraform/modules/ram-resource-share
terraform/modules/vpc-nacls

*****************************

Running Checkov in terraform/environments/core-vpc
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2025-01-30 12:32:41,241 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-pagerduty-integration?ref=0179859e6fafc567843cd55c0b05d325d5012dc4:None (for external modules, the --download-external-modules flag is required)
2025-01-30 12:32:41,241 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/terraform-aws-observability-platform-tenant?ref=fbbe5c8282786bcc0a00c969fe598e14f12eea9b:None (for external modules, the --download-external-modules flag is required)
2025-01-30 12:32:41,241 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-member-vpc?ref=bug/8874-tgw-circular-dependency:None (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 128, Failed checks: 2, Skipped checks: 27

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: vpc
	File: /vpc.tf:92-105
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		92  | module "vpc" {
		93  |   for_each             = local.vpcs[terraform.workspace]
		94  |   source               = "github.com/ministryofjustice/modernisation-platform-terraform-member-vpc?ref=bug/8874-tgw-circular-dependency"
		95  |   additional_endpoints = each.value.options.additional_endpoints
		96  |   subnet_sets          = { for key, subnet in each.value.cidr.subnet_sets : key => subnet.cidr }
		97  | 
		98  |   # VPC Flow Logs
		99  |   vpc_flow_log_iam_role       = aws_iam_role.vpc_flow_log.arn
		100 |   flow_log_s3_destination_arn = local.is-production ? local.core_logging_bucket_arns["vpc-flow-logs"] : ""
		101 | 
		102 |   # Tags
		103 |   tags_common = local.tags
		104 |   tags_prefix = each.key
		105 | }

Check: CKV_TF_2: "Ensure Terraform module sources use a tag with a version number"
	FAILED for resource: vpc
	File: /vpc.tf:92-105
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-tag

		92  | module "vpc" {
		93  |   for_each             = local.vpcs[terraform.workspace]
		94  |   source               = "github.com/ministryofjustice/modernisation-platform-terraform-member-vpc?ref=bug/8874-tgw-circular-dependency"
		95  |   additional_endpoints = each.value.options.additional_endpoints
		96  |   subnet_sets          = { for key, subnet in each.value.cidr.subnet_sets : key => subnet.cidr }
		97  | 
		98  |   # VPC Flow Logs
		99  |   vpc_flow_log_iam_role       = aws_iam_role.vpc_flow_log.arn
		100 |   flow_log_s3_destination_arn = local.is-production ? local.core_logging_bucket_arns["vpc-flow-logs"] : ""
		101 | 
		102 |   # Tags
		103 |   tags_common = local.tags
		104 |   tags_prefix = each.key
		105 | }


checkov_exitcode=1

*****************************

Running Checkov in terraform/modules/ram-resource-share
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39

checkov_exitcode=1

*****************************

Running Checkov in terraform/modules/vpc-nacls
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
terraform scan results:

Passed checks: 76, Failed checks: 0, Skipped checks: 20


checkov_exitcode=1

CTFLint Scan Success

Show Output 
*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
terraform/environments/core-vpc
terraform/modules/ram-resource-share
terraform/modules/vpc-nacls

*****************************

Running tflint in terraform/environments/core-vpc
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=0

*****************************

Running tflint in terraform/modules/ram-resource-share
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=0

*****************************

Running tflint in terraform/modules/vpc-nacls
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=0

Trivy Scan Success

Show Output 
*****************************

Trivy will check the following folders:
terraform/environments/core-vpc
terraform/modules/ram-resource-share
terraform/modules/vpc-nacls

*****************************

Running Trivy in terraform/environments/core-vpc
2025-01-30T12:32:30Z	INFO	[vulndb] Need to update DB
2025-01-30T12:32:30Z	INFO	[vulndb] Downloading vulnerability DB...
2025-01-30T12:32:30Z	INFO	[vulndb] Downloading artifact...	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-30T12:32:32Z	INFO	[vulndb] Artifact successfully downloaded	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-30T12:32:32Z	INFO	[vuln] Vulnerability scanning is enabled
2025-01-30T12:32:32Z	INFO	[misconfig] Misconfiguration scanning is enabled
2025-01-30T12:32:32Z	INFO	[misconfig] Need to update the built-in checks
2025-01-30T12:32:32Z	INFO	[misconfig] Downloading the built-in checks...
162.46 KiB / 162.46 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2025-01-30T12:32:33Z	INFO	[secret] Secret scanning is enabled
2025-01-30T12:32:33Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-30T12:32:33Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-30T12:32:34Z	INFO	[terraform scanner] Scanning root module	file_path="."
2025-01-30T12:32:34Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_iam_role.member-delegation" value="cty.NilVal"
2025-01-30T12:32:34Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_iam_role_policy.member-delegation" value="cty.NilVal"
2025-01-30T12:32:34Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_route.transit_gateway" value="cty.NilVal"
2025-01-30T12:32:34Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.dns-zone" value="cty.NilVal"
2025-01-30T12:32:34Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.dns_zone_extend" value="cty.NilVal"
2025-01-30T12:32:34Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.dns_zone_extend_private" value="cty.NilVal"
2025-01-30T12:32:34Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.r53_dns_firewall" value="cty.NilVal"
2025-01-30T12:32:34Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.resource-share" value="cty.NilVal"
2025-01-30T12:32:34Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.vpc" value="cty.NilVal"
2025-01-30T12:32:34Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.vpc_attachment" value="cty.NilVal"
2025-01-30T12:32:34Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.vpc_nacls" value="cty.NilVal"
2025-01-30T12:32:35Z	INFO	[terraform executor] Ignore finding	rule="aws-sns-enable-topic-encryption" range="monitoring.tf:9-15"
2025-01-30T12:32:35Z	INFO	Number of language-specific files	num=0
2025-01-30T12:32:35Z	INFO	Detected config files	num=2
trivy_exitcode=0

*****************************

Running Trivy in terraform/modules/ram-resource-share
2025-01-30T12:32:35Z	INFO	[vuln] Vulnerability scanning is enabled
2025-01-30T12:32:35Z	INFO	[misconfig] Misconfiguration scanning is enabled
2025-01-30T12:32:35Z	INFO	[secret] Secret scanning is enabled
2025-01-30T12:32:35Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-30T12:32:35Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-30T12:32:36Z	INFO	[terraform scanner] Scanning root module	file_path="."
2025-01-30T12:32:36Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="resource_arns, tags_common, tags_prefix"
2025-01-30T12:32:36Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ram_resource_association.default" value="cty.NilVal"
2025-01-30T12:32:36Z	INFO	Number of language-specific files	num=0
2025-01-30T12:32:36Z	INFO	Detected config files	num=1
trivy_exitcode=0

*****************************

Running Trivy in terraform/modules/vpc-nacls
2025-01-30T12:32:36Z	INFO	[vuln] Vulnerability scanning is enabled
2025-01-30T12:32:36Z	INFO	[misconfig] Misconfiguration scanning is enabled
2025-01-30T12:32:36Z	INFO	[secret] Secret scanning is enabled
2025-01-30T12:32:36Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-30T12:32:36Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-30T12:32:37Z	INFO	[terraform scanner] Scanning root module	file_path="."
2025-01-30T12:32:37Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="data_subnet_ids, private_subnet_ids, protected_subnet_ids, public_subnet_ids, tags_prefix, vpc_cidr, vpc_id, vpc_name"
2025-01-30T12:32:38Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-30T12:32:38Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-30T12:32:38Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-30T12:32:38Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-30T12:32:38Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-30T12:32:38Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-30T12:32:38Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-30T12:32:38Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-30T12:32:38Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-30T12:32:38Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:51"
2025-01-30T12:32:38Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-30T12:32:38Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-30T12:32:38Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-30T12:32:38Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-30T12:32:38Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-30T12:32:38Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-30T12:32:38Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-30T12:32:38Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-30T12:32:38Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-30T12:32:38Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:66"
2025-01-30T12:32:38Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-30T12:32:38Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-30T12:32:38Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-30T12:32:38Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-30T12:32:38Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-30T12:32:38Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-30T12:32:38Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-30T12:32:38Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-30T12:32:38Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-30T12:32:38Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:81"
2025-01-30T12:32:38Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-excessive-port-access" range="main.tf:95"
2025-01-30T12:32:38Z	INFO	Number of language-specific files	num=0
2025-01-30T12:32:38Z	INFO	Detected config files	num=2
trivy_exitcode=0

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@github-actions github-actions[bot] github-actions[bot] requested changes

Requested changes must be addressed to merge this pull request.

Assignees
No one assigned
Labels
core networking onboarding Tasks to onboard teams testing
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@richgreen-moj