TM: hmpps-domain-services: fix deleted roles

[drobinson-moj]

Lambda code has been deleted but secret sharing still exists - code now fails

[github-actions]

Trivy Scan Success

Show Output

```hcl

---

Trivy will check the following folders:
terraform/environments/hmpps-domain-services

---

Running Trivy in terraform/environments/hmpps-domain-services
2024-11-25T12:30:34Z INFO [vulndb] Need to update DB
2024-11-25T12:30:34Z INFO [vulndb] Downloading vulnerability DB...
2024-11-25T12:30:34Z INFO [vulndb] Downloading artifact... repo="public.ecr.aws/aquasecurity/trivy-db:2"
2024-11-25T12:30:36Z INFO [vulndb] Artifact successfully downloaded repo="public.ecr.aws/aquasecurity/trivy-db:2"
2024-11-25T12:30:36Z INFO [vuln] Vulnerability scanning is enabled
2024-11-25T12:30:36Z INFO [misconfig] Misconfiguration scanning is enabled
2024-11-25T12:30:36Z INFO [misconfig] Need to update the built-in checks
2024-11-25T12:30:36Z INFO [misconfig] Downloading the built-in checks...
2024-11-25T12:30:36Z ERROR [misconfig] Falling back to embedded checks err="failed to download built-in policies: download error: oci download error: failed to fetch the layer: GET https://ghcr.io/v2/aquasecurity/trivy-checks/blobs/sha256:16442a4593a0395452e678ef699a880eec94d9211dfc887d52574beb78b95030: TOOMANYREQUESTS: retry-after: 439.822µs, allowed: 44000/minute"
2024-11-25T12:30:36Z INFO [secret] Secret scanning is enabled
2024-11-25T12:30:36Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-11-25T12:30:36Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2024-11-25T12:30:37Z INFO [terraform scanner] Scanning root module file_path="."
2024-11-25T12:30:37Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="networking"
2024-11-25T12:30:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.aws_backup_plan.this" value="cty.NilVal"
2024-11-25T12:30:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.aws_backup_selection.this" value="cty.NilVal"
2024-11-25T12:30:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.aws_cloudwatch_log_group.route53" value="cty.NilVal"
2024-11-25T12:30:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.aws_cloudwatch_log_group.this" value="cty.NilVal"
2024-11-25T12:30:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.aws_cloudwatch_log_metric_filter.this" value="cty.NilVal"
2024-11-25T12:30:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.aws_cloudwatch_metric_alarm.this" value="cty.NilVal"
2024-11-25T12:30:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.aws_iam_policy.this" value="cty.NilVal"
2024-11-25T12:30:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.aws_iam_role.this" value="cty.NilVal"
2024-11-25T12:30:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.aws_iam_role_policy_attachment.this" value="cty.NilVal"
2024-11-25T12:30:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.aws_iam_service_linked_role.this" value="cty.NilVal"
2024-11-25T12:30:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.aws_key_pair.this" value="cty.NilVal"
2024-11-25T12:30:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.aws_kms_grant.this" value="cty.NilVal"
2024-11-25T12:30:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.aws_lb_target_group.instance" value="cty.NilVal"
2024-11-25T12:30:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.aws_lb_target_group_attachment.instance" value="cty.NilVal"
2024-11-25T12:30:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.aws_oam_link.this" value="cty.NilVal"
2024-11-25T12:30:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.aws_oam_sink.this" value="cty.NilVal"
2024-11-25T12:30:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.aws_oam_sink_policy.monitoring_account_oam_sink_policy" value="cty.NilVal"
2024-11-25T12:30:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.aws_route53_query_log.this" value="cty.NilVal"
2024-11-25T12:30:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.aws_route53_record.core_network_services" value="cty.NilVal"
2024-11-25T12:30:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.aws_route53_record.core_vpc" value="cty.NilVal"
2024-11-25T12:30:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.aws_route53_record.self" value="cty.NilVal"
2024-11-25T12:30:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.aws_route53_resolver_endpoint.this" value="cty.NilVal"
2024-11-25T12:30:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.aws_route53_resolver_rule.this" value="cty.NilVal"
2024-11-25T12:30:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.aws_route53_resolver_rule_association.this" value="cty.NilVal"
2024-11-25T12:30:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.aws_route53_zone.this" value="cty.NilVal"
2024-11-25T12:30:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.aws_secretsmanager_secret.this" value="cty.NilVal"
2024-11-25T12:30:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.aws_secretsmanager_secret_version.fixed" value="cty.NilVal"
2024-11-25T12:30:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.aws_security_group.this" value="cty.NilVal"
2024-11-25T12:30:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.aws_security_group_rule.route53_resolver" value="cty.NilVal"
2024-11-25T12:30:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.aws_security_group_rule.this" value="cty.NilVal"
2024-11-25T12:30:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.aws_sns_topic.this" value="cty.NilVal"
2024-11-25T12:30:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.aws_sns_topic_subscription.this" value="cty.NilVal"
2024-11-25T12:30:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.aws_ssm_association.this" value="cty.NilVal"
2024-11-25T12:30:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.aws_ssm_document.this" value="cty.NilVal"
2024-11-25T12:30:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.aws_ssm_parameter.fixed" value="cty.NilVal"
2024-11-25T12:30:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.aws_ssm_parameter.placeholder" value="cty.NilVal"
2024-11-25T12:30:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.data.aws_iam_policy_document.assume_role" value="cty.NilVal"
2024-11-25T12:30:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.data.aws_iam_policy_document.secretsmanager_secret_policy" value="cty.NilVal"
2024-11-25T12:30:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.data.aws_iam_policy_document.this" value="cty.NilVal"
2024-11-25T12:30:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.module.acm_certificate" value="cty.NilVal"
2024-11-25T12:30:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.module.cloudwatch_dashboard" value="cty.NilVal"
2024-11-25T12:30:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.module.ec2_autoscaling_group" value="cty.NilVal"
2024-11-25T12:30:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.module.ec2_instance" value="cty.NilVal"
2024-11-25T12:30:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.module.efs" value="cty.NilVal"
2024-11-25T12:30:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.module.fsx_windows" value="cty.NilVal"
2024-11-25T12:30:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.module.lb" value="cty.NilVal"
2024-11-25T12:30:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.module.lb_listener" value="cty.NilVal"
2024-11-25T12:30:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.module.s3_bucket" value="cty.NilVal"
2024-11-25T12:30:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.random_password.secrets" value="cty.NilVal"
2024-11-25T12:30:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.random_password.this" value="cty.NilVal"
2024-11-25T12:30:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.module.bastion_linux[0].aws_s3_object.user_public_keys" value="cty.NilVal"
2024-11-25T12:30:37Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.module.bastion_linux[0].data.aws_subnet.local_account" value="cty.NilVal"
2024-11-25T12:30:37Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.baseline.module.bastion_linux[0].aws_autoscaling_group.bastion_linux_daily" err="1 error occurred:\n\t* invalid for-each in aws_autoscaling_group.bastion_linux_daily.dynamic.tag block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T12:30:37Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.baseline.module.bastion_linux[0].aws_autoscaling_group.bastion_linux_daily" err="1 error occurred:\n\t* invalid for-each in aws_autoscaling_group.bastion_linux_daily.dynamic.tag block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T12:30:38Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.baseline.module.bastion_linux[0].module.s3-bucket.aws_s3_bucket_lifecycle_configuration.default" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_lifecycle_configuration.default.dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T12:30:38Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.baseline.module.bastion_linux[0].module.s3-bucket.aws_s3_bucket_lifecycle_configuration.default" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_lifecycle_configuration.default.dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T12:30:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.module.schedule_alarms_lambda[0].aws_cloudwatch_event_rule.alarm_scheduler" value="cty.NilVal"
2024-11-25T12:30:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.module.schedule_alarms_lambda[0].aws_cloudwatch_event_target.alarm_scheduler" value="cty.NilVal"
2024-11-25T12:30:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.module.schedule_alarms_lambda[0].aws_lambda_permission.allow_cloudwatch" value="cty.NilVal"
2024-11-25T12:30:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.environment.data.aws_route53_zone.core_network_services" value="cty.NilVal"
2024-11-25T12:30:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.environment.data.aws_route53_zone.core_vpc" value="cty.NilVal"
2024-11-25T12:30:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.environment.data.aws_subnet.this" value="cty.NilVal"
2024-11-25T12:30:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.environment.data.aws_subnets.this" value="cty.NilVal"
2024-11-25T12:30:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.module.bastion_linux[0].aws_s3_object.user_public_keys" value="cty.NilVal"
2024-11-25T12:30:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.module.bastion_linux[0].data.aws_subnet.local_account" value="cty.NilVal"
2024-11-25T12:30:38Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.baseline.module.bastion_linux[0].aws_autoscaling_group.bastion_linux_daily" err="1 error occurred:\n\t* invalid for-each in aws_autoscaling_group.bastion_linux_daily.dynamic.tag block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T12:30:38Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.baseline.module.bastion_linux[0].aws_autoscaling_group.bastion_linux_daily" err="1 error occurred:\n\t* invalid for-each in aws_autoscaling_group.bastion_linux_daily.dynamic.tag block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T12:30:38Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.baseline.module.bastion_linux[0].module.s3-bucket.aws_s3_bucket_lifecycle_configuration.default" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_lifecycle_configuration.default.dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T12:30:38Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.baseline.module.bastion_linux[0].module.s3-bucket.aws_s3_bucket_lifecycle_configuration.default" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_lifecycle_configuration.default.dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T12:30:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.module.schedule_alarms_lambda[0].aws_cloudwatch_event_rule.alarm_scheduler" value="cty.NilVal"
2024-11-25T12:30:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.module.schedule_alarms_lambda[0].aws_cloudwatch_event_target.alarm_scheduler" value="cty.NilVal"
2024-11-25T12:30:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.baseline.module.schedule_alarms_lambda[0].aws_lambda_permission.allow_cloudwatch" value="cty.NilVal"
2024-11-25T12:30:39Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=836db079348a2b40d59bd9cb953111e8ad61aec1/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=7b2b75c178f855d8c48d3bda4ac53df782288c02/main.tf:141-151"
2024-11-25T12:30:39Z INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v8.1.0/main.tf:150-160"
2024-11-25T12:30:39Z INFO Number of language-specific files num=0
2024-11-25T12:30:39Z INFO Detected config files num=4
trivy_exitcode=0

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/hmpps-domain-services

*****************************

Running Checkov in terraform/environments/hmpps-domain-services
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2024-11-25 12:30:42,186 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-ssm-patching.git?ref=v3.1.0:None (for external modules, the --download-external-modules flag is required)
2024-11-25 12:30:42,187 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-ssm-patching.git?ref=v3.0.0:None (for external modules, the --download-external-modules flag is required)
2024-11-25 12:30:45,818 [MainThread  ] [WARNI]  Failed updating attribute for key: secretsmanager_secrets./ec2/.ssh and value {'recovery_window_in_days': 7} forvertex attributes {'secretsmanager_secrets': {'/ec2/.ssh': {'recovery_window_in_days': 7, 'secrets': {'ec2-user': {'description': 'Private key for ec2-user key pair'}}}}, 'secretsmanager_secrets./ec2/.ssh': {'recovery_window_in_days': 7, 'secrets': {'ec2-user': {'description': 'Private key for ec2-user key pair'}}}, 'secretsmanager_secrets./ec2/.ssh.recovery_window_in_days': 7, 'secretsmanager_secrets./ec2/.ssh.secrets': {'ec2-user': {'description': 'Private key for ec2-user key pair'}}, 'secretsmanager_secrets./ec2/.ssh.secrets.ec2-user': {'description': 'Private key for ec2-user key pair'}, 'secretsmanager_secrets./ec2/.ssh.secrets.ec2-user.description': 'Private key for ec2-user key pair'}. Falling back to explicitly setting it.Exception - Parse error at 1:24 near token / (SORT_DIRECTION)
2024-11-25 12:30:46,327 [MainThread  ] [WARNI]  Failed updating attribute for key: ssm_parameters./oam and value {'parameters': '{for oam_link in coalesce(${merge({\'cloudwatch_dashboard_default_widget_groups\': [\'ec2\', \'ec2_windows\', \'lb\'], \'cloudwatch_metric_alarms_default_actions\': \'pagerduty\', \'cloudwatch_metric_oam_links\': \'hmpps-oem-${trimprefix(terraform.workspace,"${var.networking[0].application}-")}\', \'cloudwatch_metric_oam_links_ssm_parameters\': \'hmpps-oem-${trimprefix(terraform.workspace,"${var.networking[0].application}-")}\', \'enable_backup_plan_daily_and_weekly\': True, \'enable_business_unit_kms_cmks\': True, \'enable_ec2_cloud_watch_agent\': True, \'enable_ec2_self_provision\': True, \'enable_ec2_session_manager_cloudwatch_logs\': True, \'enable_ec2_ssm_agent_update\': True, \'enable_ec2_user_keypair\': True, \'enable_hmpps_domain\': True, \'enable_image_builder\': True, \'enable_s3_bucket\': True, \'s3_iam_policies\': \'EC2S3BucketWriteAndDeleteAccessPolicy\'},["${{\'development\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-development\'}}}}, \'preproduction\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-preproduction\'}}}}, \'production\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-production\'}}}}, \'test\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-test\'}}}}}["local.environment"]}"])},[]) : oam_link :> {\'description\': \'oam sink_identifier to use in aws_oam_link resource\'}}'} forvertex attributes {'ssm_parameters': {'/azure': {'parameters': {'sas_token': {'description': 'database backup storage account read-only sas token'}}}, '/oam': {'parameters': '{for oam_link in coalesce(${merge({\'cloudwatch_dashboard_default_widget_groups\': [\'ec2\', \'ec2_windows\', \'lb\'], \'cloudwatch_metric_alarms_default_actions\': \'pagerduty\', \'cloudwatch_metric_oam_links\': \'hmpps-oem-${trimprefix(terraform.workspace,"${var.networking[0].application}-")}\', \'cloudwatch_metric_oam_links_ssm_parameters\': \'hmpps-oem-${trimprefix(terraform.workspace,"${var.networking[0].application}-")}\', \'enable_backup_plan_daily_and_weekly\': True, \'enable_business_unit_kms_cmks\': True, \'enable_ec2_cloud_watch_agent\': True, \'enable_ec2_self_provision\': True, \'enable_ec2_session_manager_cloudwatch_logs\': True, \'enable_ec2_ssm_agent_update\': True, \'enable_ec2_user_keypair\': True, \'enable_hmpps_domain\': True, \'enable_image_builder\': True, \'enable_s3_bucket\': True, \'s3_iam_policies\': \'EC2S3BucketWriteAndDeleteAccessPolicy\'},["${{\'development\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-development\'}}}}, \'preproduction\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-preproduction\'}}}}, \'production\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-production\'}}}}, \'test\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-test\'}}}}}["local.environment"]}"])},[]) : oam_link :> {\'description\': \'oam sink_identifier to use in aws_oam_link resource\'}}'}, 'account': {'parameters': {'ids': {'description': 'Selected modernisation platform AWS account IDs managed by baseline module', 'value': '${jsonencode({for key , value in var.environment.account_ids : key => value if contains(local.account_names_for_account_ids_ssm_parameter,key)})}'}}, 'postfix': '_'}, 'cloud-watch-config': {'parameters': {'windows': {'description': 'cloud watch agent config for windows managed by baseline module', 'file': './templates/cloud_watch_windows.json', 'type': 'String'}}, 'postfix': '-'}}, 'ssm_parameters./azure': {'parameters': {'sas_token': {'description': 'database backup storage account read-only sas token'}}}, 'ssm_parameters./azure.parameters': {'sas_token': {'description': 'database backup storage account read-only sas token'}}, 'ssm_parameters./azure.parameters.sas_token': {'description': 'database backup storage account read-only sas token'}, 'ssm_parameters./azure.parameters.sas_token.description': 'database backup storage account read-only sas token', 'ssm_parameters./oam': {'parameters': '{for oam_link in coalesce(${merge({\'cloudwatch_dashboard_default_widget_groups\': [\'ec2\', \'ec2_windows\', \'lb\'], \'cloudwatch_metric_alarms_default_actions\': \'pagerduty\', \'cloudwatch_metric_oam_links\': \'hmpps-oem-${trimprefix(terraform.workspace,"${var.networking[0].application}-")}\', \'cloudwatch_metric_oam_links_ssm_parameters\': \'hmpps-oem-${trimprefix(terraform.workspace,"${var.networking[0].application}-")}\', \'enable_backup_plan_daily_and_weekly\': True, \'enable_business_unit_kms_cmks\': True, \'enable_ec2_cloud_watch_agent\': True, \'enable_ec2_self_provision\': True, \'enable_ec2_session_manager_cloudwatch_logs\': True, \'enable_ec2_ssm_agent_update\': True, \'enable_ec2_user_keypair\': True, \'enable_hmpps_domain\': True, \'enable_image_builder\': True, \'enable_s3_bucket\': True, \'s3_iam_policies\': \'EC2S3BucketWriteAndDeleteAccessPolicy\'},["${{\'development\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-development\'}}}}, \'preproduction\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-preproduction\'}}}}, \'production\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-production\'}}}}, \'test\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-test\'}}}}}["local.environment"]}"])},[]) : oam_link :> {\'description\': \'oam sink_identifier to use in aws_oam_link resource\'}}'}, 'ssm_parameters./oam.parameters': '{for oam_link in coalesce(${merge({\'cloudwatch_dashboard_default_widget_groups\': [\'ec2\', \'ec2_windows\', \'lb\'], \'cloudwatch_metric_alarms_default_actions\': \'pagerduty\', \'cloudwatch_metric_oam_links\': \'hmpps-oem-${trimprefix(terraform.workspace,"${var.networking[0].application}-")}\', \'cloudwatch_metric_oam_links_ssm_parameters\': \'hmpps-oem-${trimprefix(terraform.workspace,"${var.networking[0].application}-")}\', \'enable_backup_plan_daily_and_weekly\': True, \'enable_business_unit_kms_cmks\': True, \'enable_ec2_cloud_watch_agent\': True, \'enable_ec2_self_provision\': True, \'enable_ec2_session_manager_cloudwatch_logs\': True, \'enable_ec2_ssm_agent_update\': True, \'enable_ec2_user_keypair\': True, \'enable_hmpps_domain\': True, \'enable_image_builder\': True, \'enable_s3_bucket\': True, \'s3_iam_policies\': \'EC2S3BucketWriteAndDeleteAccessPolicy\'},["${{\'development\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-development\'}}}}, \'preproduction\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-preproduction\'}}}}, \'production\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-production\'}}}}, \'test\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-test\'}}}}}["local.environment"]}"])},[]) : oam_link :> {\'description\': \'oam sink_identifier to use in aws_oam_link resource\'}}', 'ssm_parameters.account': {'parameters': {'ids': {'description': 'Selected modernisation platform AWS account IDs managed by baseline module', 'value': '${jsonencode({for key , value in var.environment.account_ids : key => value if contains(local.account_names_for_account_ids_ssm_parameter,key)})}'}}, 'postfix': '_'}, 'ssm_parameters.account.parameters': {'ids': {'description': 'Selected modernisation platform AWS account IDs managed by baseline module', 'value': '${jsonencode({for key , value in var.environment.account_ids : key => value if contains(local.account_names_for_account_ids_ssm_parameter,key)})}'}}, 'ssm_parameters.account.parameters.ids': {'description': 'Selected modernisation platform AWS account IDs managed by baseline module', 'value': '${jsonencode({for key , value in var.environment.account_ids : key => value if contains(local.account_names_for_account_ids_ssm_parameter,key)})}'}, 'ssm_parameters.account.parameters.ids.description': 'Selected modernisation platform AWS account IDs managed by baseline module', 'ssm_parameters.account.parameters.ids.value': '${jsonencode({for key , value in var.environment.account_ids : key => value if contains(local.account_names_for_account_ids_ssm_parameter,key)})}', 'ssm_parameters.account.postfix': '_', 'ssm_parameters.cloud-watch-config': {'parameters': {'windows': {'description': 'cloud watch agent config for windows managed by baseline module', 'file': './templates/cloud_watch_windows.json', 'type': 'String'}}, 'postfix': '-'}, 'ssm_parameters.cloud-watch-config.parameters': {'windows': {'description': 'cloud watch agent config for windows managed by baseline module', 'file': './templates/cloud_watch_windows.json', 'type': 'String'}}, 'ssm_parameters.cloud-watch-config.parameters.windows': {'description': 'cloud watch agent config for windows managed by baseline module', 'file': './templates/cloud_watch_windows.json', 'type': 'String'}, 'ssm_parameters.cloud-watch-config.parameters.windows.description': 'cloud watch agent config for windows managed by baseline module', 'ssm_parameters.cloud-watch-config.parameters.windows.file': './templates/cloud_watch_windows.json', 'ssm_parameters.cloud-watch-config.parameters.windows.type': 'String', 'ssm_parameters.cloud-watch-config.postfix': '-'}. Falling back to explicitly setting it.Exception - Parse error at 1:16 near token / (SORT_DIRECTION)
2024-11-25 12:30:49,579 [MainThread  ] [WARNI]  Failed updating attribute for key: secretsmanager_secrets./ec2/.ssh and value {'recovery_window_in_days': 7} forvertex attributes {'secretsmanager_secrets': {'/ec2/.ssh': {'recovery_window_in_days': 7, 'secrets': {'ec2-user': {'description': 'Private key for ec2-user key pair'}}}}, 'secretsmanager_secrets./ec2/.ssh': {'recovery_window_in_days': 7, 'secrets': {'ec2-user': {'description': 'Private key for ec2-user key pair'}}}, 'secretsmanager_secrets./ec2/.ssh.recovery_window_in_days': 7, 'secretsmanager_secrets./ec2/.ssh.secrets': {'ec2-user': {'description': 'Private key for ec2-user key pair'}}, 'secretsmanager_secrets./ec2/.ssh.secrets.ec2-user': {'description': 'Private key for ec2-user key pair'}, 'secretsmanager_secrets./ec2/.ssh.secrets.ec2-user.description': 'Private key for ec2-user key pair'}. Falling back to explicitly setting it.Exception - Parse error at 1:24 near token / (SORT_DIRECTION)
2024-11-25 12:30:49,612 [MainThread  ] [WARNI]  Failed updating attribute for key: ssm_parameters./oam and value {'parameters': '{for oam_link in coalesce(${merge({\'cloudwatch_dashboard_default_widget_groups\': [\'ec2\', \'ec2_windows\', \'lb\'], \'cloudwatch_metric_alarms_default_actions\': \'pagerduty\', \'cloudwatch_metric_oam_links\': \'hmpps-oem-${trimprefix(terraform.workspace,"${var.networking[0].application}-")}\', \'cloudwatch_metric_oam_links_ssm_parameters\': \'hmpps-oem-${trimprefix(terraform.workspace,"${var.networking[0].application}-")}\', \'enable_backup_plan_daily_and_weekly\': True, \'enable_business_unit_kms_cmks\': True, \'enable_ec2_cloud_watch_agent\': True, \'enable_ec2_self_provision\': True, \'enable_ec2_session_manager_cloudwatch_logs\': True, \'enable_ec2_ssm_agent_update\': True, \'enable_ec2_user_keypair\': True, \'enable_hmpps_domain\': True, \'enable_image_builder\': True, \'enable_s3_bucket\': True, \'s3_iam_policies\': \'EC2S3BucketWriteAndDeleteAccessPolicy\'},["${{\'development\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-development\'}}}}, \'preproduction\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-preproduction\'}}}}, \'production\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-production\'}}}}, \'test\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-test\'}}}}}["local.environment"]}"])},[]) : oam_link :> {\'description\': \'oam sink_identifier to use in aws_oam_link resource\'}}'} forvertex attributes {'ssm_parameters': {'/azure': {'parameters': {'sas_token': {'description': 'database backup storage account read-only sas token'}}}, '/oam': {'parameters': '{for oam_link in coalesce(${merge({\'cloudwatch_dashboard_default_widget_groups\': [\'ec2\', \'ec2_windows\', \'lb\'], \'cloudwatch_metric_alarms_default_actions\': \'pagerduty\', \'cloudwatch_metric_oam_links\': \'hmpps-oem-${trimprefix(terraform.workspace,"${var.networking[0].application}-")}\', \'cloudwatch_metric_oam_links_ssm_parameters\': \'hmpps-oem-${trimprefix(terraform.workspace,"${var.networking[0].application}-")}\', \'enable_backup_plan_daily_and_weekly\': True, \'enable_business_unit_kms_cmks\': True, \'enable_ec2_cloud_watch_agent\': True, \'enable_ec2_self_provision\': True, \'enable_ec2_session_manager_cloudwatch_logs\': True, \'enable_ec2_ssm_agent_update\': True, \'enable_ec2_user_keypair\': True, \'enable_hmpps_domain\': True, \'enable_image_builder\': True, \'enable_s3_bucket\': True, \'s3_iam_policies\': \'EC2S3BucketWriteAndDeleteAccessPolicy\'},["${{\'development\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-development\'}}}}, \'preproduction\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-preproduction\'}}}}, \'production\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-production\'}}}}, \'test\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-test\'}}}}}["local.environment"]}"])},[]) : oam_link :> {\'description\': \'oam sink_identifier to use in aws_oam_link resource\'}}'}, 'account': {'parameters': {'ids': {'description': 'Selected modernisation platform AWS account IDs managed by baseline module', 'value': '${jsonencode({for key , value in var.environment.account_ids : key => value if contains(local.account_names_for_account_ids_ssm_parameter,key)})}'}}, 'postfix': '_'}, 'cloud-watch-config': {'parameters': {'windows': {'description': 'cloud watch agent config for windows managed by baseline module', 'file': './templates/cloud_watch_windows.json', 'type': 'String'}}, 'postfix': '-'}}, 'ssm_parameters./azure': {'parameters': {'sas_token': {'description': 'database backup storage account read-only sas token'}}}, 'ssm_parameters./azure.parameters': {'sas_token': {'description': 'database backup storage account read-only sas token'}}, 'ssm_parameters./azure.parameters.sas_token': {'description': 'database backup storage account read-only sas token'}, 'ssm_parameters./azure.parameters.sas_token.description': 'database backup storage account read-only sas token', 'ssm_parameters./oam': {'parameters': '{for oam_link in coalesce(${merge({\'cloudwatch_dashboard_default_widget_groups\': [\'ec2\', \'ec2_windows\', \'lb\'], \'cloudwatch_metric_alarms_default_actions\': \'pagerduty\', \'cloudwatch_metric_oam_links\': \'hmpps-oem-${trimprefix(terraform.workspace,"${var.networking[0].application}-")}\', \'cloudwatch_metric_oam_links_ssm_parameters\': \'hmpps-oem-${trimprefix(terraform.workspace,"${var.networking[0].application}-")}\', \'enable_backup_plan_daily_and_weekly\': True, \'enable_business_unit_kms_cmks\': True, \'enable_ec2_cloud_watch_agent\': True, \'enable_ec2_self_provision\': True, \'enable_ec2_session_manager_cloudwatch_logs\': True, \'enable_ec2_ssm_agent_update\': True, \'enable_ec2_user_keypair\': True, \'enable_hmpps_domain\': True, \'enable_image_builder\': True, \'enable_s3_bucket\': True, \'s3_iam_policies\': \'EC2S3BucketWriteAndDeleteAccessPolicy\'},["${{\'development\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-development\'}}}}, \'preproduction\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-preproduction\'}}}}, \'production\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-production\'}}}}, \'test\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-test\'}}}}}["local.environment"]}"])},[]) : oam_link :> {\'description\': \'oam sink_identifier to use in aws_oam_link resource\'}}'}, 'ssm_parameters./oam.parameters': '{for oam_link in coalesce(${merge({\'cloudwatch_dashboard_default_widget_groups\': [\'ec2\', \'ec2_windows\', \'lb\'], \'cloudwatch_metric_alarms_default_actions\': \'pagerduty\', \'cloudwatch_metric_oam_links\': \'hmpps-oem-${trimprefix(terraform.workspace,"${var.networking[0].application}-")}\', \'cloudwatch_metric_oam_links_ssm_parameters\': \'hmpps-oem-${trimprefix(terraform.workspace,"${var.networking[0].application}-")}\', \'enable_backup_plan_daily_and_weekly\': True, \'enable_business_unit_kms_cmks\': True, \'enable_ec2_cloud_watch_agent\': True, \'enable_ec2_self_provision\': True, \'enable_ec2_session_manager_cloudwatch_logs\': True, \'enable_ec2_ssm_agent_update\': True, \'enable_ec2_user_keypair\': True, \'enable_hmpps_domain\': True, \'enable_image_builder\': True, \'enable_s3_bucket\': True, \'s3_iam_policies\': \'EC2S3BucketWriteAndDeleteAccessPolicy\'},["${{\'development\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-development\'}}}}, \'preproduction\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-preproduction\'}}}}, \'production\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-production\'}}}}, \'test\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-test\'}}}}}["local.environment"]}"])},[]) : oam_link :> {\'description\': \'oam sink_identifier to use in aws_oam_link resource\'}}', 'ssm_parameters.account': {'parameters': {'ids': {'description': 'Selected modernisation platform AWS account IDs managed by baseline module', 'value': '${jsonencode({for key , value in var.environment.account_ids : key => value if contains(local.account_names_for_account_ids_ssm_parameter,key)})}'}}, 'postfix': '_'}, 'ssm_parameters.account.parameters': {'ids': {'description': 'Selected modernisation platform AWS account IDs managed by baseline module', 'value': '${jsonencode({for key , value in var.environment.account_ids : key => value if contains(local.account_names_for_account_ids_ssm_parameter,key)})}'}}, 'ssm_parameters.account.parameters.ids': {'description': 'Selected modernisation platform AWS account IDs managed by baseline module', 'value': '${jsonencode({for key , value in var.environment.account_ids : key => value if contains(local.account_names_for_account_ids_ssm_parameter,key)})}'}, 'ssm_parameters.account.parameters.ids.description': 'Selected modernisation platform AWS account IDs managed by baseline module', 'ssm_parameters.account.parameters.ids.value': '${jsonencode({for key , value in var.environment.account_ids : key => value if contains(local.account_names_for_account_ids_ssm_parameter,key)})}', 'ssm_parameters.account.postfix': '_', 'ssm_parameters.cloud-watch-config': {'parameters': {'windows': {'description': 'cloud watch agent config for windows managed by baseline module', 'file': './templates/cloud_watch_windows.json', 'type': 'String'}}, 'postfix': '-'}, 'ssm_parameters.cloud-watch-config.parameters': {'windows': {'description': 'cloud watch agent config for windows managed by baseline module', 'file': './templates/cloud_watch_windows.json', 'type': 'String'}}, 'ssm_parameters.cloud-watch-config.parameters.windows': {'description': 'cloud watch agent config for windows managed by baseline module', 'file': './templates/cloud_watch_windows.json', 'type': 'String'}, 'ssm_parameters.cloud-watch-config.parameters.windows.description': 'cloud watch agent config for windows managed by baseline module', 'ssm_parameters.cloud-watch-config.parameters.windows.file': './templates/cloud_watch_windows.json', 'ssm_parameters.cloud-watch-config.parameters.windows.type': 'String', 'ssm_parameters.cloud-watch-config.postfix': '-'}. Falling back to explicitly setting it.Exception - Parse error at 1:16 near token / (SORT_DIRECTION)
2024-11-25 12:30:50,663 [MainThread  ] [WARNI]  Failed updating attribute for key: secretsmanager_secrets./ec2/.ssh and value {'recovery_window_in_days': 7} forvertex attributes {'secretsmanager_secrets': {'/ec2/.ssh': {'recovery_window_in_days': 7, 'secrets': {'ec2-user': {'description': 'Private key for ec2-user key pair'}}}}, 'secretsmanager_secrets./ec2/.ssh': {'recovery_window_in_days': 7, 'secrets': {'ec2-user': {'description': 'Private key for ec2-user key pair'}}}, 'secretsmanager_secrets./ec2/.ssh.recovery_window_in_days': 7, 'secretsmanager_secrets./ec2/.ssh.secrets': {'ec2-user': {'description': 'Private key for ec2-user key pair'}}, 'secretsmanager_secrets./ec2/.ssh.secrets.ec2-user': {'description': 'Private key for ec2-user key pair'}, 'secretsmanager_secrets./ec2/.ssh.secrets.ec2-user.description': 'Private key for ec2-user key pair'}. Falling back to explicitly setting it.Exception - Parse error at 1:24 near token / (SORT_DIRECTION)
2024-11-25 12:30:50,696 [MainThread  ] [WARNI]  Failed updating attribute for key: ssm_parameters./oam and value {'parameters': '{for oam_link in coalesce(${merge({\'cloudwatch_dashboard_default_widget_groups\': [\'ec2\', \'ec2_windows\', \'lb\'], \'cloudwatch_metric_alarms_default_actions\': \'pagerduty\', \'cloudwatch_metric_oam_links\': \'hmpps-oem-${trimprefix(terraform.workspace,"${var.networking[0].application}-")}\', \'cloudwatch_metric_oam_links_ssm_parameters\': \'hmpps-oem-${trimprefix(terraform.workspace,"${var.networking[0].application}-")}\', \'enable_backup_plan_daily_and_weekly\': True, \'enable_business_unit_kms_cmks\': True, \'enable_ec2_cloud_watch_agent\': True, \'enable_ec2_self_provision\': True, \'enable_ec2_session_manager_cloudwatch_logs\': True, \'enable_ec2_ssm_agent_update\': True, \'enable_ec2_user_keypair\': True, \'enable_hmpps_domain\': True, \'enable_image_builder\': True, \'enable_s3_bucket\': True, \'s3_iam_policies\': \'EC2S3BucketWriteAndDeleteAccessPolicy\'},["${{\'development\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-development\'}}}}, \'preproduction\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-preproduction\'}}}}, \'production\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-production\'}}}}, \'test\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-test\'}}}}}["local.environment"]}"])},[]) : oam_link :> {\'description\': \'oam sink_identifier to use in aws_oam_link resource\'}}'} forvertex attributes {'ssm_parameters': {'/azure': {'parameters': {'sas_token': {'description': 'database backup storage account read-only sas token'}}}, '/oam': {'parameters': '{for oam_link in coalesce(${merge({\'cloudwatch_dashboard_default_widget_groups\': [\'ec2\', \'ec2_windows\', \'lb\'], \'cloudwatch_metric_alarms_default_actions\': \'pagerduty\', \'cloudwatch_metric_oam_links\': \'hmpps-oem-${trimprefix(terraform.workspace,"${var.networking[0].application}-")}\', \'cloudwatch_metric_oam_links_ssm_parameters\': \'hmpps-oem-${trimprefix(terraform.workspace,"${var.networking[0].application}-")}\', \'enable_backup_plan_daily_and_weekly\': True, \'enable_business_unit_kms_cmks\': True, \'enable_ec2_cloud_watch_agent\': True, \'enable_ec2_self_provision\': True, \'enable_ec2_session_manager_cloudwatch_logs\': True, \'enable_ec2_ssm_agent_update\': True, \'enable_ec2_user_keypair\': True, \'enable_hmpps_domain\': True, \'enable_image_builder\': True, \'enable_s3_bucket\': True, \'s3_iam_policies\': \'EC2S3BucketWriteAndDeleteAccessPolicy\'},["${{\'development\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-development\'}}}}, \'preproduction\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-preproduction\'}}}}, \'production\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-production\'}}}}, \'test\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-test\'}}}}}["local.environment"]}"])},[]) : oam_link :> {\'description\': \'oam sink_identifier to use in aws_oam_link resource\'}}'}, 'account': {'parameters': {'ids': {'description': 'Selected modernisation platform AWS account IDs managed by baseline module', 'value': '${jsonencode({for key , value in var.environment.account_ids : key => value if contains(local.account_names_for_account_ids_ssm_parameter,key)})}'}}, 'postfix': '_'}, 'cloud-watch-config': {'parameters': {'windows': {'description': 'cloud watch agent config for windows managed by baseline module', 'file': './templates/cloud_watch_windows.json', 'type': 'String'}}, 'postfix': '-'}}, 'ssm_parameters./azure': {'parameters': {'sas_token': {'description': 'database backup storage account read-only sas token'}}}, 'ssm_parameters./azure.parameters': {'sas_token': {'description': 'database backup storage account read-only sas token'}}, 'ssm_parameters./azure.parameters.sas_token': {'description': 'database backup storage account read-only sas token'}, 'ssm_parameters./azure.parameters.sas_token.description': 'database backup storage account read-only sas token', 'ssm_parameters./oam': {'parameters': '{for oam_link in coalesce(${merge({\'cloudwatch_dashboard_default_widget_groups\': [\'ec2\', \'ec2_windows\', \'lb\'], \'cloudwatch_metric_alarms_default_actions\': \'pagerduty\', \'cloudwatch_metric_oam_links\': \'hmpps-oem-${trimprefix(terraform.workspace,"${var.networking[0].application}-")}\', \'cloudwatch_metric_oam_links_ssm_parameters\': \'hmpps-oem-${trimprefix(terraform.workspace,"${var.networking[0].application}-")}\', \'enable_backup_plan_daily_and_weekly\': True, \'enable_business_unit_kms_cmks\': True, \'enable_ec2_cloud_watch_agent\': True, \'enable_ec2_self_provision\': True, \'enable_ec2_session_manager_cloudwatch_logs\': True, \'enable_ec2_ssm_agent_update\': True, \'enable_ec2_user_keypair\': True, \'enable_hmpps_domain\': True, \'enable_image_builder\': True, \'enable_s3_bucket\': True, \'s3_iam_policies\': \'EC2S3BucketWriteAndDeleteAccessPolicy\'},["${{\'development\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-development\'}}}}, \'preproduction\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-preproduction\'}}}}, \'production\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-production\'}}}}, \'test\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-test\'}}}}}["local.environment"]}"])},[]) : oam_link :> {\'description\': \'oam sink_identifier to use in aws_oam_link resource\'}}'}, 'ssm_parameters./oam.parameters': '{for oam_link in coalesce(${merge({\'cloudwatch_dashboard_default_widget_groups\': [\'ec2\', \'ec2_windows\', \'lb\'], \'cloudwatch_metric_alarms_default_actions\': \'pagerduty\', \'cloudwatch_metric_oam_links\': \'hmpps-oem-${trimprefix(terraform.workspace,"${var.networking[0].application}-")}\', \'cloudwatch_metric_oam_links_ssm_parameters\': \'hmpps-oem-${trimprefix(terraform.workspace,"${var.networking[0].application}-")}\', \'enable_backup_plan_daily_and_weekly\': True, \'enable_business_unit_kms_cmks\': True, \'enable_ec2_cloud_watch_agent\': True, \'enable_ec2_self_provision\': True, \'enable_ec2_session_manager_cloudwatch_logs\': True, \'enable_ec2_ssm_agent_update\': True, \'enable_ec2_user_keypair\': True, \'enable_hmpps_domain\': True, \'enable_image_builder\': True, \'enable_s3_bucket\': True, \'s3_iam_policies\': \'EC2S3BucketWriteAndDeleteAccessPolicy\'},["${{\'development\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-development\'}}}}, \'preproduction\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-preproduction\'}}}}, \'production\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-production\'}}}}, \'test\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-test\'}}}}}["local.environment"]}"])},[]) : oam_link :> {\'description\': \'oam sink_identifier to use in aws_oam_link resource\'}}', 'ssm_parameters.account': {'parameters': {'ids': {'description': 'Selected modernisation platform AWS account IDs managed by baseline module', 'value': '${jsonencode({for key , value in var.environment.account_ids : key => value if contains(local.account_names_for_account_ids_ssm_parameter,key)})}'}}, 'postfix': '_'}, 'ssm_parameters.account.parameters': {'ids': {'description': 'Selected modernisation platform AWS account IDs managed by baseline module', 'value': '${jsonencode({for key , value in var.environment.account_ids : key => value if contains(local.account_names_for_account_ids_ssm_parameter,key)})}'}}, 'ssm_parameters.account.parameters.ids': {'description': 'Selected modernisation platform AWS account IDs managed by baseline module', 'value': '${jsonencode({for key , value in var.environment.account_ids : key => value if contains(local.account_names_for_account_ids_ssm_parameter,key)})}'}, 'ssm_parameters.account.parameters.ids.description': 'Selected modernisation platform AWS account IDs managed by baseline module', 'ssm_parameters.account.parameters.ids.value': '${jsonencode({for key , value in var.environment.account_ids : key => value if contains(local.account_names_for_account_ids_ssm_parameter,key)})}', 'ssm_parameters.account.postfix': '_', 'ssm_parameters.cloud-watch-config': {'parameters': {'windows': {'description': 'cloud watch agent config for windows managed by baseline module', 'file': './templates/cloud_watch_windows.json', 'type': 'String'}}, 'postfix': '-'}, 'ssm_parameters.cloud-watch-config.parameters': {'windows': {'description': 'cloud watch agent config for windows managed by baseline module', 'file': './templates/cloud_watch_windows.json', 'type': 'String'}}, 'ssm_parameters.cloud-watch-config.parameters.windows': {'description': 'cloud watch agent config for windows managed by baseline module', 'file': './templates/cloud_watch_windows.json', 'type': 'String'}, 'ssm_parameters.cloud-watch-config.parameters.windows.description': 'cloud watch agent config for windows managed by baseline module', 'ssm_parameters.cloud-watch-config.parameters.windows.file': './templates/cloud_watch_windows.json', 'ssm_parameters.cloud-watch-config.parameters.windows.type': 'String', 'ssm_parameters.cloud-watch-config.postfix': '-'}. Falling back to explicitly setting it.Exception - Parse error at 1:16 near token / (SORT_DIRECTION)
2024-11-25 12:30:51,755 [MainThread  ] [WARNI]  Failed updating attribute for key: secretsmanager_secrets./ec2/.ssh and value {'recovery_window_in_days': 7} forvertex attributes {'secretsmanager_secrets': {'/ec2/.ssh': {'recovery_window_in_days': 7, 'secrets': {'ec2-user': {'description': 'Private key for ec2-user key pair'}}}}, 'secretsmanager_secrets./ec2/.ssh': {'recovery_window_in_days': 7, 'secrets': {'ec2-user': {'description': 'Private key for ec2-user key pair'}}}, 'secretsmanager_secrets./ec2/.ssh.recovery_window_in_days': 7, 'secretsmanager_secrets./ec2/.ssh.secrets': {'ec2-user': {'description': 'Private key for ec2-user key pair'}}, 'secretsmanager_secrets./ec2/.ssh.secrets.ec2-user': {'description': 'Private key for ec2-user key pair'}, 'secretsmanager_secrets./ec2/.ssh.secrets.ec2-user.description': 'Private key for ec2-user key pair'}. Falling back to explicitly setting it.Exception - Parse error at 1:24 near token / (SORT_DIRECTION)
2024-11-25 12:30:51,789 [MainThread  ] [WARNI]  Failed updating attribute for key: ssm_parameters./oam and value {'parameters': '{for oam_link in coalesce(${merge({\'cloudwatch_dashboard_default_widget_groups\': [\'ec2\', \'ec2_windows\', \'lb\'], \'cloudwatch_metric_alarms_default_actions\': \'pagerduty\', \'cloudwatch_metric_oam_links\': \'hmpps-oem-${trimprefix(terraform.workspace,"${var.networking[0].application}-")}\', \'cloudwatch_metric_oam_links_ssm_parameters\': \'hmpps-oem-${trimprefix(terraform.workspace,"${var.networking[0].application}-")}\', \'enable_backup_plan_daily_and_weekly\': True, \'enable_business_unit_kms_cmks\': True, \'enable_ec2_cloud_watch_agent\': True, \'enable_ec2_self_provision\': True, \'enable_ec2_session_manager_cloudwatch_logs\': True, \'enable_ec2_ssm_agent_update\': True, \'enable_ec2_user_keypair\': True, \'enable_hmpps_domain\': True, \'enable_image_builder\': True, \'enable_s3_bucket\': True, \'s3_iam_policies\': \'EC2S3BucketWriteAndDeleteAccessPolicy\'},["${{\'development\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-development\'}}}}, \'preproduction\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-preproduction\'}}}}, \'production\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-production\'}}}}, \'test\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-test\'}}}}}["local.environment"]}"])},[]) : oam_link :> {\'description\': \'oam sink_identifier to use in aws_oam_link resource\'}}'} forvertex attributes {'ssm_parameters': {'/azure': {'parameters': {'sas_token': {'description': 'database backup storage account read-only sas token'}}}, '/oam': {'parameters': '{for oam_link in coalesce(${merge({\'cloudwatch_dashboard_default_widget_groups\': [\'ec2\', \'ec2_windows\', \'lb\'], \'cloudwatch_metric_alarms_default_actions\': \'pagerduty\', \'cloudwatch_metric_oam_links\': \'hmpps-oem-${trimprefix(terraform.workspace,"${var.networking[0].application}-")}\', \'cloudwatch_metric_oam_links_ssm_parameters\': \'hmpps-oem-${trimprefix(terraform.workspace,"${var.networking[0].application}-")}\', \'enable_backup_plan_daily_and_weekly\': True, \'enable_business_unit_kms_cmks\': True, \'enable_ec2_cloud_watch_agent\': True, \'enable_ec2_self_provision\': True, \'enable_ec2_session_manager_cloudwatch_logs\': True, \'enable_ec2_ssm_agent_update\': True, \'enable_ec2_user_keypair\': True, \'enable_hmpps_domain\': True, \'enable_image_builder\': True, \'enable_s3_bucket\': True, \'s3_iam_policies\': \'EC2S3BucketWriteAndDeleteAccessPolicy\'},["${{\'development\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-development\'}}}}, \'preproduction\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-preproduction\'}}}}, \'production\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-production\'}}}}, \'test\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-test\'}}}}}["local.environment"]}"])},[]) : oam_link :> {\'description\': \'oam sink_identifier to use in aws_oam_link resource\'}}'}, 'account': {'parameters': {'ids': {'description': 'Selected modernisation platform AWS account IDs managed by baseline module', 'value': '${jsonencode({for key , value in var.environment.account_ids : key => value if contains(local.account_names_for_account_ids_ssm_parameter,key)})}'}}, 'postfix': '_'}, 'cloud-watch-config': {'parameters': {'windows': {'description': 'cloud watch agent config for windows managed by baseline module', 'file': './templates/cloud_watch_windows.json', 'type': 'String'}}, 'postfix': '-'}}, 'ssm_parameters./azure': {'parameters': {'sas_token': {'description': 'database backup storage account read-only sas token'}}}, 'ssm_parameters./azure.parameters': {'sas_token': {'description': 'database backup storage account read-only sas token'}}, 'ssm_parameters./azure.parameters.sas_token': {'description': 'database backup storage account read-only sas token'}, 'ssm_parameters./azure.parameters.sas_token.description': 'database backup storage account read-only sas token', 'ssm_parameters./oam': {'parameters': '{for oam_link in coalesce(${merge({\'cloudwatch_dashboard_default_widget_groups\': [\'ec2\', \'ec2_windows\', \'lb\'], \'cloudwatch_metric_alarms_default_actions\': \'pagerduty\', \'cloudwatch_metric_oam_links\': \'hmpps-oem-${trimprefix(terraform.workspace,"${var.networking[0].application}-")}\', \'cloudwatch_metric_oam_links_ssm_parameters\': \'hmpps-oem-${trimprefix(terraform.workspace,"${var.networking[0].application}-")}\', \'enable_backup_plan_daily_and_weekly\': True, \'enable_business_unit_kms_cmks\': True, \'enable_ec2_cloud_watch_agent\': True, \'enable_ec2_self_provision\': True, \'enable_ec2_session_manager_cloudwatch_logs\': True, \'enable_ec2_ssm_agent_update\': True, \'enable_ec2_user_keypair\': True, \'enable_hmpps_domain\': True, \'enable_image_builder\': True, \'enable_s3_bucket\': True, \'s3_iam_policies\': \'EC2S3BucketWriteAndDeleteAccessPolicy\'},["${{\'development\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-development\'}}}}, \'preproduction\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-preproduction\'}}}}, \'production\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-production\'}}}}, \'test\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-test\'}}}}}["local.environment"]}"])},[]) : oam_link :> {\'description\': \'oam sink_identifier to use in aws_oam_link resource\'}}'}, 'ssm_parameters./oam.parameters': '{for oam_link in coalesce(${merge({\'cloudwatch_dashboard_default_widget_groups\': [\'ec2\', \'ec2_windows\', \'lb\'], \'cloudwatch_metric_alarms_default_actions\': \'pagerduty\', \'cloudwatch_metric_oam_links\': \'hmpps-oem-${trimprefix(terraform.workspace,"${var.networking[0].application}-")}\', \'cloudwatch_metric_oam_links_ssm_parameters\': \'hmpps-oem-${trimprefix(terraform.workspace,"${var.networking[0].application}-")}\', \'enable_backup_plan_daily_and_weekly\': True, \'enable_business_unit_kms_cmks\': True, \'enable_ec2_cloud_watch_agent\': True, \'enable_ec2_self_provision\': True, \'enable_ec2_session_manager_cloudwatch_logs\': True, \'enable_ec2_ssm_agent_update\': True, \'enable_ec2_user_keypair\': True, \'enable_hmpps_domain\': True, \'enable_image_builder\': True, \'enable_s3_bucket\': True, \'s3_iam_policies\': \'EC2S3BucketWriteAndDeleteAccessPolicy\'},["${{\'development\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-development\'}}}}, \'preproduction\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-preproduction\'}}}}, \'production\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-production\'}}}}, \'test\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-test\'}}}}}["local.environment"]}"])},[]) : oam_link :> {\'description\': \'oam sink_identifier to use in aws_oam_link resource\'}}', 'ssm_parameters.account': {'parameters': {'ids': {'description': 'Selected modernisation platform AWS account IDs managed by baseline module', 'value': '${jsonencode({for key , value in var.environment.account_ids : key => value if contains(local.account_names_for_account_ids_ssm_parameter,key)})}'}}, 'postfix': '_'}, 'ssm_parameters.account.parameters': {'ids': {'description': 'Selected modernisation platform AWS account IDs managed by baseline module', 'value': '${jsonencode({for key , value in var.environment.account_ids : key => value if contains(local.account_names_for_account_ids_ssm_parameter,key)})}'}}, 'ssm_parameters.account.parameters.ids': {'description': 'Selected modernisation platform AWS account IDs managed by baseline module', 'value': '${jsonencode({for key , value in var.environment.account_ids : key => value if contains(local.account_names_for_account_ids_ssm_parameter,key)})}'}, 'ssm_parameters.account.parameters.ids.description': 'Selected modernisation platform AWS account IDs managed by baseline module', 'ssm_parameters.account.parameters.ids.value': '${jsonencode({for key , value in var.environment.account_ids : key => value if contains(local.account_names_for_account_ids_ssm_parameter,key)})}', 'ssm_parameters.account.postfix': '_', 'ssm_parameters.cloud-watch-config': {'parameters': {'windows': {'description': 'cloud watch agent config for windows managed by baseline module', 'file': './templates/cloud_watch_windows.json', 'type': 'String'}}, 'postfix': '-'}, 'ssm_parameters.cloud-watch-config.parameters': {'windows': {'description': 'cloud watch agent config for windows managed by baseline module', 'file': './templates/cloud_watch_windows.json', 'type': 'String'}}, 'ssm_parameters.cloud-watch-config.parameters.windows': {'description': 'cloud watch agent config for windows managed by baseline module', 'file': './templates/cloud_watch_windows.json', 'type': 'String'}, 'ssm_parameters.cloud-watch-config.parameters.windows.description': 'cloud watch agent config for windows managed by baseline module', 'ssm_parameters.cloud-watch-config.parameters.windows.file': './templates/cloud_watch_windows.json', 'ssm_parameters.cloud-watch-config.parameters.windows.type': 'String', 'ssm_parameters.cloud-watch-config.postfix': '-'}. Falling back to explicitly setting it.Exception - Parse error at 1:16 near token / (SORT_DIRECTION)
2024-11-25 12:30:52,829 [MainThread  ] [WARNI]  Failed updating attribute for key: secretsmanager_secrets./ec2/.ssh and value {'recovery_window_in_days': 7} forvertex attributes {'secretsmanager_secrets': {'/ec2/.ssh': {'recovery_window_in_days': 7, 'secrets': {'ec2-user': {'description': 'Private key for ec2-user key pair'}}}}, 'secretsmanager_secrets./ec2/.ssh': {'recovery_window_in_days': 7, 'secrets': {'ec2-user': {'description': 'Private key for ec2-user key pair'}}}, 'secretsmanager_secrets./ec2/.ssh.recovery_window_in_days': 7, 'secretsmanager_secrets./ec2/.ssh.secrets': {'ec2-user': {'description': 'Private key for ec2-user key pair'}}, 'secretsmanager_secrets./ec2/.ssh.secrets.ec2-user': {'description': 'Private key for ec2-user key pair'}, 'secretsmanager_secrets./ec2/.ssh.secrets.ec2-user.description': 'Private key for ec2-user key pair'}. Falling back to explicitly setting it.Exception - Parse error at 1:24 near token / (SORT_DIRECTION)
2024-11-25 12:30:52,863 [MainThread  ] [WARNI]  Failed updating attribute for key: ssm_parameters./oam and value {'parameters': '{for oam_link in coalesce(${merge({\'cloudwatch_dashboard_default_widget_groups\': [\'ec2\', \'ec2_windows\', \'lb\'], \'cloudwatch_metric_alarms_default_actions\': \'pagerduty\', \'cloudwatch_metric_oam_links\': \'hmpps-oem-${trimprefix(terraform.workspace,"${var.networking[0].application}-")}\', \'cloudwatch_metric_oam_links_ssm_parameters\': \'hmpps-oem-${trimprefix(terraform.workspace,"${var.networking[0].application}-")}\', \'enable_backup_plan_daily_and_weekly\': True, \'enable_business_unit_kms_cmks\': True, \'enable_ec2_cloud_watch_agent\': True, \'enable_ec2_self_provision\': True, \'enable_ec2_session_manager_cloudwatch_logs\': True, \'enable_ec2_ssm_agent_update\': True, \'enable_ec2_user_keypair\': True, \'enable_hmpps_domain\': True, \'enable_image_builder\': True, \'enable_s3_bucket\': True, \'s3_iam_policies\': \'EC2S3BucketWriteAndDeleteAccessPolicy\'},["${{\'development\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-development\'}}}}, \'preproduction\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-preproduction\'}}}}, \'production\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-production\'}}}}, \'test\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-test\'}}}}}["local.environment"]}"])},[]) : oam_link :> {\'description\': \'oam sink_identifier to use in aws_oam_link resource\'}}'} forvertex attributes {'ssm_parameters': {'/azure': {'parameters': {'sas_token': {'description': 'database backup storage account read-only sas token'}}}, '/oam': {'parameters': '{for oam_link in coalesce(${merge({\'cloudwatch_dashboard_default_widget_groups\': [\'ec2\', \'ec2_windows\', \'lb\'], \'cloudwatch_metric_alarms_default_actions\': \'pagerduty\', \'cloudwatch_metric_oam_links\': \'hmpps-oem-${trimprefix(terraform.workspace,"${var.networking[0].application}-")}\', \'cloudwatch_metric_oam_links_ssm_parameters\': \'hmpps-oem-${trimprefix(terraform.workspace,"${var.networking[0].application}-")}\', \'enable_backup_plan_daily_and_weekly\': True, \'enable_business_unit_kms_cmks\': True, \'enable_ec2_cloud_watch_agent\': True, \'enable_ec2_self_provision\': True, \'enable_ec2_session_manager_cloudwatch_logs\': True, \'enable_ec2_ssm_agent_update\': True, \'enable_ec2_user_keypair\': True, \'enable_hmpps_domain\': True, \'enable_image_builder\': True, \'enable_s3_bucket\': True, \'s3_iam_policies\': \'EC2S3BucketWriteAndDeleteAccessPolicy\'},["${{\'development\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-development\'}}}}, \'preproduction\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-preproduction\'}}}}, \'production\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-production\'}}}}, \'test\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-test\'}}}}}["local.environment"]}"])},[]) : oam_link :> {\'description\': \'oam sink_identifier to use in aws_oam_link resource\'}}'}, 'account': {'parameters': {'ids': {'description': 'Selected modernisation platform AWS account IDs managed by baseline module', 'value': '${jsonencode({for key , value in var.environment.account_ids : key => value if contains(local.account_names_for_account_ids_ssm_parameter,key)})}'}}, 'postfix': '_'}, 'cloud-watch-config': {'parameters': {'windows': {'description': 'cloud watch agent config for windows managed by baseline module', 'file': './templates/cloud_watch_windows.json', 'type': 'String'}}, 'postfix': '-'}}, 'ssm_parameters./azure': {'parameters': {'sas_token': {'description': 'database backup storage account read-only sas token'}}}, 'ssm_parameters./azure.parameters': {'sas_token': {'description': 'database backup storage account read-only sas token'}}, 'ssm_parameters./azure.parameters.sas_token': {'description': 'database backup storage account read-only sas token'}, 'ssm_parameters./azure.parameters.sas_token.description': 'database backup storage account read-only sas token', 'ssm_parameters./oam': {'parameters': '{for oam_link in coalesce(${merge({\'cloudwatch_dashboard_default_widget_groups\': [\'ec2\', \'ec2_windows\', \'lb\'], \'cloudwatch_metric_alarms_default_actions\': \'pagerduty\', \'cloudwatch_metric_oam_links\': \'hmpps-oem-${trimprefix(terraform.workspace,"${var.networking[0].application}-")}\', \'cloudwatch_metric_oam_links_ssm_parameters\': \'hmpps-oem-${trimprefix(terraform.workspace,"${var.networking[0].application}-")}\', \'enable_backup_plan_daily_and_weekly\': True, \'enable_business_unit_kms_cmks\': True, \'enable_ec2_cloud_watch_agent\': True, \'enable_ec2_self_provision\': True, \'enable_ec2_session_manager_cloudwatch_logs\': True, \'enable_ec2_ssm_agent_update\': True, \'enable_ec2_user_keypair\': True, \'enable_hmpps_domain\': True, \'enable_image_builder\': True, \'enable_s3_bucket\': True, \'s3_iam_policies\': \'EC2S3BucketWriteAndDeleteAccessPolicy\'},["${{\'development\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-development\'}}}}, \'preproduction\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-preproduction\'}}}}, \'production\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-production\'}}}}, \'test\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-test\'}}}}}["local.environment"]}"])},[]) : oam_link :> {\'description\': \'oam sink_identifier to use in aws_oam_link resource\'}}'}, 'ssm_parameters./oam.parameters': '{for oam_link in coalesce(${merge({\'cloudwatch_dashboard_default_widget_groups\': [\'ec2\', \'ec2_windows\', \'lb\'], \'cloudwatch_metric_alarms_default_actions\': \'pagerduty\', \'cloudwatch_metric_oam_links\': \'hmpps-oem-${trimprefix(terraform.workspace,"${var.networking[0].application}-")}\', \'cloudwatch_metric_oam_links_ssm_parameters\': \'hmpps-oem-${trimprefix(terraform.workspace,"${var.networking[0].application}-")}\', \'enable_backup_plan_daily_and_weekly\': True, \'enable_business_unit_kms_cmks\': True, \'enable_ec2_cloud_watch_agent\': True, \'enable_ec2_self_provision\': True, \'enable_ec2_session_manager_cloudwatch_logs\': True, \'enable_ec2_ssm_agent_update\': True, \'enable_ec2_user_keypair\': True, \'enable_hmpps_domain\': True, \'enable_image_builder\': True, \'enable_s3_bucket\': True, \'s3_iam_policies\': \'EC2S3BucketWriteAndDeleteAccessPolicy\'},["${{\'development\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-development\'}}}}, \'preproduction\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-preproduction\'}}}}, \'production\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-production\'}}}}, \'test\': {\'options\': {\'sns_topics\': {\'pagerduty_integrations\': {\'pagerduty\': \'hmpps-domain-services-test\'}}}}}["local.environment"]}"])},[]) : oam_link :> {\'description\': \'oam sink_identifier to use in aws_oam_link resource\'}}', 'ssm_parameters.account': {'parameters': {'ids': {'description': 'Selected modernisation platform AWS account IDs managed by baseline module', 'value': '${jsonencode({for key , value in var.environment.account_ids : key => value if contains(local.account_names_for_account_ids_ssm_parameter,key)})}'}}, 'postfix': '_'}, 'ssm_parameters.account.parameters': {'ids': {'description': 'Selected modernisation platform AWS account IDs managed by baseline module', 'value': '${jsonencode({for key , value in var.environment.account_ids : key => value if contains(local.account_names_for_account_ids_ssm_parameter,key)})}'}}, 'ssm_parameters.account.parameters.ids': {'description': 'Selected modernisation platform AWS account IDs managed by baseline module', 'value': '${jsonencode({for key , value in var.environment.account_ids : key => value if contains(local.account_names_for_account_ids_ssm_parameter,key)})}'}, 'ssm_parameters.account.parameters.ids.description': 'Selected modernisation platform AWS account IDs managed by baseline module', 'ssm_parameters.account.parameters.ids.value': '${jsonencode({for key , value in var.environment.account_ids : key => value if contains(local.account_names_for_account_ids_ssm_parameter,key)})}', 'ssm_parameters.account.postfix': '_', 'ssm_parameters.cloud-watch-config': {'parameters': {'windows': {'description': 'cloud watch agent config for windows managed by baseline module', 'file': './templates/cloud_watch_windows.json', 'type': 'String'}}, 'postfix': '-'}, 'ssm_parameters.cloud-watch-config.parameters': {'windows': {'description': 'cloud watch agent config for windows managed by baseline module', 'file': './templates/cloud_watch_windows.json', 'type': 'String'}}, 'ssm_parameters.cloud-watch-config.parameters.windows': {'description': 'cloud watch agent config for windows managed by baseline module', 'file': './templates/cloud_watch_windows.json', 'type': 'String'}, 'ssm_parameters.cloud-watch-config.parameters.windows.description': 'cloud watch agent config for windows managed by baseline module', 'ssm_parameters.cloud-watch-config.parameters.windows.file': './templates/cloud_watch_windows.json', 'ssm_parameters.cloud-watch-config.parameters.windows.type': 'String', 'ssm_parameters.cloud-watch-config.postfix': '-'}. Falling back to explicitly setting it.Exception - Parse error at 1:16 near token / (SORT_DIRECTION)
terraform scan results:

Passed checks: 172, Failed checks: 8, Skipped checks: 24

Check: CKV_AWS_115: "Ensure that AWS Lambda function is configured for function-level concurrent execution limit"
	FAILED for resource: module.baseline.module.schedule_alarms_lambda[0].aws_lambda_function.alarm_scheduler
	File: /../../modules/schedule_alarms_lambda/main.tf:8-27
	Calling File: /../../modules/baseline/schedule_alarms_lambda.tf:1-20
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-function-level-concurrent-execution-limit

		8  | resource "aws_lambda_function" "alarm_scheduler" {
		9  |   filename         = "${path.module}/lambda/alarm_scheduler.zip"
		10 |   function_name    = var.lambda_function_name
		11 |   architectures    = ["arm64"]
		12 |   role             = aws_iam_role.lambda_exec.arn
		13 |   runtime          = "python3.12"
		14 |   handler          = "alarm_scheduler.lambda_handler"
		15 |   source_code_hash = data.archive_file.lambda_function_payload.output_base64sha256
		16 |   timeout          = 10
		17 | 
		18 |   environment {
		19 |     variables = {
		20 |       LOG_LEVEL       = var.lambda_log_level
		21 |       SPECIFIC_ALARMS = tostring(join(",", var.alarm_list))
		22 |       ALARM_PATTERNS  = tostring(join(",", var.alarm_patterns))
		23 |     }
		24 |   }
		25 | 
		26 |   tags = var.tags
		27 | }

Check: CKV_AWS_173: "Check encryption settings for Lambda environmental variable"
	FAILED for resource: module.baseline.module.schedule_alarms_lambda[0].aws_lambda_function.alarm_scheduler
	File: /../../modules/schedule_alarms_lambda/main.tf:8-27
	Calling File: /../../modules/baseline/schedule_alarms_lambda.tf:1-20
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-5

		8  | resource "aws_lambda_function" "alarm_scheduler" {
		9  |   filename         = "${path.module}/lambda/alarm_scheduler.zip"
		10 |   function_name    = var.lambda_function_name
		11 |   architectures    = ["arm64"]
		12 |   role             = aws_iam_role.lambda_exec.arn
		13 |   runtime          = "python3.12"
		14 |   handler          = "alarm_scheduler.lambda_handler"
		15 |   source_code_hash = data.archive_file.lambda_function_payload.output_base64sha256
		16 |   timeout          = 10
		17 | 
		18 |   environment {
		19 |     variables = {
		20 |       LOG_LEVEL       = var.lambda_log_level
		21 |       SPECIFIC_ALARMS = tostring(join(",", var.alarm_list))
		22 |       ALARM_PATTERNS  = tostring(join(",", var.alarm_patterns))
		23 |     }
		24 |   }
		25 | 
		26 |   tags = var.tags
		27 | }

Check: CKV_AWS_116: "Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)"
	FAILED for resource: module.baseline.module.schedule_alarms_lambda[0].aws_lambda_function.alarm_scheduler
	File: /../../modules/schedule_alarms_lambda/main.tf:8-27
	Calling File: /../../modules/baseline/schedule_alarms_lambda.tf:1-20
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-a-dead-letter-queue-dlq

		8  | resource "aws_lambda_function" "alarm_scheduler" {
		9  |   filename         = "${path.module}/lambda/alarm_scheduler.zip"
		10 |   function_name    = var.lambda_function_name
		11 |   architectures    = ["arm64"]
		12 |   role             = aws_iam_role.lambda_exec.arn
		13 |   runtime          = "python3.12"
		14 |   handler          = "alarm_scheduler.lambda_handler"
		15 |   source_code_hash = data.archive_file.lambda_function_payload.output_base64sha256
		16 |   timeout          = 10
		17 | 
		18 |   environment {
		19 |     variables = {
		20 |       LOG_LEVEL       = var.lambda_log_level
		21 |       SPECIFIC_ALARMS = tostring(join(",", var.alarm_list))
		22 |       ALARM_PATTERNS  = tostring(join(",", var.alarm_patterns))
		23 |     }
		24 |   }
		25 | 
		26 |   tags = var.tags
		27 | }

Check: CKV_AWS_50: "X-Ray tracing is enabled for Lambda"
	FAILED for resource: module.baseline.module.schedule_alarms_lambda[0].aws_lambda_function.alarm_scheduler
	File: /../../modules/schedule_alarms_lambda/main.tf:8-27
	Calling File: /../../modules/baseline/schedule_alarms_lambda.tf:1-20
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-4

		8  | resource "aws_lambda_function" "alarm_scheduler" {
		9  |   filename         = "${path.module}/lambda/alarm_scheduler.zip"
		10 |   function_name    = var.lambda_function_name
		11 |   architectures    = ["arm64"]
		12 |   role             = aws_iam_role.lambda_exec.arn
		13 |   runtime          = "python3.12"
		14 |   handler          = "alarm_scheduler.lambda_handler"
		15 |   source_code_hash = data.archive_file.lambda_function_payload.output_base64sha256
		16 |   timeout          = 10
		17 | 
		18 |   environment {
		19 |     variables = {
		20 |       LOG_LEVEL       = var.lambda_log_level
		21 |       SPECIFIC_ALARMS = tostring(join(",", var.alarm_list))
		22 |       ALARM_PATTERNS  = tostring(join(",", var.alarm_patterns))
		23 |     }
		24 |   }
		25 | 
		26 |   tags = var.tags
		27 | }

Check: CKV_AWS_272: "Ensure AWS Lambda function is configured to validate code-signing"
	FAILED for resource: module.baseline.module.schedule_alarms_lambda[0].aws_lambda_function.alarm_scheduler
	File: /../../modules/schedule_alarms_lambda/main.tf:8-27
	Calling File: /../../modules/baseline/schedule_alarms_lambda.tf:1-20
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-272

		8  | resource "aws_lambda_function" "alarm_scheduler" {
		9  |   filename         = "${path.module}/lambda/alarm_scheduler.zip"
		10 |   function_name    = var.lambda_function_name
		11 |   architectures    = ["arm64"]
		12 |   role             = aws_iam_role.lambda_exec.arn
		13 |   runtime          = "python3.12"
		14 |   handler          = "alarm_scheduler.lambda_handler"
		15 |   source_code_hash = data.archive_file.lambda_function_payload.output_base64sha256
		16 |   timeout          = 10
		17 | 
		18 |   environment {
		19 |     variables = {
		20 |       LOG_LEVEL       = var.lambda_log_level
		21 |       SPECIFIC_ALARMS = tostring(join(",", var.alarm_list))
		22 |       ALARM_PATTERNS  = tostring(join(",", var.alarm_patterns))
		23 |     }
		24 |   }
		25 | 
		26 |   tags = var.tags
		27 | }

Check: CKV_AWS_117: "Ensure that AWS Lambda function is configured inside a VPC"
	FAILED for resource: module.baseline.module.schedule_alarms_lambda[0].aws_lambda_function.alarm_scheduler
	File: /../../modules/schedule_alarms_lambda/main.tf:8-27
	Calling File: /../../modules/baseline/schedule_alarms_lambda.tf:1-20
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-inside-a-vpc-1

		8  | resource "aws_lambda_function" "alarm_scheduler" {
		9  |   filename         = "${path.module}/lambda/alarm_scheduler.zip"
		10 |   function_name    = var.lambda_function_name
		11 |   architectures    = ["arm64"]
		12 |   role             = aws_iam_role.lambda_exec.arn
		13 |   runtime          = "python3.12"
		14 |   handler          = "alarm_scheduler.lambda_handler"
		15 |   source_code_hash = data.archive_file.lambda_function_payload.output_base64sha256
		16 |   timeout          = 10
		17 | 
		18 |   environment {
		19 |     variables = {
		20 |       LOG_LEVEL       = var.lambda_log_level
		21 |       SPECIFIC_ALARMS = tostring(join(",", var.alarm_list))
		22 |       ALARM_PATTERNS  = tostring(join(",", var.alarm_patterns))
		23 |     }
		24 |   }
		25 | 
		26 |   tags = var.tags
		27 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: module.baseline.module.schedule_alarms_lambda[0].aws_cloudwatch_log_group.execution_logs
	File: /../../modules/schedule_alarms_lambda/main.tf:29-34
	Calling File: /../../modules/baseline/schedule_alarms_lambda.tf:1-20
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		29 | resource "aws_cloudwatch_log_group" "execution_logs" {
		30 |   name              = format("/aws/lambda/%s", var.lambda_function_name)
		31 |   retention_in_days = 7
		32 | 
		33 |   tags = var.tags
		34 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: module.baseline.module.schedule_alarms_lambda[0].aws_cloudwatch_log_group.execution_logs
	File: /../../modules/schedule_alarms_lambda/main.tf:29-34
	Calling File: /../../modules/baseline/schedule_alarms_lambda.tf:1-20
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		29 | resource "aws_cloudwatch_log_group" "execution_logs" {
		30 |   name              = format("/aws/lambda/%s", var.lambda_function_name)
		31 |   retention_in_days = 7
		32 | 
		33 |   tags = var.tags
		34 | }


checkov_exitcode=1

CTFLint Scan Success

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
terraform/environments/hmpps-domain-services

*****************************

Running tflint in terraform/environments/hmpps-domain-services
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=0

Trivy Scan Success

Show Output

*****************************

Trivy will check the following folders:
terraform/environments/hmpps-domain-services

*****************************

Running Trivy in terraform/environments/hmpps-domain-services
2024-11-25T12:30:34Z	INFO	[vulndb] Need to update DB
2024-11-25T12:30:34Z	INFO	[vulndb] Downloading vulnerability DB...
2024-11-25T12:30:34Z	INFO	[vulndb] Downloading artifact...	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2024-11-25T12:30:36Z	INFO	[vulndb] Artifact successfully downloaded	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2024-11-25T12:30:36Z	INFO	[vuln] Vulnerability scanning is enabled
2024-11-25T12:30:36Z	INFO	[misconfig] Misconfiguration scanning is enabled
2024-11-25T12:30:36Z	INFO	[misconfig] Need to update the built-in checks
2024-11-25T12:30:36Z	INFO	[misconfig] Downloading the built-in checks...
2024-11-25T12:30:36Z	ERROR	[misconfig] Falling back to embedded checks	err="failed to download built-in policies: download error: oci download error: failed to fetch the layer: GET https://ghcr.io/v2/aquasecurity/trivy-checks/blobs/sha256:16442a4593a0395452e678ef699a880eec94d9211dfc887d52574beb78b95030: TOOMANYREQUESTS: retry-after: 439.822µs, allowed: 44000/minute"
2024-11-25T12:30:36Z	INFO	[secret] Secret scanning is enabled
2024-11-25T12:30:36Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-11-25T12:30:36Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2024-11-25T12:30:37Z	INFO	[terraform scanner] Scanning root module	file_path="."
2024-11-25T12:30:37Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="networking"
2024-11-25T12:30:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.aws_backup_plan.this" value="cty.NilVal"
2024-11-25T12:30:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.aws_backup_selection.this" value="cty.NilVal"
2024-11-25T12:30:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.aws_cloudwatch_log_group.route53" value="cty.NilVal"
2024-11-25T12:30:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.aws_cloudwatch_log_group.this" value="cty.NilVal"
2024-11-25T12:30:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.aws_cloudwatch_log_metric_filter.this" value="cty.NilVal"
2024-11-25T12:30:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.aws_cloudwatch_metric_alarm.this" value="cty.NilVal"
2024-11-25T12:30:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.aws_iam_policy.this" value="cty.NilVal"
2024-11-25T12:30:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.aws_iam_role.this" value="cty.NilVal"
2024-11-25T12:30:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.aws_iam_role_policy_attachment.this" value="cty.NilVal"
2024-11-25T12:30:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.aws_iam_service_linked_role.this" value="cty.NilVal"
2024-11-25T12:30:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.aws_key_pair.this" value="cty.NilVal"
2024-11-25T12:30:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.aws_kms_grant.this" value="cty.NilVal"
2024-11-25T12:30:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.aws_lb_target_group.instance" value="cty.NilVal"
2024-11-25T12:30:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.aws_lb_target_group_attachment.instance" value="cty.NilVal"
2024-11-25T12:30:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.aws_oam_link.this" value="cty.NilVal"
2024-11-25T12:30:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.aws_oam_sink.this" value="cty.NilVal"
2024-11-25T12:30:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.aws_oam_sink_policy.monitoring_account_oam_sink_policy" value="cty.NilVal"
2024-11-25T12:30:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.aws_route53_query_log.this" value="cty.NilVal"
2024-11-25T12:30:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.aws_route53_record.core_network_services" value="cty.NilVal"
2024-11-25T12:30:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.aws_route53_record.core_vpc" value="cty.NilVal"
2024-11-25T12:30:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.aws_route53_record.self" value="cty.NilVal"
2024-11-25T12:30:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.aws_route53_resolver_endpoint.this" value="cty.NilVal"
2024-11-25T12:30:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.aws_route53_resolver_rule.this" value="cty.NilVal"
2024-11-25T12:30:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.aws_route53_resolver_rule_association.this" value="cty.NilVal"
2024-11-25T12:30:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.aws_route53_zone.this" value="cty.NilVal"
2024-11-25T12:30:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.aws_secretsmanager_secret.this" value="cty.NilVal"
2024-11-25T12:30:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.aws_secretsmanager_secret_version.fixed" value="cty.NilVal"
2024-11-25T12:30:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.aws_security_group.this" value="cty.NilVal"
2024-11-25T12:30:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.aws_security_group_rule.route53_resolver" value="cty.NilVal"
2024-11-25T12:30:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.aws_security_group_rule.this" value="cty.NilVal"
2024-11-25T12:30:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.aws_sns_topic.this" value="cty.NilVal"
2024-11-25T12:30:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.aws_sns_topic_subscription.this" value="cty.NilVal"
2024-11-25T12:30:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.aws_ssm_association.this" value="cty.NilVal"
2024-11-25T12:30:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.aws_ssm_document.this" value="cty.NilVal"
2024-11-25T12:30:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.aws_ssm_parameter.fixed" value="cty.NilVal"
2024-11-25T12:30:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.aws_ssm_parameter.placeholder" value="cty.NilVal"
2024-11-25T12:30:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.data.aws_iam_policy_document.assume_role" value="cty.NilVal"
2024-11-25T12:30:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.data.aws_iam_policy_document.secretsmanager_secret_policy" value="cty.NilVal"
2024-11-25T12:30:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.data.aws_iam_policy_document.this" value="cty.NilVal"
2024-11-25T12:30:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.module.acm_certificate" value="cty.NilVal"
2024-11-25T12:30:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.module.cloudwatch_dashboard" value="cty.NilVal"
2024-11-25T12:30:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.module.ec2_autoscaling_group" value="cty.NilVal"
2024-11-25T12:30:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.module.ec2_instance" value="cty.NilVal"
2024-11-25T12:30:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.module.efs" value="cty.NilVal"
2024-11-25T12:30:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.module.fsx_windows" value="cty.NilVal"
2024-11-25T12:30:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.module.lb" value="cty.NilVal"
2024-11-25T12:30:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.module.lb_listener" value="cty.NilVal"
2024-11-25T12:30:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.module.s3_bucket" value="cty.NilVal"
2024-11-25T12:30:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.random_password.secrets" value="cty.NilVal"
2024-11-25T12:30:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.random_password.this" value="cty.NilVal"
2024-11-25T12:30:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.module.bastion_linux[0].aws_s3_object.user_public_keys" value="cty.NilVal"
2024-11-25T12:30:37Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.module.bastion_linux[0].data.aws_subnet.local_account" value="cty.NilVal"
2024-11-25T12:30:37Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.baseline.module.bastion_linux[0].aws_autoscaling_group.bastion_linux_daily" err="1 error occurred:\n\t* invalid for-each in aws_autoscaling_group.bastion_linux_daily.dynamic.tag block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T12:30:37Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.baseline.module.bastion_linux[0].aws_autoscaling_group.bastion_linux_daily" err="1 error occurred:\n\t* invalid for-each in aws_autoscaling_group.bastion_linux_daily.dynamic.tag block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T12:30:38Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.baseline.module.bastion_linux[0].module.s3-bucket.aws_s3_bucket_lifecycle_configuration.default" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_lifecycle_configuration.default.dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T12:30:38Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.baseline.module.bastion_linux[0].module.s3-bucket.aws_s3_bucket_lifecycle_configuration.default" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_lifecycle_configuration.default.dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T12:30:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.module.schedule_alarms_lambda[0].aws_cloudwatch_event_rule.alarm_scheduler" value="cty.NilVal"
2024-11-25T12:30:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.module.schedule_alarms_lambda[0].aws_cloudwatch_event_target.alarm_scheduler" value="cty.NilVal"
2024-11-25T12:30:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.module.schedule_alarms_lambda[0].aws_lambda_permission.allow_cloudwatch" value="cty.NilVal"
2024-11-25T12:30:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.environment.data.aws_route53_zone.core_network_services" value="cty.NilVal"
2024-11-25T12:30:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.environment.data.aws_route53_zone.core_vpc" value="cty.NilVal"
2024-11-25T12:30:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.environment.data.aws_subnet.this" value="cty.NilVal"
2024-11-25T12:30:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.environment.data.aws_subnets.this" value="cty.NilVal"
2024-11-25T12:30:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.module.bastion_linux[0].aws_s3_object.user_public_keys" value="cty.NilVal"
2024-11-25T12:30:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.module.bastion_linux[0].data.aws_subnet.local_account" value="cty.NilVal"
2024-11-25T12:30:38Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.baseline.module.bastion_linux[0].aws_autoscaling_group.bastion_linux_daily" err="1 error occurred:\n\t* invalid for-each in aws_autoscaling_group.bastion_linux_daily.dynamic.tag block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T12:30:38Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.baseline.module.bastion_linux[0].aws_autoscaling_group.bastion_linux_daily" err="1 error occurred:\n\t* invalid for-each in aws_autoscaling_group.bastion_linux_daily.dynamic.tag block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T12:30:38Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.baseline.module.bastion_linux[0].module.s3-bucket.aws_s3_bucket_lifecycle_configuration.default" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_lifecycle_configuration.default.dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T12:30:38Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.baseline.module.bastion_linux[0].module.s3-bucket.aws_s3_bucket_lifecycle_configuration.default" err="1 error occurred:\n\t* invalid for-each in aws_s3_bucket_lifecycle_configuration.default.dynamic.rule block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2024-11-25T12:30:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.module.schedule_alarms_lambda[0].aws_cloudwatch_event_rule.alarm_scheduler" value="cty.NilVal"
2024-11-25T12:30:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.module.schedule_alarms_lambda[0].aws_cloudwatch_event_target.alarm_scheduler" value="cty.NilVal"
2024-11-25T12:30:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.baseline.module.schedule_alarms_lambda[0].aws_lambda_permission.allow_cloudwatch" value="cty.NilVal"
2024-11-25T12:30:39Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-bastion-linux?ref=836db079348a2b40d59bd9cb953111e8ad61aec1/github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=7b2b75c178f855d8c48d3bda4ac53df782288c02/main.tf:141-151"
2024-11-25T12:30:39Z	INFO	[terraform executor] Ignore finding	rule="aws-s3-encryption-customer-key" range="github.com/ministryofjustice/modernisation-platform-terraform-s3-bucket?ref=v8.1.0/main.tf:150-160"
2024-11-25T12:30:39Z	INFO	Number of language-specific files	num=0
2024-11-25T12:30:39Z	INFO	Detected config files	num=4
trivy_exitcode=0