Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[DPR2-1576] S3 bucket expiration override #9228

Merged
merged 4 commits into from
Jan 6, 2025
Merged

[DPR2-1576] S3 bucket expiration override #9228

merged 4 commits into from
Jan 6, 2025

Conversation

stalwartstu
Copy link
Contributor

No description provided.

@stalwartstu stalwartstu requested review from a team as code owners January 6, 2025 14:06
@github-actions github-actions bot added the environments-repository Used to exclude PRs from this repo in our Slack PR update label Jan 6, 2025
@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Jan 6, 2025

Trivy Scan Success

Show Output ```hcl

Trivy will check the following folders:
terraform/environments/digital-prison-reporting
terraform/environments/digital-prison-reporting/modules/s3_bucket

Running Trivy in terraform/environments/digital-prison-reporting
2025-01-06T14:08:53Z INFO [vulndb] Need to update DB
2025-01-06T14:08:53Z INFO [vulndb] Downloading vulnerability DB...
2025-01-06T14:08:53Z INFO [vulndb] Downloading artifact... repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-06T14:08:55Z INFO [vulndb] Artifact successfully downloaded repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-06T14:08:55Z INFO [vuln] Vulnerability scanning is enabled
2025-01-06T14:08:55Z INFO [misconfig] Misconfiguration scanning is enabled
2025-01-06T14:08:55Z INFO [misconfig] Need to update the built-in checks
2025-01-06T14:08:55Z INFO [misconfig] Downloading the built-in checks...
160.80 KiB / 160.80 KiB [---------------------------------------------------------] 100.00% ? p/s 0s2025-01-06T14:08:56Z INFO [secret] Secret scanning is enabled
2025-01-06T14:08:56Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-06T14:08:56Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-06T14:08:58Z INFO [terraform scanner] Scanning root module file_path="."
2025-01-06T14:08:58Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="networking"
2025-01-06T14:08:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_glue_connection.glue_dps_connection" value="cty.NilVal"
2025-01-06T14:08:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_iam_role_policy_attachment.redshift_spectrum" value="cty.NilVal"
2025-01-06T14:08:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_secretsmanager_secret.dps" value="cty.NilVal"
2025-01-06T14:08:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_secretsmanager_secret_version.dps" value="cty.NilVal"
2025-01-06T14:08:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="data.aws_secretsmanager_secret.dps" value="cty.NilVal"
2025-01-06T14:08:58Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="data.aws_secretsmanager_secret_version.dps" value="cty.NilVal"
2025-01-06T14:09:00Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.aws_s3_data_migrate.aws_iam_role_policy_attachment.this" value="cty.NilVal"
2025-01-06T14:09:00Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.datamart.aws_redshift_authentication_profile.this" value="cty.NilVal"
2025-01-06T14:09:00Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.datamart.aws_redshift_scheduled_action.this" value="cty.NilVal"
2025-01-06T14:09:00Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.datamart.aws_redshift_usage_limit.this" value="cty.NilVal"
2025-01-06T14:09:00Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datamart.aws_redshift_cluster.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_redshift_cluster.this[0].dynamic.logging block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-06T14:09:00Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datamart.aws_redshift_cluster.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_redshift_cluster.this[0].dynamic.logging block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-06T14:09:00Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.domain_builder_backend_Lambda.aws_iam_role_policy_attachment.this" value="cty.NilVal"
2025-01-06T14:09:00Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.domain_builder_cli_agent.aws_iam_role_policy_attachment.this" value="cty.NilVal"
2025-01-06T14:09:00Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.domain_builder_cli_agent.aws_security_group_rule.ingress_traffic" value="cty.NilVal"
2025-01-06T14:09:00Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.domain_builder_cli_agent.aws_autoscaling_group.bastion_linux_daily[0]" err="1 error occurred:\n\t* invalid for-each in aws_autoscaling_group.bastion_linux_daily[0].dynamic.tag block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-06T14:09:00Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.domain_builder_cli_agent.aws_autoscaling_group.bastion_linux_daily[0]" err="1 error occurred:\n\t* invalid for-each in aws_autoscaling_group.bastion_linux_daily[0].dynamic.tag block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-06T14:09:00Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.domain_builder_flyway_Lambda.aws_iam_role_policy_attachment.this" value="cty.NilVal"
2025-01-06T14:09:01Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.ec2_kinesis_agent.aws_security_group_rule.ingress_traffic_from_security_groups" value="cty.NilVal"
2025-01-06T14:09:01Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.ec2_kinesis_agent.aws_autoscaling_group.bastion_linux_daily" err="1 error occurred:\n\t* invalid for-each in aws_autoscaling_group.bastion_linux_daily.dynamic.tag block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-06T14:09:01Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.ec2_kinesis_agent.aws_autoscaling_group.bastion_linux_daily" err="1 error occurred:\n\t* invalid for-each in aws_autoscaling_group.bastion_linux_daily.dynamic.tag block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-06T14:09:01Z INFO [terraform scanner] Scanning root module file_path="modules/domains/dms-endpoints"
2025-01-06T14:09:01Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="bucket_name, env, project_id, source_app_password, source_app_username"
2025-01-06T14:09:01Z INFO [terraform scanner] Scanning root module file_path="modules/domains/dms-instance"
2025-01-06T14:09:01Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="env, name, project_id"
2025-01-06T14:09:01Z INFO [terraform scanner] Scanning root module file_path="modules/domains/dms-task"
2025-01-06T14:09:01Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="env, project_id"
2025-01-06T14:09:01Z INFO [terraform scanner] Scanning root module file_path="modules/domains/ingestion-jobs"
2025-01-06T14:09:01Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="env, glue_cdc_maintenance_window, jar_version, project_id, script_version"
2025-01-06T14:09:01Z INFO [terraform scanner] Scanning root module file_path="modules/domains/ingestion-pipeline"
2025-01-06T14:09:01Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="archive_job_trigger_name, data_ingestion_pipeline, dms_replication_task_arn, domain, glue_archive_job, glue_hive_table_creation_jobname, glue_maintenance_compaction_job, glue_maintenance_retention_job, glue_reporting_hub_batch_jobname, glue_reporting_hub_cdc_jobname, glue_s3_data_deletion_job, glue_s3_file_transfer_job, glue_s3_max_attempts, glue_s3_retry_max_wait_millis, glue_s3_retry_min_wait_millis, glue_stop_glue_instance_job, glue_switch_prisons_hive_data_location_job, glue_trigger_activation_job, pipeline_notification_lambda_function, replication_task_id, s3_curated_bucket_id, s3_curated_path, s3_glue_bucket_id, s3_raw_archive_bucket_id, s3_raw_bucket_id, s3_structured_bucket_id, s3_structured_path, s3_temp_reload_bucket_id, step_function_execution_role_arn, stop_dms_task_job"
2025-01-06T14:09:01Z INFO [terraform scanner] Scanning root module file_path="modules/domains/maintenance-pipeline"
2025-01-06T14:09:01Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="dms_replication_task_arn, domain, glue_maintenance_compaction_job, glue_maintenance_retention_job, glue_reporting_hub_cdc_jobname, glue_s3_max_attempts, glue_s3_retry_max_wait_millis, glue_s3_retry_min_wait_millis, glue_stop_glue_instance_job, glue_unprocessed_raw_files_check_job, maintenance_pipeline_name, processed_files_check_max_attempts, processed_files_check_wait_interval_seconds, replication_task_id, s3_curated_path, s3_glue_bucket_id, s3_structured_path, step_function_execution_role_arn, stop_dms_task_job"
2025-01-06T14:09:01Z INFO [terraform scanner] Scanning root module file_path="modules/domains/pipeline-lambda"
2025-01-06T14:09:01Z INFO [terraform scanner] Scanning root module file_path="modules/domains/reload-pipeline"
2025-01-06T14:09:01Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="archive_job_trigger_name, dms_replication_task_arn, domain, glue_archive_job, glue_create_reload_diff_job, glue_hive_table_creation_jobname, glue_maintenance_compaction_job, glue_maintenance_retention_job, glue_reporting_hub_batch_jobname, glue_reporting_hub_cdc_jobname, glue_s3_data_deletion_job, glue_s3_file_transfer_job, glue_s3_max_attempts, glue_s3_retry_max_wait_millis, glue_s3_retry_min_wait_millis, glue_stop_glue_instance_job, glue_switch_prisons_hive_data_location_job, glue_trigger_activation_job, glue_unprocessed_raw_files_check_job, pipeline_notification_lambda_function, processed_files_check_max_attempts, processed_files_check_wait_interval_seconds, reload_pipeline, replication_task_id, s3_curated_bucket_id, s3_curated_path, s3_glue_bucket_id, s3_raw_archive_bucket_id, s3_raw_bucket_id, s3_structured_bucket_id, s3_structured_path, s3_temp_reload_bucket_id, step_function_execution_role_arn, stop_dms_task_job"
2025-01-06T14:09:01Z INFO [terraform scanner] Scanning root module file_path="modules/domains/replay-pipeline"
2025-01-06T14:09:01Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="dms_replication_task_arn, glue_maintenance_compaction_job, glue_maintenance_retention_job, glue_s3_max_attempts, glue_s3_retry_max_wait_millis, glue_s3_retry_min_wait_millis, processed_files_check_max_attempts, processed_files_check_wait_interval_seconds, replication_task_id, s3_curated_path, s3_structured_path, step_function_execution_role_arn"
2025-01-06T14:09:01Z INFO [terraform scanner] Scanning root module file_path="modules/domains/start-cdc-pipeline"
2025-01-06T14:09:01Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="dms_replication_task_arn, domain, glue_reporting_hub_cdc_jobname, glue_stop_glue_instance_job, replication_task_id, s3_glue_bucket_id, start_cdc_pipeline, step_function_execution_role_arn, stop_dms_task_job"
2025-01-06T14:09:01Z INFO [terraform scanner] Scanning root module file_path="modules/domains/stop-cdc-pipeline"
2025-01-06T14:09:01Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="glue_reporting_hub_cdc_jobname, glue_stop_glue_instance_job, glue_unprocessed_raw_files_check_job, processed_files_check_max_attempts, processed_files_check_wait_interval_seconds, replication_task_id, step_function_execution_role_arn, stop_cdc_pipeline, stop_dms_task_job"
2025-01-06T14:09:01Z INFO [terraform scanner] Scanning root module file_path="modules/glue_connection"
2025-01-06T14:09:01Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="availability_zone, connection_url, description, name, password, security_groups, subnet, username"
2025-01-06T14:09:01Z INFO [terraform scanner] Scanning root module file_path="modules/pipeline_trigger"
2025-01-06T14:09:01Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="description, pipeline_name, schedule_expression, state_machine_arn, step_function_execution_role_arn"
2025-01-06T14:09:03Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-public-egress-sgr" range="modules/ec2/main.tf:72"
2025-01-06T14:09:04Z INFO Number of language-specific files num=0
2025-01-06T14:09:04Z INFO Detected config files num=32
trivy_exitcode=0

Running Trivy in terraform/environments/digital-prison-reporting/modules/s3_bucket
2025-01-06T14:09:04Z INFO [vuln] Vulnerability scanning is enabled
2025-01-06T14:09:04Z INFO [misconfig] Misconfiguration scanning is enabled
2025-01-06T14:09:04Z INFO [secret] Secret scanning is enabled
2025-01-06T14:09:04Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-06T14:09:04Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-06T14:09:05Z INFO [terraform scanner] Scanning root module file_path="."
2025-01-06T14:09:05Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="tags"
2025-01-06T14:09:05Z INFO Number of language-specific files num=0
2025-01-06T14:09:05Z INFO Detected config files num=1
trivy_exitcode=0

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/digital-prison-reporting
terraform/environments/digital-prison-reporting/modules/s3_bucket

*****************************

Running Checkov in terraform/environments/digital-prison-reporting
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2025-01-06 14:09:07,769 [MainThread  ] [WARNI]  Failed to download module ministryofjustice/observability-platform-tenant/aws:1.2.0 (for external modules, the --download-external-modules flag is required)
2025-01-06 14:09:07,769 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-pagerduty-integration?ref=v2.0.0:None (for external modules, the --download-external-modules flag is required)
2025-01-06 14:09:38,626 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:09:38,637 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:09:38,649 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:09:38,661 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:09:38,673 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:09:38,683 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:09:38,693 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:09:38,703 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:09:38,714 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:09:38,723 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:09:38,734 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:09:38,745 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:09:38,756 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:09:38,766 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:09:38,792 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:09:38,803 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:09:38,815 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:09:38,826 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:09:38,838 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:09:40,594 [MainThread  ] [ERROR]  Failed to invoke function /usr/local/lib/python3.9/dist-packages/checkov/common/runners/runner_registry._parallel_run with (<checkov.terraform.runner.Runner object at 0x7fe1f2704be0>, '/github/workspace/terraform/environments/digital-prison-reporting', None, None, <checkov.runner_filter.RunnerFilter object at 0x7fe1f26d0910>, True, None)
Traceback (most recent call last):
  File "/usr/local/lib/python3.9/dist-packages/checkov/common/parallelizer/parallel_runner.py", line 72, in func_wrapper
    result = original_func(*item)
  File "/usr/local/lib/python3.9/dist-packages/checkov/common/runners/runner_registry.py", line 836, in _parallel_run
    report = runner.run(
  File "/usr/local/lib/python3.9/dist-packages/checkov/terraform/runner.py", line 134, in run
    self.check_tf_definition(report, root_folder, runner_filter, collect_skip_comments)
  File "/usr/local/lib/python3.9/dist-packages/checkov/terraform/runner.py", line 228, in check_tf_definition
    self.push_skipped_checks_down_from_modules(self.context)
  File "/usr/local/lib/python3.9/dist-packages/checkov/terraform/runner.py", line 254, in push_skipped_checks_down_from_modules
    self.push_skipped_checks_down(definition_context, skipped_checks, resolved_paths)
  File "/usr/local/lib/python3.9/dist-packages/checkov/terraform/runner.py", line 293, in push_skipped_checks_down
    resource_config["skipped_checks"] += skipped_checks
TypeError: 'int' object is not subscriptable

checkov_exitcode=0

*****************************

Running Checkov in terraform/environments/digital-prison-reporting/modules/s3_bucket
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
terraform scan results:

Passed checks: 12, Failed checks: 1, Skipped checks: 4

Check: CKV_AWS_300: "Ensure S3 lifecycle configuration sets period for aborting failed uploads"
	FAILED for resource: aws_s3_bucket_lifecycle_configuration.lifecycle[0]
	File: /main.tf:34-122
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-300

		Code lines for this resource are too many. Please use IDE of your choice to review the file.

checkov_exitcode=1

CTFLint Scan Failed

Show Output 
*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
terraform/environments/digital-prison-reporting
terraform/environments/digital-prison-reporting/modules/s3_bucket

*****************************

Running tflint in terraform/environments/digital-prison-reporting
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=0

*****************************

Running tflint in terraform/environments/digital-prison-reporting/modules/s3_bucket
Excluding the following checks: terraform_unused_declarations
11 issue(s) found:

Warning: `name` variable has no type (terraform_typed_variables)

  on terraform/environments/digital-prison-reporting/modules/s3_bucket/variables.tf line 2:
   2: variable "name" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_typed_variables.md

Warning: `s3_notification_name` variable has no type (terraform_typed_variables)

  on terraform/environments/digital-prison-reporting/modules/s3_bucket/variables.tf line 25:
  25: variable "s3_notification_name" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_typed_variables.md

Warning: `create_s3` variable has no type (terraform_typed_variables)

  on terraform/environments/digital-prison-reporting/modules/s3_bucket/variables.tf line 30:
  30: variable "create_s3" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_typed_variables.md

Warning: `create_notification_queue` variable has no type (terraform_typed_variables)

  on terraform/environments/digital-prison-reporting/modules/s3_bucket/variables.tf line 41:
  41: variable "create_notification_queue" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_typed_variables.md

Warning: `sqs_msg_retention_seconds` variable has no type (terraform_typed_variables)

  on terraform/environments/digital-prison-reporting/modules/s3_bucket/variables.tf line 46:
  46: variable "sqs_msg_retention_seconds" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_typed_variables.md

Warning: `filter_prefix` variable has no type (terraform_typed_variables)

  on terraform/environments/digital-prison-reporting/modules/s3_bucket/variables.tf line 51:
  51: variable "filter_prefix" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_typed_variables.md

Warning: `enable_lifecycle` variable has no type (terraform_typed_variables)

  on terraform/environments/digital-prison-reporting/modules/s3_bucket/variables.tf line 56:
  56: variable "enable_lifecycle" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_typed_variables.md

Warning: `enable_versioning_config` variable has no type (terraform_typed_variables)

  on terraform/environments/digital-prison-reporting/modules/s3_bucket/variables.tf line 61:
  61: variable "enable_versioning_config" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_typed_variables.md

Warning: `enable_s3_versioning` variable has no type (terraform_typed_variables)

  on terraform/environments/digital-prison-reporting/modules/s3_bucket/variables.tf line 66:
  66: variable "enable_s3_versioning" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_typed_variables.md

Warning: `enable_notification` variable has no type (terraform_typed_variables)

  on terraform/environments/digital-prison-reporting/modules/s3_bucket/variables.tf line 71:
  71: variable "enable_notification" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_typed_variables.md

Warning: `bucket_key` variable has no type (terraform_typed_variables)

  on terraform/environments/digital-prison-reporting/modules/s3_bucket/variables.tf line 98:
  98: variable "bucket_key" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_typed_variables.md

tflint_exitcode=2

Trivy Scan Success

Show Output 
*****************************

Trivy will check the following folders:
terraform/environments/digital-prison-reporting
terraform/environments/digital-prison-reporting/modules/s3_bucket

*****************************

Running Trivy in terraform/environments/digital-prison-reporting
2025-01-06T14:08:53Z	INFO	[vulndb] Need to update DB
2025-01-06T14:08:53Z	INFO	[vulndb] Downloading vulnerability DB...
2025-01-06T14:08:53Z	INFO	[vulndb] Downloading artifact...	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-06T14:08:55Z	INFO	[vulndb] Artifact successfully downloaded	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-06T14:08:55Z	INFO	[vuln] Vulnerability scanning is enabled
2025-01-06T14:08:55Z	INFO	[misconfig] Misconfiguration scanning is enabled
2025-01-06T14:08:55Z	INFO	[misconfig] Need to update the built-in checks
2025-01-06T14:08:55Z	INFO	[misconfig] Downloading the built-in checks...
160.80 KiB / 160.80 KiB [---------------------------------------------------------] 100.00% ? p/s 0s2025-01-06T14:08:56Z	INFO	[secret] Secret scanning is enabled
2025-01-06T14:08:56Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-06T14:08:56Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-06T14:08:58Z	INFO	[terraform scanner] Scanning root module	file_path="."
2025-01-06T14:08:58Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="networking"
2025-01-06T14:08:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_glue_connection.glue_dps_connection" value="cty.NilVal"
2025-01-06T14:08:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_iam_role_policy_attachment.redshift_spectrum" value="cty.NilVal"
2025-01-06T14:08:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_secretsmanager_secret.dps" value="cty.NilVal"
2025-01-06T14:08:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_secretsmanager_secret_version.dps" value="cty.NilVal"
2025-01-06T14:08:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="data.aws_secretsmanager_secret.dps" value="cty.NilVal"
2025-01-06T14:08:58Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="data.aws_secretsmanager_secret_version.dps" value="cty.NilVal"
2025-01-06T14:09:00Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.aws_s3_data_migrate.aws_iam_role_policy_attachment.this" value="cty.NilVal"
2025-01-06T14:09:00Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.datamart.aws_redshift_authentication_profile.this" value="cty.NilVal"
2025-01-06T14:09:00Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.datamart.aws_redshift_scheduled_action.this" value="cty.NilVal"
2025-01-06T14:09:00Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.datamart.aws_redshift_usage_limit.this" value="cty.NilVal"
2025-01-06T14:09:00Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datamart.aws_redshift_cluster.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_redshift_cluster.this[0].dynamic.logging block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-06T14:09:00Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datamart.aws_redshift_cluster.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_redshift_cluster.this[0].dynamic.logging block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-06T14:09:00Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.domain_builder_backend_Lambda.aws_iam_role_policy_attachment.this" value="cty.NilVal"
2025-01-06T14:09:00Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.domain_builder_cli_agent.aws_iam_role_policy_attachment.this" value="cty.NilVal"
2025-01-06T14:09:00Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.domain_builder_cli_agent.aws_security_group_rule.ingress_traffic" value="cty.NilVal"
2025-01-06T14:09:00Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.domain_builder_cli_agent.aws_autoscaling_group.bastion_linux_daily[0]" err="1 error occurred:\n\t* invalid for-each in aws_autoscaling_group.bastion_linux_daily[0].dynamic.tag block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-06T14:09:00Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.domain_builder_cli_agent.aws_autoscaling_group.bastion_linux_daily[0]" err="1 error occurred:\n\t* invalid for-each in aws_autoscaling_group.bastion_linux_daily[0].dynamic.tag block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-06T14:09:00Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.domain_builder_flyway_Lambda.aws_iam_role_policy_attachment.this" value="cty.NilVal"
2025-01-06T14:09:01Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.ec2_kinesis_agent.aws_security_group_rule.ingress_traffic_from_security_groups" value="cty.NilVal"
2025-01-06T14:09:01Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.ec2_kinesis_agent.aws_autoscaling_group.bastion_linux_daily" err="1 error occurred:\n\t* invalid for-each in aws_autoscaling_group.bastion_linux_daily.dynamic.tag block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-06T14:09:01Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.ec2_kinesis_agent.aws_autoscaling_group.bastion_linux_daily" err="1 error occurred:\n\t* invalid for-each in aws_autoscaling_group.bastion_linux_daily.dynamic.tag block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-06T14:09:01Z	INFO	[terraform scanner] Scanning root module	file_path="modules/domains/dms-endpoints"
2025-01-06T14:09:01Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="bucket_name, env, project_id, source_app_password, source_app_username"
2025-01-06T14:09:01Z	INFO	[terraform scanner] Scanning root module	file_path="modules/domains/dms-instance"
2025-01-06T14:09:01Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="env, name, project_id"
2025-01-06T14:09:01Z	INFO	[terraform scanner] Scanning root module	file_path="modules/domains/dms-task"
2025-01-06T14:09:01Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="env, project_id"
2025-01-06T14:09:01Z	INFO	[terraform scanner] Scanning root module	file_path="modules/domains/ingestion-jobs"
2025-01-06T14:09:01Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="env, glue_cdc_maintenance_window, jar_version, project_id, script_version"
2025-01-06T14:09:01Z	INFO	[terraform scanner] Scanning root module	file_path="modules/domains/ingestion-pipeline"
2025-01-06T14:09:01Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="archive_job_trigger_name, data_ingestion_pipeline, dms_replication_task_arn, domain, glue_archive_job, glue_hive_table_creation_jobname, glue_maintenance_compaction_job, glue_maintenance_retention_job, glue_reporting_hub_batch_jobname, glue_reporting_hub_cdc_jobname, glue_s3_data_deletion_job, glue_s3_file_transfer_job, glue_s3_max_attempts, glue_s3_retry_max_wait_millis, glue_s3_retry_min_wait_millis, glue_stop_glue_instance_job, glue_switch_prisons_hive_data_location_job, glue_trigger_activation_job, pipeline_notification_lambda_function, replication_task_id, s3_curated_bucket_id, s3_curated_path, s3_glue_bucket_id, s3_raw_archive_bucket_id, s3_raw_bucket_id, s3_structured_bucket_id, s3_structured_path, s3_temp_reload_bucket_id, step_function_execution_role_arn, stop_dms_task_job"
2025-01-06T14:09:01Z	INFO	[terraform scanner] Scanning root module	file_path="modules/domains/maintenance-pipeline"
2025-01-06T14:09:01Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="dms_replication_task_arn, domain, glue_maintenance_compaction_job, glue_maintenance_retention_job, glue_reporting_hub_cdc_jobname, glue_s3_max_attempts, glue_s3_retry_max_wait_millis, glue_s3_retry_min_wait_millis, glue_stop_glue_instance_job, glue_unprocessed_raw_files_check_job, maintenance_pipeline_name, processed_files_check_max_attempts, processed_files_check_wait_interval_seconds, replication_task_id, s3_curated_path, s3_glue_bucket_id, s3_structured_path, step_function_execution_role_arn, stop_dms_task_job"
2025-01-06T14:09:01Z	INFO	[terraform scanner] Scanning root module	file_path="modules/domains/pipeline-lambda"
2025-01-06T14:09:01Z	INFO	[terraform scanner] Scanning root module	file_path="modules/domains/reload-pipeline"
2025-01-06T14:09:01Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="archive_job_trigger_name, dms_replication_task_arn, domain, glue_archive_job, glue_create_reload_diff_job, glue_hive_table_creation_jobname, glue_maintenance_compaction_job, glue_maintenance_retention_job, glue_reporting_hub_batch_jobname, glue_reporting_hub_cdc_jobname, glue_s3_data_deletion_job, glue_s3_file_transfer_job, glue_s3_max_attempts, glue_s3_retry_max_wait_millis, glue_s3_retry_min_wait_millis, glue_stop_glue_instance_job, glue_switch_prisons_hive_data_location_job, glue_trigger_activation_job, glue_unprocessed_raw_files_check_job, pipeline_notification_lambda_function, processed_files_check_max_attempts, processed_files_check_wait_interval_seconds, reload_pipeline, replication_task_id, s3_curated_bucket_id, s3_curated_path, s3_glue_bucket_id, s3_raw_archive_bucket_id, s3_raw_bucket_id, s3_structured_bucket_id, s3_structured_path, s3_temp_reload_bucket_id, step_function_execution_role_arn, stop_dms_task_job"
2025-01-06T14:09:01Z	INFO	[terraform scanner] Scanning root module	file_path="modules/domains/replay-pipeline"
2025-01-06T14:09:01Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="dms_replication_task_arn, glue_maintenance_compaction_job, glue_maintenance_retention_job, glue_s3_max_attempts, glue_s3_retry_max_wait_millis, glue_s3_retry_min_wait_millis, processed_files_check_max_attempts, processed_files_check_wait_interval_seconds, replication_task_id, s3_curated_path, s3_structured_path, step_function_execution_role_arn"
2025-01-06T14:09:01Z	INFO	[terraform scanner] Scanning root module	file_path="modules/domains/start-cdc-pipeline"
2025-01-06T14:09:01Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="dms_replication_task_arn, domain, glue_reporting_hub_cdc_jobname, glue_stop_glue_instance_job, replication_task_id, s3_glue_bucket_id, start_cdc_pipeline, step_function_execution_role_arn, stop_dms_task_job"
2025-01-06T14:09:01Z	INFO	[terraform scanner] Scanning root module	file_path="modules/domains/stop-cdc-pipeline"
2025-01-06T14:09:01Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="glue_reporting_hub_cdc_jobname, glue_stop_glue_instance_job, glue_unprocessed_raw_files_check_job, processed_files_check_max_attempts, processed_files_check_wait_interval_seconds, replication_task_id, step_function_execution_role_arn, stop_cdc_pipeline, stop_dms_task_job"
2025-01-06T14:09:01Z	INFO	[terraform scanner] Scanning root module	file_path="modules/glue_connection"
2025-01-06T14:09:01Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="availability_zone, connection_url, description, name, password, security_groups, subnet, username"
2025-01-06T14:09:01Z	INFO	[terraform scanner] Scanning root module	file_path="modules/pipeline_trigger"
2025-01-06T14:09:01Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="description, pipeline_name, schedule_expression, state_machine_arn, step_function_execution_role_arn"
2025-01-06T14:09:03Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-public-egress-sgr" range="modules/ec2/main.tf:72"
2025-01-06T14:09:04Z	INFO	Number of language-specific files	num=0
2025-01-06T14:09:04Z	INFO	Detected config files	num=32
trivy_exitcode=0

*****************************

Running Trivy in terraform/environments/digital-prison-reporting/modules/s3_bucket
2025-01-06T14:09:04Z	INFO	[vuln] Vulnerability scanning is enabled
2025-01-06T14:09:04Z	INFO	[misconfig] Misconfiguration scanning is enabled
2025-01-06T14:09:04Z	INFO	[secret] Secret scanning is enabled
2025-01-06T14:09:04Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-06T14:09:04Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-06T14:09:05Z	INFO	[terraform scanner] Scanning root module	file_path="."
2025-01-06T14:09:05Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="tags"
2025-01-06T14:09:05Z	INFO	Number of language-specific files	num=0
2025-01-06T14:09:05Z	INFO	Detected config files	num=1
trivy_exitcode=0

@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Jan 6, 2025

Trivy Scan Success

Show Output ```hcl

Trivy will check the following folders:
terraform/environments/digital-prison-reporting
terraform/environments/digital-prison-reporting/modules/s3_bucket

Running Trivy in terraform/environments/digital-prison-reporting
2025-01-06T14:15:06Z INFO [vulndb] Need to update DB
2025-01-06T14:15:06Z INFO [vulndb] Downloading vulnerability DB...
2025-01-06T14:15:06Z INFO [vulndb] Downloading artifact... repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-06T14:15:09Z INFO [vulndb] Artifact successfully downloaded repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-06T14:15:09Z INFO [vuln] Vulnerability scanning is enabled
2025-01-06T14:15:09Z INFO [misconfig] Misconfiguration scanning is enabled
2025-01-06T14:15:09Z INFO [misconfig] Need to update the built-in checks
2025-01-06T14:15:09Z INFO [misconfig] Downloading the built-in checks...
160.80 KiB / 160.80 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2025-01-06T14:15:09Z INFO [secret] Secret scanning is enabled
2025-01-06T14:15:09Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-06T14:15:09Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-06T14:15:11Z INFO [terraform scanner] Scanning root module file_path="."
2025-01-06T14:15:11Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="networking"
2025-01-06T14:15:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_glue_connection.glue_dps_connection" value="cty.NilVal"
2025-01-06T14:15:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_iam_role_policy_attachment.redshift_spectrum" value="cty.NilVal"
2025-01-06T14:15:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_secretsmanager_secret.dps" value="cty.NilVal"
2025-01-06T14:15:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_secretsmanager_secret_version.dps" value="cty.NilVal"
2025-01-06T14:15:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="data.aws_secretsmanager_secret.dps" value="cty.NilVal"
2025-01-06T14:15:12Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="data.aws_secretsmanager_secret_version.dps" value="cty.NilVal"
2025-01-06T14:15:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.aws_s3_data_migrate.aws_iam_role_policy_attachment.this" value="cty.NilVal"
2025-01-06T14:15:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.datamart.aws_redshift_authentication_profile.this" value="cty.NilVal"
2025-01-06T14:15:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.datamart.aws_redshift_scheduled_action.this" value="cty.NilVal"
2025-01-06T14:15:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.datamart.aws_redshift_usage_limit.this" value="cty.NilVal"
2025-01-06T14:15:13Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datamart.aws_redshift_cluster.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_redshift_cluster.this[0].dynamic.logging block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-06T14:15:13Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datamart.aws_redshift_cluster.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_redshift_cluster.this[0].dynamic.logging block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-06T14:15:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.domain_builder_backend_Lambda.aws_iam_role_policy_attachment.this" value="cty.NilVal"
2025-01-06T14:15:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.domain_builder_cli_agent.aws_iam_role_policy_attachment.this" value="cty.NilVal"
2025-01-06T14:15:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.domain_builder_cli_agent.aws_security_group_rule.ingress_traffic" value="cty.NilVal"
2025-01-06T14:15:13Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.domain_builder_cli_agent.aws_autoscaling_group.bastion_linux_daily[0]" err="1 error occurred:\n\t* invalid for-each in aws_autoscaling_group.bastion_linux_daily[0].dynamic.tag block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-06T14:15:13Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.domain_builder_cli_agent.aws_autoscaling_group.bastion_linux_daily[0]" err="1 error occurred:\n\t* invalid for-each in aws_autoscaling_group.bastion_linux_daily[0].dynamic.tag block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-06T14:15:13Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.domain_builder_flyway_Lambda.aws_iam_role_policy_attachment.this" value="cty.NilVal"
2025-01-06T14:15:14Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.ec2_kinesis_agent.aws_security_group_rule.ingress_traffic_from_security_groups" value="cty.NilVal"
2025-01-06T14:15:14Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.ec2_kinesis_agent.aws_autoscaling_group.bastion_linux_daily" err="1 error occurred:\n\t* invalid for-each in aws_autoscaling_group.bastion_linux_daily.dynamic.tag block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-06T14:15:14Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.ec2_kinesis_agent.aws_autoscaling_group.bastion_linux_daily" err="1 error occurred:\n\t* invalid for-each in aws_autoscaling_group.bastion_linux_daily.dynamic.tag block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-06T14:15:14Z INFO [terraform scanner] Scanning root module file_path="modules/domains/dms-endpoints"
2025-01-06T14:15:14Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="bucket_name, env, project_id, source_app_password, source_app_username"
2025-01-06T14:15:14Z INFO [terraform scanner] Scanning root module file_path="modules/domains/dms-instance"
2025-01-06T14:15:14Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="env, name, project_id"
2025-01-06T14:15:14Z INFO [terraform scanner] Scanning root module file_path="modules/domains/dms-task"
2025-01-06T14:15:14Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="env, project_id"
2025-01-06T14:15:14Z INFO [terraform scanner] Scanning root module file_path="modules/domains/ingestion-jobs"
2025-01-06T14:15:14Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="env, glue_cdc_maintenance_window, jar_version, project_id, script_version"
2025-01-06T14:15:14Z INFO [terraform scanner] Scanning root module file_path="modules/domains/ingestion-pipeline"
2025-01-06T14:15:14Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="archive_job_trigger_name, data_ingestion_pipeline, dms_replication_task_arn, domain, glue_archive_job, glue_hive_table_creation_jobname, glue_maintenance_compaction_job, glue_maintenance_retention_job, glue_reporting_hub_batch_jobname, glue_reporting_hub_cdc_jobname, glue_s3_data_deletion_job, glue_s3_file_transfer_job, glue_s3_max_attempts, glue_s3_retry_max_wait_millis, glue_s3_retry_min_wait_millis, glue_stop_glue_instance_job, glue_switch_prisons_hive_data_location_job, glue_trigger_activation_job, pipeline_notification_lambda_function, replication_task_id, s3_curated_bucket_id, s3_curated_path, s3_glue_bucket_id, s3_raw_archive_bucket_id, s3_raw_bucket_id, s3_structured_bucket_id, s3_structured_path, s3_temp_reload_bucket_id, step_function_execution_role_arn, stop_dms_task_job"
2025-01-06T14:15:14Z INFO [terraform scanner] Scanning root module file_path="modules/domains/maintenance-pipeline"
2025-01-06T14:15:14Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="dms_replication_task_arn, domain, glue_maintenance_compaction_job, glue_maintenance_retention_job, glue_reporting_hub_cdc_jobname, glue_s3_max_attempts, glue_s3_retry_max_wait_millis, glue_s3_retry_min_wait_millis, glue_stop_glue_instance_job, glue_unprocessed_raw_files_check_job, maintenance_pipeline_name, processed_files_check_max_attempts, processed_files_check_wait_interval_seconds, replication_task_id, s3_curated_path, s3_glue_bucket_id, s3_structured_path, step_function_execution_role_arn, stop_dms_task_job"
2025-01-06T14:15:14Z INFO [terraform scanner] Scanning root module file_path="modules/domains/pipeline-lambda"
2025-01-06T14:15:14Z INFO [terraform scanner] Scanning root module file_path="modules/domains/reload-pipeline"
2025-01-06T14:15:14Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="archive_job_trigger_name, dms_replication_task_arn, domain, glue_archive_job, glue_create_reload_diff_job, glue_hive_table_creation_jobname, glue_maintenance_compaction_job, glue_maintenance_retention_job, glue_reporting_hub_batch_jobname, glue_reporting_hub_cdc_jobname, glue_s3_data_deletion_job, glue_s3_file_transfer_job, glue_s3_max_attempts, glue_s3_retry_max_wait_millis, glue_s3_retry_min_wait_millis, glue_stop_glue_instance_job, glue_switch_prisons_hive_data_location_job, glue_trigger_activation_job, glue_unprocessed_raw_files_check_job, pipeline_notification_lambda_function, processed_files_check_max_attempts, processed_files_check_wait_interval_seconds, reload_pipeline, replication_task_id, s3_curated_bucket_id, s3_curated_path, s3_glue_bucket_id, s3_raw_archive_bucket_id, s3_raw_bucket_id, s3_structured_bucket_id, s3_structured_path, s3_temp_reload_bucket_id, step_function_execution_role_arn, stop_dms_task_job"
2025-01-06T14:15:14Z INFO [terraform scanner] Scanning root module file_path="modules/domains/replay-pipeline"
2025-01-06T14:15:14Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="dms_replication_task_arn, glue_maintenance_compaction_job, glue_maintenance_retention_job, glue_s3_max_attempts, glue_s3_retry_max_wait_millis, glue_s3_retry_min_wait_millis, processed_files_check_max_attempts, processed_files_check_wait_interval_seconds, replication_task_id, s3_curated_path, s3_structured_path, step_function_execution_role_arn"
2025-01-06T14:15:14Z INFO [terraform scanner] Scanning root module file_path="modules/domains/start-cdc-pipeline"
2025-01-06T14:15:14Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="dms_replication_task_arn, domain, glue_reporting_hub_cdc_jobname, glue_stop_glue_instance_job, replication_task_id, s3_glue_bucket_id, start_cdc_pipeline, step_function_execution_role_arn, stop_dms_task_job"
2025-01-06T14:15:14Z INFO [terraform scanner] Scanning root module file_path="modules/domains/stop-cdc-pipeline"
2025-01-06T14:15:14Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="glue_reporting_hub_cdc_jobname, glue_stop_glue_instance_job, glue_unprocessed_raw_files_check_job, processed_files_check_max_attempts, processed_files_check_wait_interval_seconds, replication_task_id, step_function_execution_role_arn, stop_cdc_pipeline, stop_dms_task_job"
2025-01-06T14:15:14Z INFO [terraform scanner] Scanning root module file_path="modules/glue_connection"
2025-01-06T14:15:14Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="availability_zone, connection_url, description, name, password, security_groups, subnet, username"
2025-01-06T14:15:14Z INFO [terraform scanner] Scanning root module file_path="modules/pipeline_trigger"
2025-01-06T14:15:14Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="description, pipeline_name, schedule_expression, state_machine_arn, step_function_execution_role_arn"
2025-01-06T14:15:17Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-public-egress-sgr" range="modules/ec2/main.tf:72"
2025-01-06T14:15:17Z INFO Number of language-specific files num=0
2025-01-06T14:15:17Z INFO Detected config files num=32
trivy_exitcode=0

Running Trivy in terraform/environments/digital-prison-reporting/modules/s3_bucket
2025-01-06T14:15:17Z INFO [vuln] Vulnerability scanning is enabled
2025-01-06T14:15:17Z INFO [misconfig] Misconfiguration scanning is enabled
2025-01-06T14:15:17Z INFO [secret] Secret scanning is enabled
2025-01-06T14:15:17Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-06T14:15:17Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-06T14:15:18Z INFO [terraform scanner] Scanning root module file_path="."
2025-01-06T14:15:18Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="tags"
2025-01-06T14:15:18Z INFO Number of language-specific files num=0
2025-01-06T14:15:18Z INFO Detected config files num=1
trivy_exitcode=0

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/digital-prison-reporting
terraform/environments/digital-prison-reporting/modules/s3_bucket

*****************************

Running Checkov in terraform/environments/digital-prison-reporting
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2025-01-06 14:15:21,254 [MainThread  ] [WARNI]  Failed to download module ministryofjustice/observability-platform-tenant/aws:1.2.0 (for external modules, the --download-external-modules flag is required)
2025-01-06 14:15:21,262 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-pagerduty-integration?ref=v2.0.0:None (for external modules, the --download-external-modules flag is required)
2025-01-06 14:15:52,109 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:15:52,119 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:15:52,131 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:15:52,142 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:15:52,155 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:15:52,165 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:15:52,175 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:15:52,185 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:15:52,195 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:15:52,205 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:15:52,216 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:15:52,227 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:15:52,237 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:15:52,248 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:15:52,274 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:15:52,285 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:15:52,297 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:15:52,308 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:15:52,320 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:15:53,878 [MainThread  ] [ERROR]  Failed to invoke function /usr/local/lib/python3.9/dist-packages/checkov/common/runners/runner_registry._parallel_run with (<checkov.terraform.runner.Runner object at 0x7fb6c0100eb0>, '/github/workspace/terraform/environments/digital-prison-reporting', None, None, <checkov.runner_filter.RunnerFilter object at 0x7fb6c00c8be0>, True, None)
Traceback (most recent call last):
  File "/usr/local/lib/python3.9/dist-packages/checkov/common/parallelizer/parallel_runner.py", line 72, in func_wrapper
    result = original_func(*item)
  File "/usr/local/lib/python3.9/dist-packages/checkov/common/runners/runner_registry.py", line 836, in _parallel_run
    report = runner.run(
  File "/usr/local/lib/python3.9/dist-packages/checkov/terraform/runner.py", line 134, in run
    self.check_tf_definition(report, root_folder, runner_filter, collect_skip_comments)
  File "/usr/local/lib/python3.9/dist-packages/checkov/terraform/runner.py", line 228, in check_tf_definition
    self.push_skipped_checks_down_from_modules(self.context)
  File "/usr/local/lib/python3.9/dist-packages/checkov/terraform/runner.py", line 254, in push_skipped_checks_down_from_modules
    self.push_skipped_checks_down(definition_context, skipped_checks, resolved_paths)
  File "/usr/local/lib/python3.9/dist-packages/checkov/terraform/runner.py", line 293, in push_skipped_checks_down
    resource_config["skipped_checks"] += skipped_checks
TypeError: 'int' object is not subscriptable

checkov_exitcode=0

*****************************

Running Checkov in terraform/environments/digital-prison-reporting/modules/s3_bucket
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
terraform scan results:

Passed checks: 12, Failed checks: 1, Skipped checks: 4

Check: CKV_AWS_300: "Ensure S3 lifecycle configuration sets period for aborting failed uploads"
	FAILED for resource: aws_s3_bucket_lifecycle_configuration.lifecycle[0]
	File: /main.tf:34-122
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-300

		Code lines for this resource are too many. Please use IDE of your choice to review the file.

checkov_exitcode=1

CTFLint Scan Failed

Show Output 
*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
terraform/environments/digital-prison-reporting
terraform/environments/digital-prison-reporting/modules/s3_bucket

*****************************

Running tflint in terraform/environments/digital-prison-reporting
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=0

*****************************

Running tflint in terraform/environments/digital-prison-reporting/modules/s3_bucket
Excluding the following checks: terraform_unused_declarations
1 issue(s) found:

Warning: `s3_notification_name` variable has no type (terraform_typed_variables)

  on terraform/environments/digital-prison-reporting/modules/s3_bucket/variables.tf line 26:
  26: variable "s3_notification_name" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_typed_variables.md

tflint_exitcode=2

Trivy Scan Success

Show Output 
*****************************

Trivy will check the following folders:
terraform/environments/digital-prison-reporting
terraform/environments/digital-prison-reporting/modules/s3_bucket

*****************************

Running Trivy in terraform/environments/digital-prison-reporting
2025-01-06T14:15:06Z	INFO	[vulndb] Need to update DB
2025-01-06T14:15:06Z	INFO	[vulndb] Downloading vulnerability DB...
2025-01-06T14:15:06Z	INFO	[vulndb] Downloading artifact...	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-06T14:15:09Z	INFO	[vulndb] Artifact successfully downloaded	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-06T14:15:09Z	INFO	[vuln] Vulnerability scanning is enabled
2025-01-06T14:15:09Z	INFO	[misconfig] Misconfiguration scanning is enabled
2025-01-06T14:15:09Z	INFO	[misconfig] Need to update the built-in checks
2025-01-06T14:15:09Z	INFO	[misconfig] Downloading the built-in checks...
160.80 KiB / 160.80 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2025-01-06T14:15:09Z	INFO	[secret] Secret scanning is enabled
2025-01-06T14:15:09Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-06T14:15:09Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-06T14:15:11Z	INFO	[terraform scanner] Scanning root module	file_path="."
2025-01-06T14:15:11Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="networking"
2025-01-06T14:15:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_glue_connection.glue_dps_connection" value="cty.NilVal"
2025-01-06T14:15:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_iam_role_policy_attachment.redshift_spectrum" value="cty.NilVal"
2025-01-06T14:15:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_secretsmanager_secret.dps" value="cty.NilVal"
2025-01-06T14:15:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_secretsmanager_secret_version.dps" value="cty.NilVal"
2025-01-06T14:15:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="data.aws_secretsmanager_secret.dps" value="cty.NilVal"
2025-01-06T14:15:12Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="data.aws_secretsmanager_secret_version.dps" value="cty.NilVal"
2025-01-06T14:15:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.aws_s3_data_migrate.aws_iam_role_policy_attachment.this" value="cty.NilVal"
2025-01-06T14:15:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.datamart.aws_redshift_authentication_profile.this" value="cty.NilVal"
2025-01-06T14:15:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.datamart.aws_redshift_scheduled_action.this" value="cty.NilVal"
2025-01-06T14:15:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.datamart.aws_redshift_usage_limit.this" value="cty.NilVal"
2025-01-06T14:15:13Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datamart.aws_redshift_cluster.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_redshift_cluster.this[0].dynamic.logging block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-06T14:15:13Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datamart.aws_redshift_cluster.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_redshift_cluster.this[0].dynamic.logging block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-06T14:15:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.domain_builder_backend_Lambda.aws_iam_role_policy_attachment.this" value="cty.NilVal"
2025-01-06T14:15:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.domain_builder_cli_agent.aws_iam_role_policy_attachment.this" value="cty.NilVal"
2025-01-06T14:15:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.domain_builder_cli_agent.aws_security_group_rule.ingress_traffic" value="cty.NilVal"
2025-01-06T14:15:13Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.domain_builder_cli_agent.aws_autoscaling_group.bastion_linux_daily[0]" err="1 error occurred:\n\t* invalid for-each in aws_autoscaling_group.bastion_linux_daily[0].dynamic.tag block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-06T14:15:13Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.domain_builder_cli_agent.aws_autoscaling_group.bastion_linux_daily[0]" err="1 error occurred:\n\t* invalid for-each in aws_autoscaling_group.bastion_linux_daily[0].dynamic.tag block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-06T14:15:13Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.domain_builder_flyway_Lambda.aws_iam_role_policy_attachment.this" value="cty.NilVal"
2025-01-06T14:15:14Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.ec2_kinesis_agent.aws_security_group_rule.ingress_traffic_from_security_groups" value="cty.NilVal"
2025-01-06T14:15:14Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.ec2_kinesis_agent.aws_autoscaling_group.bastion_linux_daily" err="1 error occurred:\n\t* invalid for-each in aws_autoscaling_group.bastion_linux_daily.dynamic.tag block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-06T14:15:14Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.ec2_kinesis_agent.aws_autoscaling_group.bastion_linux_daily" err="1 error occurred:\n\t* invalid for-each in aws_autoscaling_group.bastion_linux_daily.dynamic.tag block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-06T14:15:14Z	INFO	[terraform scanner] Scanning root module	file_path="modules/domains/dms-endpoints"
2025-01-06T14:15:14Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="bucket_name, env, project_id, source_app_password, source_app_username"
2025-01-06T14:15:14Z	INFO	[terraform scanner] Scanning root module	file_path="modules/domains/dms-instance"
2025-01-06T14:15:14Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="env, name, project_id"
2025-01-06T14:15:14Z	INFO	[terraform scanner] Scanning root module	file_path="modules/domains/dms-task"
2025-01-06T14:15:14Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="env, project_id"
2025-01-06T14:15:14Z	INFO	[terraform scanner] Scanning root module	file_path="modules/domains/ingestion-jobs"
2025-01-06T14:15:14Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="env, glue_cdc_maintenance_window, jar_version, project_id, script_version"
2025-01-06T14:15:14Z	INFO	[terraform scanner] Scanning root module	file_path="modules/domains/ingestion-pipeline"
2025-01-06T14:15:14Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="archive_job_trigger_name, data_ingestion_pipeline, dms_replication_task_arn, domain, glue_archive_job, glue_hive_table_creation_jobname, glue_maintenance_compaction_job, glue_maintenance_retention_job, glue_reporting_hub_batch_jobname, glue_reporting_hub_cdc_jobname, glue_s3_data_deletion_job, glue_s3_file_transfer_job, glue_s3_max_attempts, glue_s3_retry_max_wait_millis, glue_s3_retry_min_wait_millis, glue_stop_glue_instance_job, glue_switch_prisons_hive_data_location_job, glue_trigger_activation_job, pipeline_notification_lambda_function, replication_task_id, s3_curated_bucket_id, s3_curated_path, s3_glue_bucket_id, s3_raw_archive_bucket_id, s3_raw_bucket_id, s3_structured_bucket_id, s3_structured_path, s3_temp_reload_bucket_id, step_function_execution_role_arn, stop_dms_task_job"
2025-01-06T14:15:14Z	INFO	[terraform scanner] Scanning root module	file_path="modules/domains/maintenance-pipeline"
2025-01-06T14:15:14Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="dms_replication_task_arn, domain, glue_maintenance_compaction_job, glue_maintenance_retention_job, glue_reporting_hub_cdc_jobname, glue_s3_max_attempts, glue_s3_retry_max_wait_millis, glue_s3_retry_min_wait_millis, glue_stop_glue_instance_job, glue_unprocessed_raw_files_check_job, maintenance_pipeline_name, processed_files_check_max_attempts, processed_files_check_wait_interval_seconds, replication_task_id, s3_curated_path, s3_glue_bucket_id, s3_structured_path, step_function_execution_role_arn, stop_dms_task_job"
2025-01-06T14:15:14Z	INFO	[terraform scanner] Scanning root module	file_path="modules/domains/pipeline-lambda"
2025-01-06T14:15:14Z	INFO	[terraform scanner] Scanning root module	file_path="modules/domains/reload-pipeline"
2025-01-06T14:15:14Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="archive_job_trigger_name, dms_replication_task_arn, domain, glue_archive_job, glue_create_reload_diff_job, glue_hive_table_creation_jobname, glue_maintenance_compaction_job, glue_maintenance_retention_job, glue_reporting_hub_batch_jobname, glue_reporting_hub_cdc_jobname, glue_s3_data_deletion_job, glue_s3_file_transfer_job, glue_s3_max_attempts, glue_s3_retry_max_wait_millis, glue_s3_retry_min_wait_millis, glue_stop_glue_instance_job, glue_switch_prisons_hive_data_location_job, glue_trigger_activation_job, glue_unprocessed_raw_files_check_job, pipeline_notification_lambda_function, processed_files_check_max_attempts, processed_files_check_wait_interval_seconds, reload_pipeline, replication_task_id, s3_curated_bucket_id, s3_curated_path, s3_glue_bucket_id, s3_raw_archive_bucket_id, s3_raw_bucket_id, s3_structured_bucket_id, s3_structured_path, s3_temp_reload_bucket_id, step_function_execution_role_arn, stop_dms_task_job"
2025-01-06T14:15:14Z	INFO	[terraform scanner] Scanning root module	file_path="modules/domains/replay-pipeline"
2025-01-06T14:15:14Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="dms_replication_task_arn, glue_maintenance_compaction_job, glue_maintenance_retention_job, glue_s3_max_attempts, glue_s3_retry_max_wait_millis, glue_s3_retry_min_wait_millis, processed_files_check_max_attempts, processed_files_check_wait_interval_seconds, replication_task_id, s3_curated_path, s3_structured_path, step_function_execution_role_arn"
2025-01-06T14:15:14Z	INFO	[terraform scanner] Scanning root module	file_path="modules/domains/start-cdc-pipeline"
2025-01-06T14:15:14Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="dms_replication_task_arn, domain, glue_reporting_hub_cdc_jobname, glue_stop_glue_instance_job, replication_task_id, s3_glue_bucket_id, start_cdc_pipeline, step_function_execution_role_arn, stop_dms_task_job"
2025-01-06T14:15:14Z	INFO	[terraform scanner] Scanning root module	file_path="modules/domains/stop-cdc-pipeline"
2025-01-06T14:15:14Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="glue_reporting_hub_cdc_jobname, glue_stop_glue_instance_job, glue_unprocessed_raw_files_check_job, processed_files_check_max_attempts, processed_files_check_wait_interval_seconds, replication_task_id, step_function_execution_role_arn, stop_cdc_pipeline, stop_dms_task_job"
2025-01-06T14:15:14Z	INFO	[terraform scanner] Scanning root module	file_path="modules/glue_connection"
2025-01-06T14:15:14Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="availability_zone, connection_url, description, name, password, security_groups, subnet, username"
2025-01-06T14:15:14Z	INFO	[terraform scanner] Scanning root module	file_path="modules/pipeline_trigger"
2025-01-06T14:15:14Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="description, pipeline_name, schedule_expression, state_machine_arn, step_function_execution_role_arn"
2025-01-06T14:15:17Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-public-egress-sgr" range="modules/ec2/main.tf:72"
2025-01-06T14:15:17Z	INFO	Number of language-specific files	num=0
2025-01-06T14:15:17Z	INFO	Detected config files	num=32
trivy_exitcode=0

*****************************

Running Trivy in terraform/environments/digital-prison-reporting/modules/s3_bucket
2025-01-06T14:15:17Z	INFO	[vuln] Vulnerability scanning is enabled
2025-01-06T14:15:17Z	INFO	[misconfig] Misconfiguration scanning is enabled
2025-01-06T14:15:17Z	INFO	[secret] Secret scanning is enabled
2025-01-06T14:15:17Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-06T14:15:17Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-06T14:15:18Z	INFO	[terraform scanner] Scanning root module	file_path="."
2025-01-06T14:15:18Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="tags"
2025-01-06T14:15:18Z	INFO	Number of language-specific files	num=0
2025-01-06T14:15:18Z	INFO	Detected config files	num=1
trivy_exitcode=0

@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Jan 6, 2025

Trivy Scan Success

Show Output ```hcl

Trivy will check the following folders:
terraform/environments/digital-prison-reporting
terraform/environments/digital-prison-reporting/modules/s3_bucket

Running Trivy in terraform/environments/digital-prison-reporting
2025-01-06T14:28:25Z INFO [vulndb] Need to update DB
2025-01-06T14:28:25Z INFO [vulndb] Downloading vulnerability DB...
2025-01-06T14:28:25Z INFO [vulndb] Downloading artifact... repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-06T14:28:27Z INFO [vulndb] Artifact successfully downloaded repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-06T14:28:27Z INFO [vuln] Vulnerability scanning is enabled
2025-01-06T14:28:27Z INFO [misconfig] Misconfiguration scanning is enabled
2025-01-06T14:28:27Z INFO [misconfig] Need to update the built-in checks
2025-01-06T14:28:27Z INFO [misconfig] Downloading the built-in checks...
160.80 KiB / 160.80 KiB [---------------------------------------------------------] 100.00% ? p/s 0s2025-01-06T14:28:27Z INFO [secret] Secret scanning is enabled
2025-01-06T14:28:27Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-06T14:28:27Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-06T14:28:30Z INFO [terraform scanner] Scanning root module file_path="."
2025-01-06T14:28:30Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="networking"
2025-01-06T14:28:30Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_glue_connection.glue_dps_connection" value="cty.NilVal"
2025-01-06T14:28:30Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_iam_role_policy_attachment.redshift_spectrum" value="cty.NilVal"
2025-01-06T14:28:30Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_secretsmanager_secret.dps" value="cty.NilVal"
2025-01-06T14:28:30Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_secretsmanager_secret_version.dps" value="cty.NilVal"
2025-01-06T14:28:30Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="data.aws_secretsmanager_secret.dps" value="cty.NilVal"
2025-01-06T14:28:30Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="data.aws_secretsmanager_secret_version.dps" value="cty.NilVal"
2025-01-06T14:28:31Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.aws_s3_data_migrate.aws_iam_role_policy_attachment.this" value="cty.NilVal"
2025-01-06T14:28:31Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.datamart.aws_redshift_authentication_profile.this" value="cty.NilVal"
2025-01-06T14:28:31Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.datamart.aws_redshift_scheduled_action.this" value="cty.NilVal"
2025-01-06T14:28:31Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.datamart.aws_redshift_usage_limit.this" value="cty.NilVal"
2025-01-06T14:28:31Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datamart.aws_redshift_cluster.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_redshift_cluster.this[0].dynamic.logging block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-06T14:28:31Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datamart.aws_redshift_cluster.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_redshift_cluster.this[0].dynamic.logging block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-06T14:28:31Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.domain_builder_backend_Lambda.aws_iam_role_policy_attachment.this" value="cty.NilVal"
2025-01-06T14:28:31Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.domain_builder_cli_agent.aws_iam_role_policy_attachment.this" value="cty.NilVal"
2025-01-06T14:28:31Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.domain_builder_cli_agent.aws_security_group_rule.ingress_traffic" value="cty.NilVal"
2025-01-06T14:28:31Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.domain_builder_cli_agent.aws_autoscaling_group.bastion_linux_daily[0]" err="1 error occurred:\n\t* invalid for-each in aws_autoscaling_group.bastion_linux_daily[0].dynamic.tag block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-06T14:28:31Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.domain_builder_cli_agent.aws_autoscaling_group.bastion_linux_daily[0]" err="1 error occurred:\n\t* invalid for-each in aws_autoscaling_group.bastion_linux_daily[0].dynamic.tag block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-06T14:28:31Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.domain_builder_flyway_Lambda.aws_iam_role_policy_attachment.this" value="cty.NilVal"
2025-01-06T14:28:32Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.ec2_kinesis_agent.aws_security_group_rule.ingress_traffic_from_security_groups" value="cty.NilVal"
2025-01-06T14:28:32Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.ec2_kinesis_agent.aws_autoscaling_group.bastion_linux_daily" err="1 error occurred:\n\t* invalid for-each in aws_autoscaling_group.bastion_linux_daily.dynamic.tag block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-06T14:28:32Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.ec2_kinesis_agent.aws_autoscaling_group.bastion_linux_daily" err="1 error occurred:\n\t* invalid for-each in aws_autoscaling_group.bastion_linux_daily.dynamic.tag block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-06T14:28:32Z INFO [terraform scanner] Scanning root module file_path="modules/domains/dms-endpoints"
2025-01-06T14:28:32Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="bucket_name, env, project_id, source_app_password, source_app_username"
2025-01-06T14:28:32Z INFO [terraform scanner] Scanning root module file_path="modules/domains/dms-instance"
2025-01-06T14:28:32Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="env, name, project_id"
2025-01-06T14:28:32Z INFO [terraform scanner] Scanning root module file_path="modules/domains/dms-task"
2025-01-06T14:28:32Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="env, project_id"
2025-01-06T14:28:32Z INFO [terraform scanner] Scanning root module file_path="modules/domains/ingestion-jobs"
2025-01-06T14:28:32Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="env, glue_cdc_maintenance_window, jar_version, project_id, script_version"
2025-01-06T14:28:32Z INFO [terraform scanner] Scanning root module file_path="modules/domains/ingestion-pipeline"
2025-01-06T14:28:32Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="archive_job_trigger_name, data_ingestion_pipeline, dms_replication_task_arn, domain, glue_archive_job, glue_hive_table_creation_jobname, glue_maintenance_compaction_job, glue_maintenance_retention_job, glue_reporting_hub_batch_jobname, glue_reporting_hub_cdc_jobname, glue_s3_data_deletion_job, glue_s3_file_transfer_job, glue_s3_max_attempts, glue_s3_retry_max_wait_millis, glue_s3_retry_min_wait_millis, glue_stop_glue_instance_job, glue_switch_prisons_hive_data_location_job, glue_trigger_activation_job, pipeline_notification_lambda_function, replication_task_id, s3_curated_bucket_id, s3_curated_path, s3_glue_bucket_id, s3_raw_archive_bucket_id, s3_raw_bucket_id, s3_structured_bucket_id, s3_structured_path, s3_temp_reload_bucket_id, step_function_execution_role_arn, stop_dms_task_job"
2025-01-06T14:28:32Z INFO [terraform scanner] Scanning root module file_path="modules/domains/maintenance-pipeline"
2025-01-06T14:28:32Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="dms_replication_task_arn, domain, glue_maintenance_compaction_job, glue_maintenance_retention_job, glue_reporting_hub_cdc_jobname, glue_s3_max_attempts, glue_s3_retry_max_wait_millis, glue_s3_retry_min_wait_millis, glue_stop_glue_instance_job, glue_unprocessed_raw_files_check_job, maintenance_pipeline_name, processed_files_check_max_attempts, processed_files_check_wait_interval_seconds, replication_task_id, s3_curated_path, s3_glue_bucket_id, s3_structured_path, step_function_execution_role_arn, stop_dms_task_job"
2025-01-06T14:28:32Z INFO [terraform scanner] Scanning root module file_path="modules/domains/pipeline-lambda"
2025-01-06T14:28:32Z INFO [terraform scanner] Scanning root module file_path="modules/domains/reload-pipeline"
2025-01-06T14:28:32Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="archive_job_trigger_name, dms_replication_task_arn, domain, glue_archive_job, glue_create_reload_diff_job, glue_hive_table_creation_jobname, glue_maintenance_compaction_job, glue_maintenance_retention_job, glue_reporting_hub_batch_jobname, glue_reporting_hub_cdc_jobname, glue_s3_data_deletion_job, glue_s3_file_transfer_job, glue_s3_max_attempts, glue_s3_retry_max_wait_millis, glue_s3_retry_min_wait_millis, glue_stop_glue_instance_job, glue_switch_prisons_hive_data_location_job, glue_trigger_activation_job, glue_unprocessed_raw_files_check_job, pipeline_notification_lambda_function, processed_files_check_max_attempts, processed_files_check_wait_interval_seconds, reload_pipeline, replication_task_id, s3_curated_bucket_id, s3_curated_path, s3_glue_bucket_id, s3_raw_archive_bucket_id, s3_raw_bucket_id, s3_structured_bucket_id, s3_structured_path, s3_temp_reload_bucket_id, step_function_execution_role_arn, stop_dms_task_job"
2025-01-06T14:28:32Z INFO [terraform scanner] Scanning root module file_path="modules/domains/replay-pipeline"
2025-01-06T14:28:32Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="dms_replication_task_arn, glue_maintenance_compaction_job, glue_maintenance_retention_job, glue_s3_max_attempts, glue_s3_retry_max_wait_millis, glue_s3_retry_min_wait_millis, processed_files_check_max_attempts, processed_files_check_wait_interval_seconds, replication_task_id, s3_curated_path, s3_structured_path, step_function_execution_role_arn"
2025-01-06T14:28:32Z INFO [terraform scanner] Scanning root module file_path="modules/domains/start-cdc-pipeline"
2025-01-06T14:28:32Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="dms_replication_task_arn, domain, glue_reporting_hub_cdc_jobname, glue_stop_glue_instance_job, replication_task_id, s3_glue_bucket_id, start_cdc_pipeline, step_function_execution_role_arn, stop_dms_task_job"
2025-01-06T14:28:32Z INFO [terraform scanner] Scanning root module file_path="modules/domains/stop-cdc-pipeline"
2025-01-06T14:28:32Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="glue_reporting_hub_cdc_jobname, glue_stop_glue_instance_job, glue_unprocessed_raw_files_check_job, processed_files_check_max_attempts, processed_files_check_wait_interval_seconds, replication_task_id, step_function_execution_role_arn, stop_cdc_pipeline, stop_dms_task_job"
2025-01-06T14:28:32Z INFO [terraform scanner] Scanning root module file_path="modules/glue_connection"
2025-01-06T14:28:32Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="availability_zone, connection_url, description, name, password, security_groups, subnet, username"
2025-01-06T14:28:32Z INFO [terraform scanner] Scanning root module file_path="modules/pipeline_trigger"
2025-01-06T14:28:32Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="description, pipeline_name, schedule_expression, state_machine_arn, step_function_execution_role_arn"
2025-01-06T14:28:35Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-public-egress-sgr" range="modules/ec2/main.tf:72"
2025-01-06T14:28:35Z INFO Number of language-specific files num=0
2025-01-06T14:28:35Z INFO Detected config files num=32
trivy_exitcode=0

Running Trivy in terraform/environments/digital-prison-reporting/modules/s3_bucket
2025-01-06T14:28:35Z INFO [vuln] Vulnerability scanning is enabled
2025-01-06T14:28:35Z INFO [misconfig] Misconfiguration scanning is enabled
2025-01-06T14:28:35Z INFO [secret] Secret scanning is enabled
2025-01-06T14:28:35Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-06T14:28:35Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-06T14:28:36Z INFO [terraform scanner] Scanning root module file_path="."
2025-01-06T14:28:36Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="tags"
2025-01-06T14:28:36Z INFO Number of language-specific files num=0
2025-01-06T14:28:36Z INFO Detected config files num=1
trivy_exitcode=0

</details> #### `Checkov Scan` Success
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/digital-prison-reporting
terraform/environments/digital-prison-reporting/modules/s3_bucket

*****************************

Running Checkov in terraform/environments/digital-prison-reporting
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2025-01-06 14:28:39,302 [MainThread  ] [WARNI]  Failed to download module ministryofjustice/observability-platform-tenant/aws:1.2.0 (for external modules, the --download-external-modules flag is required)
2025-01-06 14:28:39,302 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-pagerduty-integration?ref=v2.0.0:None (for external modules, the --download-external-modules flag is required)
2025-01-06 14:29:10,257 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:29:10,268 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:29:10,279 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:29:10,291 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:29:10,303 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:29:10,313 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:29:10,324 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:29:10,334 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:29:10,344 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:29:10,354 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:29:10,365 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:29:10,376 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:29:10,387 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:29:10,398 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:29:10,423 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:29:10,434 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:29:10,446 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:29:10,458 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:29:10,469 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:29:12,221 [MainThread  ] [ERROR]  Failed to invoke function /usr/local/lib/python3.9/dist-packages/checkov/common/runners/runner_registry._parallel_run with (<checkov.terraform.runner.Runner object at 0x7f740fd07df0>, '/github/workspace/terraform/environments/digital-prison-reporting', None, None, <checkov.runner_filter.RunnerFilter object at 0x7f740fcd0b20>, True, None)
Traceback (most recent call last):
  File "/usr/local/lib/python3.9/dist-packages/checkov/common/parallelizer/parallel_runner.py", line 72, in func_wrapper
    result = original_func(*item)
  File "/usr/local/lib/python3.9/dist-packages/checkov/common/runners/runner_registry.py", line 836, in _parallel_run
    report = runner.run(
  File "/usr/local/lib/python3.9/dist-packages/checkov/terraform/runner.py", line 134, in run
    self.check_tf_definition(report, root_folder, runner_filter, collect_skip_comments)
  File "/usr/local/lib/python3.9/dist-packages/checkov/terraform/runner.py", line 228, in check_tf_definition
    self.push_skipped_checks_down_from_modules(self.context)
  File "/usr/local/lib/python3.9/dist-packages/checkov/terraform/runner.py", line 254, in push_skipped_checks_down_from_modules
    self.push_skipped_checks_down(definition_context, skipped_checks, resolved_paths)
  File "/usr/local/lib/python3.9/dist-packages/checkov/terraform/runner.py", line 293, in push_skipped_checks_down
    resource_config["skipped_checks"] += skipped_checks
TypeError: 'int' object is not subscriptable

checkov_exitcode=0

*****************************

Running Checkov in terraform/environments/digital-prison-reporting/modules/s3_bucket
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
terraform scan results:

Passed checks: 12, Failed checks: 0, Skipped checks: 5


checkov_exitcode=0

CTFLint Scan Success

Show Output 
*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
terraform/environments/digital-prison-reporting
terraform/environments/digital-prison-reporting/modules/s3_bucket

*****************************

Running tflint in terraform/environments/digital-prison-reporting
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=0

*****************************

Running tflint in terraform/environments/digital-prison-reporting/modules/s3_bucket
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=0

Trivy Scan Success

Show Output 
*****************************

Trivy will check the following folders:
terraform/environments/digital-prison-reporting
terraform/environments/digital-prison-reporting/modules/s3_bucket

*****************************

Running Trivy in terraform/environments/digital-prison-reporting
2025-01-06T14:28:25Z	INFO	[vulndb] Need to update DB
2025-01-06T14:28:25Z	INFO	[vulndb] Downloading vulnerability DB...
2025-01-06T14:28:25Z	INFO	[vulndb] Downloading artifact...	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-06T14:28:27Z	INFO	[vulndb] Artifact successfully downloaded	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-06T14:28:27Z	INFO	[vuln] Vulnerability scanning is enabled
2025-01-06T14:28:27Z	INFO	[misconfig] Misconfiguration scanning is enabled
2025-01-06T14:28:27Z	INFO	[misconfig] Need to update the built-in checks
2025-01-06T14:28:27Z	INFO	[misconfig] Downloading the built-in checks...
160.80 KiB / 160.80 KiB [---------------------------------------------------------] 100.00% ? p/s 0s2025-01-06T14:28:27Z	INFO	[secret] Secret scanning is enabled
2025-01-06T14:28:27Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-06T14:28:27Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-06T14:28:30Z	INFO	[terraform scanner] Scanning root module	file_path="."
2025-01-06T14:28:30Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="networking"
2025-01-06T14:28:30Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_glue_connection.glue_dps_connection" value="cty.NilVal"
2025-01-06T14:28:30Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_iam_role_policy_attachment.redshift_spectrum" value="cty.NilVal"
2025-01-06T14:28:30Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_secretsmanager_secret.dps" value="cty.NilVal"
2025-01-06T14:28:30Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_secretsmanager_secret_version.dps" value="cty.NilVal"
2025-01-06T14:28:30Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="data.aws_secretsmanager_secret.dps" value="cty.NilVal"
2025-01-06T14:28:30Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="data.aws_secretsmanager_secret_version.dps" value="cty.NilVal"
2025-01-06T14:28:31Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.aws_s3_data_migrate.aws_iam_role_policy_attachment.this" value="cty.NilVal"
2025-01-06T14:28:31Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.datamart.aws_redshift_authentication_profile.this" value="cty.NilVal"
2025-01-06T14:28:31Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.datamart.aws_redshift_scheduled_action.this" value="cty.NilVal"
2025-01-06T14:28:31Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.datamart.aws_redshift_usage_limit.this" value="cty.NilVal"
2025-01-06T14:28:31Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datamart.aws_redshift_cluster.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_redshift_cluster.this[0].dynamic.logging block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-06T14:28:31Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datamart.aws_redshift_cluster.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_redshift_cluster.this[0].dynamic.logging block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-06T14:28:31Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.domain_builder_backend_Lambda.aws_iam_role_policy_attachment.this" value="cty.NilVal"
2025-01-06T14:28:31Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.domain_builder_cli_agent.aws_iam_role_policy_attachment.this" value="cty.NilVal"
2025-01-06T14:28:31Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.domain_builder_cli_agent.aws_security_group_rule.ingress_traffic" value="cty.NilVal"
2025-01-06T14:28:31Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.domain_builder_cli_agent.aws_autoscaling_group.bastion_linux_daily[0]" err="1 error occurred:\n\t* invalid for-each in aws_autoscaling_group.bastion_linux_daily[0].dynamic.tag block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-06T14:28:31Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.domain_builder_cli_agent.aws_autoscaling_group.bastion_linux_daily[0]" err="1 error occurred:\n\t* invalid for-each in aws_autoscaling_group.bastion_linux_daily[0].dynamic.tag block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-06T14:28:31Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.domain_builder_flyway_Lambda.aws_iam_role_policy_attachment.this" value="cty.NilVal"
2025-01-06T14:28:32Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.ec2_kinesis_agent.aws_security_group_rule.ingress_traffic_from_security_groups" value="cty.NilVal"
2025-01-06T14:28:32Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.ec2_kinesis_agent.aws_autoscaling_group.bastion_linux_daily" err="1 error occurred:\n\t* invalid for-each in aws_autoscaling_group.bastion_linux_daily.dynamic.tag block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-06T14:28:32Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.ec2_kinesis_agent.aws_autoscaling_group.bastion_linux_daily" err="1 error occurred:\n\t* invalid for-each in aws_autoscaling_group.bastion_linux_daily.dynamic.tag block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-06T14:28:32Z	INFO	[terraform scanner] Scanning root module	file_path="modules/domains/dms-endpoints"
2025-01-06T14:28:32Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="bucket_name, env, project_id, source_app_password, source_app_username"
2025-01-06T14:28:32Z	INFO	[terraform scanner] Scanning root module	file_path="modules/domains/dms-instance"
2025-01-06T14:28:32Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="env, name, project_id"
2025-01-06T14:28:32Z	INFO	[terraform scanner] Scanning root module	file_path="modules/domains/dms-task"
2025-01-06T14:28:32Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="env, project_id"
2025-01-06T14:28:32Z	INFO	[terraform scanner] Scanning root module	file_path="modules/domains/ingestion-jobs"
2025-01-06T14:28:32Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="env, glue_cdc_maintenance_window, jar_version, project_id, script_version"
2025-01-06T14:28:32Z	INFO	[terraform scanner] Scanning root module	file_path="modules/domains/ingestion-pipeline"
2025-01-06T14:28:32Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="archive_job_trigger_name, data_ingestion_pipeline, dms_replication_task_arn, domain, glue_archive_job, glue_hive_table_creation_jobname, glue_maintenance_compaction_job, glue_maintenance_retention_job, glue_reporting_hub_batch_jobname, glue_reporting_hub_cdc_jobname, glue_s3_data_deletion_job, glue_s3_file_transfer_job, glue_s3_max_attempts, glue_s3_retry_max_wait_millis, glue_s3_retry_min_wait_millis, glue_stop_glue_instance_job, glue_switch_prisons_hive_data_location_job, glue_trigger_activation_job, pipeline_notification_lambda_function, replication_task_id, s3_curated_bucket_id, s3_curated_path, s3_glue_bucket_id, s3_raw_archive_bucket_id, s3_raw_bucket_id, s3_structured_bucket_id, s3_structured_path, s3_temp_reload_bucket_id, step_function_execution_role_arn, stop_dms_task_job"
2025-01-06T14:28:32Z	INFO	[terraform scanner] Scanning root module	file_path="modules/domains/maintenance-pipeline"
2025-01-06T14:28:32Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="dms_replication_task_arn, domain, glue_maintenance_compaction_job, glue_maintenance_retention_job, glue_reporting_hub_cdc_jobname, glue_s3_max_attempts, glue_s3_retry_max_wait_millis, glue_s3_retry_min_wait_millis, glue_stop_glue_instance_job, glue_unprocessed_raw_files_check_job, maintenance_pipeline_name, processed_files_check_max_attempts, processed_files_check_wait_interval_seconds, replication_task_id, s3_curated_path, s3_glue_bucket_id, s3_structured_path, step_function_execution_role_arn, stop_dms_task_job"
2025-01-06T14:28:32Z	INFO	[terraform scanner] Scanning root module	file_path="modules/domains/pipeline-lambda"
2025-01-06T14:28:32Z	INFO	[terraform scanner] Scanning root module	file_path="modules/domains/reload-pipeline"
2025-01-06T14:28:32Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="archive_job_trigger_name, dms_replication_task_arn, domain, glue_archive_job, glue_create_reload_diff_job, glue_hive_table_creation_jobname, glue_maintenance_compaction_job, glue_maintenance_retention_job, glue_reporting_hub_batch_jobname, glue_reporting_hub_cdc_jobname, glue_s3_data_deletion_job, glue_s3_file_transfer_job, glue_s3_max_attempts, glue_s3_retry_max_wait_millis, glue_s3_retry_min_wait_millis, glue_stop_glue_instance_job, glue_switch_prisons_hive_data_location_job, glue_trigger_activation_job, glue_unprocessed_raw_files_check_job, pipeline_notification_lambda_function, processed_files_check_max_attempts, processed_files_check_wait_interval_seconds, reload_pipeline, replication_task_id, s3_curated_bucket_id, s3_curated_path, s3_glue_bucket_id, s3_raw_archive_bucket_id, s3_raw_bucket_id, s3_structured_bucket_id, s3_structured_path, s3_temp_reload_bucket_id, step_function_execution_role_arn, stop_dms_task_job"
2025-01-06T14:28:32Z	INFO	[terraform scanner] Scanning root module	file_path="modules/domains/replay-pipeline"
2025-01-06T14:28:32Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="dms_replication_task_arn, glue_maintenance_compaction_job, glue_maintenance_retention_job, glue_s3_max_attempts, glue_s3_retry_max_wait_millis, glue_s3_retry_min_wait_millis, processed_files_check_max_attempts, processed_files_check_wait_interval_seconds, replication_task_id, s3_curated_path, s3_structured_path, step_function_execution_role_arn"
2025-01-06T14:28:32Z	INFO	[terraform scanner] Scanning root module	file_path="modules/domains/start-cdc-pipeline"
2025-01-06T14:28:32Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="dms_replication_task_arn, domain, glue_reporting_hub_cdc_jobname, glue_stop_glue_instance_job, replication_task_id, s3_glue_bucket_id, start_cdc_pipeline, step_function_execution_role_arn, stop_dms_task_job"
2025-01-06T14:28:32Z	INFO	[terraform scanner] Scanning root module	file_path="modules/domains/stop-cdc-pipeline"
2025-01-06T14:28:32Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="glue_reporting_hub_cdc_jobname, glue_stop_glue_instance_job, glue_unprocessed_raw_files_check_job, processed_files_check_max_attempts, processed_files_check_wait_interval_seconds, replication_task_id, step_function_execution_role_arn, stop_cdc_pipeline, stop_dms_task_job"
2025-01-06T14:28:32Z	INFO	[terraform scanner] Scanning root module	file_path="modules/glue_connection"
2025-01-06T14:28:32Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="availability_zone, connection_url, description, name, password, security_groups, subnet, username"
2025-01-06T14:28:32Z	INFO	[terraform scanner] Scanning root module	file_path="modules/pipeline_trigger"
2025-01-06T14:28:32Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="description, pipeline_name, schedule_expression, state_machine_arn, step_function_execution_role_arn"
2025-01-06T14:28:35Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-public-egress-sgr" range="modules/ec2/main.tf:72"
2025-01-06T14:28:35Z	INFO	Number of language-specific files	num=0
2025-01-06T14:28:35Z	INFO	Detected config files	num=32
trivy_exitcode=0

*****************************

Running Trivy in terraform/environments/digital-prison-reporting/modules/s3_bucket
2025-01-06T14:28:35Z	INFO	[vuln] Vulnerability scanning is enabled
2025-01-06T14:28:35Z	INFO	[misconfig] Misconfiguration scanning is enabled
2025-01-06T14:28:35Z	INFO	[secret] Secret scanning is enabled
2025-01-06T14:28:35Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-06T14:28:35Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-06T14:28:36Z	INFO	[terraform scanner] Scanning root module	file_path="."
2025-01-06T14:28:36Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="tags"
2025-01-06T14:28:36Z	INFO	Number of language-specific files	num=0
2025-01-06T14:28:36Z	INFO	Detected config files	num=1
trivy_exitcode=0

@stalwartstu stalwartstu had a problem deploying to digital-prison-reporting-test January 6, 2025 14:32 — with GitHub Actions Error
@stalwartstu stalwartstu had a problem deploying to digital-prison-reporting-development January 6, 2025 14:32 — with GitHub Actions Error
@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Jan 6, 2025

Trivy Scan Success

Show Output ```hcl

Trivy will check the following folders:
terraform/environments/digital-prison-reporting
terraform/environments/digital-prison-reporting/modules/s3_bucket

Running Trivy in terraform/environments/digital-prison-reporting
2025-01-06T14:46:11Z INFO [vulndb] Need to update DB
2025-01-06T14:46:11Z INFO [vulndb] Downloading vulnerability DB...
2025-01-06T14:46:11Z INFO [vulndb] Downloading artifact... repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-06T14:46:14Z INFO [vulndb] Artifact successfully downloaded repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-06T14:46:14Z INFO [vuln] Vulnerability scanning is enabled
2025-01-06T14:46:14Z INFO [misconfig] Misconfiguration scanning is enabled
2025-01-06T14:46:14Z INFO [misconfig] Need to update the built-in checks
2025-01-06T14:46:14Z INFO [misconfig] Downloading the built-in checks...
160.80 KiB / 160.80 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2025-01-06T14:46:14Z INFO [secret] Secret scanning is enabled
2025-01-06T14:46:14Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-06T14:46:14Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-06T14:46:17Z INFO [terraform scanner] Scanning root module file_path="."
2025-01-06T14:46:17Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="networking"
2025-01-06T14:46:17Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_glue_connection.glue_dps_connection" value="cty.NilVal"
2025-01-06T14:46:17Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_iam_role_policy_attachment.redshift_spectrum" value="cty.NilVal"
2025-01-06T14:46:17Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_secretsmanager_secret.dps" value="cty.NilVal"
2025-01-06T14:46:17Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_secretsmanager_secret_version.dps" value="cty.NilVal"
2025-01-06T14:46:17Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="data.aws_secretsmanager_secret.dps" value="cty.NilVal"
2025-01-06T14:46:17Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="data.aws_secretsmanager_secret_version.dps" value="cty.NilVal"
2025-01-06T14:46:18Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.aws_s3_data_migrate.aws_iam_role_policy_attachment.this" value="cty.NilVal"
2025-01-06T14:46:18Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.datamart.aws_redshift_authentication_profile.this" value="cty.NilVal"
2025-01-06T14:46:18Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.datamart.aws_redshift_scheduled_action.this" value="cty.NilVal"
2025-01-06T14:46:18Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.datamart.aws_redshift_usage_limit.this" value="cty.NilVal"
2025-01-06T14:46:18Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datamart.aws_redshift_cluster.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_redshift_cluster.this[0].dynamic.logging block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-06T14:46:18Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.datamart.aws_redshift_cluster.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_redshift_cluster.this[0].dynamic.logging block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-06T14:46:18Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.domain_builder_backend_Lambda.aws_iam_role_policy_attachment.this" value="cty.NilVal"
2025-01-06T14:46:18Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.domain_builder_cli_agent.aws_iam_role_policy_attachment.this" value="cty.NilVal"
2025-01-06T14:46:18Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.domain_builder_cli_agent.aws_security_group_rule.ingress_traffic" value="cty.NilVal"
2025-01-06T14:46:18Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.domain_builder_cli_agent.aws_autoscaling_group.bastion_linux_daily[0]" err="1 error occurred:\n\t* invalid for-each in aws_autoscaling_group.bastion_linux_daily[0].dynamic.tag block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-06T14:46:18Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.domain_builder_cli_agent.aws_autoscaling_group.bastion_linux_daily[0]" err="1 error occurred:\n\t* invalid for-each in aws_autoscaling_group.bastion_linux_daily[0].dynamic.tag block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-06T14:46:18Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.domain_builder_flyway_Lambda.aws_iam_role_policy_attachment.this" value="cty.NilVal"
2025-01-06T14:46:19Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.ec2_kinesis_agent.aws_security_group_rule.ingress_traffic_from_security_groups" value="cty.NilVal"
2025-01-06T14:46:19Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.ec2_kinesis_agent.aws_autoscaling_group.bastion_linux_daily" err="1 error occurred:\n\t* invalid for-each in aws_autoscaling_group.bastion_linux_daily.dynamic.tag block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-06T14:46:19Z ERROR [terraform evaluator] Failed to expand dynamic block. block="module.ec2_kinesis_agent.aws_autoscaling_group.bastion_linux_daily" err="1 error occurred:\n\t* invalid for-each in aws_autoscaling_group.bastion_linux_daily.dynamic.tag block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-06T14:46:19Z INFO [terraform scanner] Scanning root module file_path="modules/domains/dms-endpoints"
2025-01-06T14:46:19Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="bucket_name, env, project_id, source_app_password, source_app_username"
2025-01-06T14:46:19Z INFO [terraform scanner] Scanning root module file_path="modules/domains/dms-instance"
2025-01-06T14:46:19Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="env, name, project_id"
2025-01-06T14:46:19Z INFO [terraform scanner] Scanning root module file_path="modules/domains/dms-task"
2025-01-06T14:46:19Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="env, project_id"
2025-01-06T14:46:19Z INFO [terraform scanner] Scanning root module file_path="modules/domains/ingestion-jobs"
2025-01-06T14:46:19Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="env, glue_cdc_maintenance_window, jar_version, project_id, script_version"
2025-01-06T14:46:19Z INFO [terraform scanner] Scanning root module file_path="modules/domains/ingestion-pipeline"
2025-01-06T14:46:19Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="archive_job_trigger_name, data_ingestion_pipeline, dms_replication_task_arn, domain, glue_archive_job, glue_hive_table_creation_jobname, glue_maintenance_compaction_job, glue_maintenance_retention_job, glue_reporting_hub_batch_jobname, glue_reporting_hub_cdc_jobname, glue_s3_data_deletion_job, glue_s3_file_transfer_job, glue_s3_max_attempts, glue_s3_retry_max_wait_millis, glue_s3_retry_min_wait_millis, glue_stop_glue_instance_job, glue_switch_prisons_hive_data_location_job, glue_trigger_activation_job, pipeline_notification_lambda_function, replication_task_id, s3_curated_bucket_id, s3_curated_path, s3_glue_bucket_id, s3_raw_archive_bucket_id, s3_raw_bucket_id, s3_structured_bucket_id, s3_structured_path, s3_temp_reload_bucket_id, step_function_execution_role_arn, stop_dms_task_job"
2025-01-06T14:46:19Z INFO [terraform scanner] Scanning root module file_path="modules/domains/maintenance-pipeline"
2025-01-06T14:46:19Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="dms_replication_task_arn, domain, glue_maintenance_compaction_job, glue_maintenance_retention_job, glue_reporting_hub_cdc_jobname, glue_s3_max_attempts, glue_s3_retry_max_wait_millis, glue_s3_retry_min_wait_millis, glue_stop_glue_instance_job, glue_unprocessed_raw_files_check_job, maintenance_pipeline_name, processed_files_check_max_attempts, processed_files_check_wait_interval_seconds, replication_task_id, s3_curated_path, s3_glue_bucket_id, s3_structured_path, step_function_execution_role_arn, stop_dms_task_job"
2025-01-06T14:46:19Z INFO [terraform scanner] Scanning root module file_path="modules/domains/pipeline-lambda"
2025-01-06T14:46:19Z INFO [terraform scanner] Scanning root module file_path="modules/domains/reload-pipeline"
2025-01-06T14:46:19Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="archive_job_trigger_name, dms_replication_task_arn, domain, glue_archive_job, glue_create_reload_diff_job, glue_hive_table_creation_jobname, glue_maintenance_compaction_job, glue_maintenance_retention_job, glue_reporting_hub_batch_jobname, glue_reporting_hub_cdc_jobname, glue_s3_data_deletion_job, glue_s3_file_transfer_job, glue_s3_max_attempts, glue_s3_retry_max_wait_millis, glue_s3_retry_min_wait_millis, glue_stop_glue_instance_job, glue_switch_prisons_hive_data_location_job, glue_trigger_activation_job, glue_unprocessed_raw_files_check_job, pipeline_notification_lambda_function, processed_files_check_max_attempts, processed_files_check_wait_interval_seconds, reload_pipeline, replication_task_id, s3_curated_bucket_id, s3_curated_path, s3_glue_bucket_id, s3_raw_archive_bucket_id, s3_raw_bucket_id, s3_structured_bucket_id, s3_structured_path, s3_temp_reload_bucket_id, step_function_execution_role_arn, stop_dms_task_job"
2025-01-06T14:46:19Z INFO [terraform scanner] Scanning root module file_path="modules/domains/replay-pipeline"
2025-01-06T14:46:19Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="dms_replication_task_arn, glue_maintenance_compaction_job, glue_maintenance_retention_job, glue_s3_max_attempts, glue_s3_retry_max_wait_millis, glue_s3_retry_min_wait_millis, processed_files_check_max_attempts, processed_files_check_wait_interval_seconds, replication_task_id, s3_curated_path, s3_structured_path, step_function_execution_role_arn"
2025-01-06T14:46:19Z INFO [terraform scanner] Scanning root module file_path="modules/domains/start-cdc-pipeline"
2025-01-06T14:46:19Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="dms_replication_task_arn, domain, glue_reporting_hub_cdc_jobname, glue_stop_glue_instance_job, replication_task_id, s3_glue_bucket_id, start_cdc_pipeline, step_function_execution_role_arn, stop_dms_task_job"
2025-01-06T14:46:19Z INFO [terraform scanner] Scanning root module file_path="modules/domains/stop-cdc-pipeline"
2025-01-06T14:46:19Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="glue_reporting_hub_cdc_jobname, glue_stop_glue_instance_job, glue_unprocessed_raw_files_check_job, processed_files_check_max_attempts, processed_files_check_wait_interval_seconds, replication_task_id, step_function_execution_role_arn, stop_cdc_pipeline, stop_dms_task_job"
2025-01-06T14:46:19Z INFO [terraform scanner] Scanning root module file_path="modules/glue_connection"
2025-01-06T14:46:19Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="availability_zone, connection_url, description, name, password, security_groups, subnet, username"
2025-01-06T14:46:19Z INFO [terraform scanner] Scanning root module file_path="modules/pipeline_trigger"
2025-01-06T14:46:19Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="description, pipeline_name, schedule_expression, state_machine_arn, step_function_execution_role_arn"
2025-01-06T14:46:21Z INFO [terraform executor] Ignore finding rule="aws-ec2-no-public-egress-sgr" range="modules/ec2/main.tf:72"
2025-01-06T14:46:22Z INFO Number of language-specific files num=0
2025-01-06T14:46:22Z INFO Detected config files num=32
trivy_exitcode=0

Running Trivy in terraform/environments/digital-prison-reporting/modules/s3_bucket
2025-01-06T14:46:22Z INFO [vuln] Vulnerability scanning is enabled
2025-01-06T14:46:22Z INFO [misconfig] Misconfiguration scanning is enabled
2025-01-06T14:46:22Z INFO [secret] Secret scanning is enabled
2025-01-06T14:46:22Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-06T14:46:22Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-06T14:46:23Z INFO [terraform scanner] Scanning root module file_path="."
2025-01-06T14:46:23Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="tags"
2025-01-06T14:46:23Z INFO Number of language-specific files num=0
2025-01-06T14:46:23Z INFO Detected config files num=1
trivy_exitcode=0

</details> #### `Checkov Scan` Success
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/digital-prison-reporting
terraform/environments/digital-prison-reporting/modules/s3_bucket

*****************************

Running Checkov in terraform/environments/digital-prison-reporting
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2025-01-06 14:46:25,816 [MainThread  ] [WARNI]  Failed to download module ministryofjustice/observability-platform-tenant/aws:1.2.0 (for external modules, the --download-external-modules flag is required)
2025-01-06 14:46:25,816 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-pagerduty-integration?ref=v2.0.0:None (for external modules, the --download-external-modules flag is required)
2025-01-06 14:46:56,084 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:46:56,095 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:46:56,109 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:46:56,121 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:46:56,133 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:46:56,143 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:46:56,154 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:46:56,164 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:46:56,174 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:46:56,184 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:46:56,195 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:46:56,205 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:46:56,216 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:46:56,227 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:46:56,252 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:46:56,263 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:46:56,275 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:46:56,287 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:46:56,298 [MainThread  ] [WARNI]  Error in evaluate_try of argument arn:aws:iam::var.account:policy/aws_iam_policy.additional-policy[0].name - invalid syntax (<string>, line 1)
2025-01-06 14:46:57,831 [MainThread  ] [ERROR]  Failed to invoke function /usr/local/lib/python3.9/dist-packages/checkov/common/runners/runner_registry._parallel_run with (<checkov.terraform.runner.Runner object at 0x7fbb2e904fa0>, '/github/workspace/terraform/environments/digital-prison-reporting', None, None, <checkov.runner_filter.RunnerFilter object at 0x7fbb2e8cdcd0>, True, None)
Traceback (most recent call last):
  File "/usr/local/lib/python3.9/dist-packages/checkov/common/parallelizer/parallel_runner.py", line 72, in func_wrapper
    result = original_func(*item)
  File "/usr/local/lib/python3.9/dist-packages/checkov/common/runners/runner_registry.py", line 836, in _parallel_run
    report = runner.run(
  File "/usr/local/lib/python3.9/dist-packages/checkov/terraform/runner.py", line 134, in run
    self.check_tf_definition(report, root_folder, runner_filter, collect_skip_comments)
  File "/usr/local/lib/python3.9/dist-packages/checkov/terraform/runner.py", line 228, in check_tf_definition
    self.push_skipped_checks_down_from_modules(self.context)
  File "/usr/local/lib/python3.9/dist-packages/checkov/terraform/runner.py", line 254, in push_skipped_checks_down_from_modules
    self.push_skipped_checks_down(definition_context, skipped_checks, resolved_paths)
  File "/usr/local/lib/python3.9/dist-packages/checkov/terraform/runner.py", line 293, in push_skipped_checks_down
    resource_config["skipped_checks"] += skipped_checks
TypeError: 'int' object is not subscriptable

checkov_exitcode=0

*****************************

Running Checkov in terraform/environments/digital-prison-reporting/modules/s3_bucket
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
terraform scan results:

Passed checks: 12, Failed checks: 0, Skipped checks: 5


checkov_exitcode=0

CTFLint Scan Success

Show Output 
*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
terraform/environments/digital-prison-reporting
terraform/environments/digital-prison-reporting/modules/s3_bucket

*****************************

Running tflint in terraform/environments/digital-prison-reporting
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=0

*****************************

Running tflint in terraform/environments/digital-prison-reporting/modules/s3_bucket
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=0

Trivy Scan Success

Show Output 
*****************************

Trivy will check the following folders:
terraform/environments/digital-prison-reporting
terraform/environments/digital-prison-reporting/modules/s3_bucket

*****************************

Running Trivy in terraform/environments/digital-prison-reporting
2025-01-06T14:46:11Z	INFO	[vulndb] Need to update DB
2025-01-06T14:46:11Z	INFO	[vulndb] Downloading vulnerability DB...
2025-01-06T14:46:11Z	INFO	[vulndb] Downloading artifact...	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-06T14:46:14Z	INFO	[vulndb] Artifact successfully downloaded	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2025-01-06T14:46:14Z	INFO	[vuln] Vulnerability scanning is enabled
2025-01-06T14:46:14Z	INFO	[misconfig] Misconfiguration scanning is enabled
2025-01-06T14:46:14Z	INFO	[misconfig] Need to update the built-in checks
2025-01-06T14:46:14Z	INFO	[misconfig] Downloading the built-in checks...
160.80 KiB / 160.80 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2025-01-06T14:46:14Z	INFO	[secret] Secret scanning is enabled
2025-01-06T14:46:14Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-06T14:46:14Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-06T14:46:17Z	INFO	[terraform scanner] Scanning root module	file_path="."
2025-01-06T14:46:17Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="networking"
2025-01-06T14:46:17Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_glue_connection.glue_dps_connection" value="cty.NilVal"
2025-01-06T14:46:17Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_iam_role_policy_attachment.redshift_spectrum" value="cty.NilVal"
2025-01-06T14:46:17Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_secretsmanager_secret.dps" value="cty.NilVal"
2025-01-06T14:46:17Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_secretsmanager_secret_version.dps" value="cty.NilVal"
2025-01-06T14:46:17Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="data.aws_secretsmanager_secret.dps" value="cty.NilVal"
2025-01-06T14:46:17Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="data.aws_secretsmanager_secret_version.dps" value="cty.NilVal"
2025-01-06T14:46:18Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.aws_s3_data_migrate.aws_iam_role_policy_attachment.this" value="cty.NilVal"
2025-01-06T14:46:18Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.datamart.aws_redshift_authentication_profile.this" value="cty.NilVal"
2025-01-06T14:46:18Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.datamart.aws_redshift_scheduled_action.this" value="cty.NilVal"
2025-01-06T14:46:18Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.datamart.aws_redshift_usage_limit.this" value="cty.NilVal"
2025-01-06T14:46:18Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datamart.aws_redshift_cluster.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_redshift_cluster.this[0].dynamic.logging block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-06T14:46:18Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.datamart.aws_redshift_cluster.this[0]" err="1 error occurred:\n\t* invalid for-each in aws_redshift_cluster.this[0].dynamic.logging block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-06T14:46:18Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.domain_builder_backend_Lambda.aws_iam_role_policy_attachment.this" value="cty.NilVal"
2025-01-06T14:46:18Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.domain_builder_cli_agent.aws_iam_role_policy_attachment.this" value="cty.NilVal"
2025-01-06T14:46:18Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.domain_builder_cli_agent.aws_security_group_rule.ingress_traffic" value="cty.NilVal"
2025-01-06T14:46:18Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.domain_builder_cli_agent.aws_autoscaling_group.bastion_linux_daily[0]" err="1 error occurred:\n\t* invalid for-each in aws_autoscaling_group.bastion_linux_daily[0].dynamic.tag block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-06T14:46:18Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.domain_builder_cli_agent.aws_autoscaling_group.bastion_linux_daily[0]" err="1 error occurred:\n\t* invalid for-each in aws_autoscaling_group.bastion_linux_daily[0].dynamic.tag block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-06T14:46:18Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.domain_builder_flyway_Lambda.aws_iam_role_policy_attachment.this" value="cty.NilVal"
2025-01-06T14:46:19Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.ec2_kinesis_agent.aws_security_group_rule.ingress_traffic_from_security_groups" value="cty.NilVal"
2025-01-06T14:46:19Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.ec2_kinesis_agent.aws_autoscaling_group.bastion_linux_daily" err="1 error occurred:\n\t* invalid for-each in aws_autoscaling_group.bastion_linux_daily.dynamic.tag block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-06T14:46:19Z	ERROR	[terraform evaluator] Failed to expand dynamic block.	block="module.ec2_kinesis_agent.aws_autoscaling_group.bastion_linux_daily" err="1 error occurred:\n\t* invalid for-each in aws_autoscaling_group.bastion_linux_daily.dynamic.tag block: cannot use a cty.NilVal value in for_each. An iterable collection is required\n\n"
2025-01-06T14:46:19Z	INFO	[terraform scanner] Scanning root module	file_path="modules/domains/dms-endpoints"
2025-01-06T14:46:19Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="bucket_name, env, project_id, source_app_password, source_app_username"
2025-01-06T14:46:19Z	INFO	[terraform scanner] Scanning root module	file_path="modules/domains/dms-instance"
2025-01-06T14:46:19Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="env, name, project_id"
2025-01-06T14:46:19Z	INFO	[terraform scanner] Scanning root module	file_path="modules/domains/dms-task"
2025-01-06T14:46:19Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="env, project_id"
2025-01-06T14:46:19Z	INFO	[terraform scanner] Scanning root module	file_path="modules/domains/ingestion-jobs"
2025-01-06T14:46:19Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="env, glue_cdc_maintenance_window, jar_version, project_id, script_version"
2025-01-06T14:46:19Z	INFO	[terraform scanner] Scanning root module	file_path="modules/domains/ingestion-pipeline"
2025-01-06T14:46:19Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="archive_job_trigger_name, data_ingestion_pipeline, dms_replication_task_arn, domain, glue_archive_job, glue_hive_table_creation_jobname, glue_maintenance_compaction_job, glue_maintenance_retention_job, glue_reporting_hub_batch_jobname, glue_reporting_hub_cdc_jobname, glue_s3_data_deletion_job, glue_s3_file_transfer_job, glue_s3_max_attempts, glue_s3_retry_max_wait_millis, glue_s3_retry_min_wait_millis, glue_stop_glue_instance_job, glue_switch_prisons_hive_data_location_job, glue_trigger_activation_job, pipeline_notification_lambda_function, replication_task_id, s3_curated_bucket_id, s3_curated_path, s3_glue_bucket_id, s3_raw_archive_bucket_id, s3_raw_bucket_id, s3_structured_bucket_id, s3_structured_path, s3_temp_reload_bucket_id, step_function_execution_role_arn, stop_dms_task_job"
2025-01-06T14:46:19Z	INFO	[terraform scanner] Scanning root module	file_path="modules/domains/maintenance-pipeline"
2025-01-06T14:46:19Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="dms_replication_task_arn, domain, glue_maintenance_compaction_job, glue_maintenance_retention_job, glue_reporting_hub_cdc_jobname, glue_s3_max_attempts, glue_s3_retry_max_wait_millis, glue_s3_retry_min_wait_millis, glue_stop_glue_instance_job, glue_unprocessed_raw_files_check_job, maintenance_pipeline_name, processed_files_check_max_attempts, processed_files_check_wait_interval_seconds, replication_task_id, s3_curated_path, s3_glue_bucket_id, s3_structured_path, step_function_execution_role_arn, stop_dms_task_job"
2025-01-06T14:46:19Z	INFO	[terraform scanner] Scanning root module	file_path="modules/domains/pipeline-lambda"
2025-01-06T14:46:19Z	INFO	[terraform scanner] Scanning root module	file_path="modules/domains/reload-pipeline"
2025-01-06T14:46:19Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="archive_job_trigger_name, dms_replication_task_arn, domain, glue_archive_job, glue_create_reload_diff_job, glue_hive_table_creation_jobname, glue_maintenance_compaction_job, glue_maintenance_retention_job, glue_reporting_hub_batch_jobname, glue_reporting_hub_cdc_jobname, glue_s3_data_deletion_job, glue_s3_file_transfer_job, glue_s3_max_attempts, glue_s3_retry_max_wait_millis, glue_s3_retry_min_wait_millis, glue_stop_glue_instance_job, glue_switch_prisons_hive_data_location_job, glue_trigger_activation_job, glue_unprocessed_raw_files_check_job, pipeline_notification_lambda_function, processed_files_check_max_attempts, processed_files_check_wait_interval_seconds, reload_pipeline, replication_task_id, s3_curated_bucket_id, s3_curated_path, s3_glue_bucket_id, s3_raw_archive_bucket_id, s3_raw_bucket_id, s3_structured_bucket_id, s3_structured_path, s3_temp_reload_bucket_id, step_function_execution_role_arn, stop_dms_task_job"
2025-01-06T14:46:19Z	INFO	[terraform scanner] Scanning root module	file_path="modules/domains/replay-pipeline"
2025-01-06T14:46:19Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="dms_replication_task_arn, glue_maintenance_compaction_job, glue_maintenance_retention_job, glue_s3_max_attempts, glue_s3_retry_max_wait_millis, glue_s3_retry_min_wait_millis, processed_files_check_max_attempts, processed_files_check_wait_interval_seconds, replication_task_id, s3_curated_path, s3_structured_path, step_function_execution_role_arn"
2025-01-06T14:46:19Z	INFO	[terraform scanner] Scanning root module	file_path="modules/domains/start-cdc-pipeline"
2025-01-06T14:46:19Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="dms_replication_task_arn, domain, glue_reporting_hub_cdc_jobname, glue_stop_glue_instance_job, replication_task_id, s3_glue_bucket_id, start_cdc_pipeline, step_function_execution_role_arn, stop_dms_task_job"
2025-01-06T14:46:19Z	INFO	[terraform scanner] Scanning root module	file_path="modules/domains/stop-cdc-pipeline"
2025-01-06T14:46:19Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="glue_reporting_hub_cdc_jobname, glue_stop_glue_instance_job, glue_unprocessed_raw_files_check_job, processed_files_check_max_attempts, processed_files_check_wait_interval_seconds, replication_task_id, step_function_execution_role_arn, stop_cdc_pipeline, stop_dms_task_job"
2025-01-06T14:46:19Z	INFO	[terraform scanner] Scanning root module	file_path="modules/glue_connection"
2025-01-06T14:46:19Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="availability_zone, connection_url, description, name, password, security_groups, subnet, username"
2025-01-06T14:46:19Z	INFO	[terraform scanner] Scanning root module	file_path="modules/pipeline_trigger"
2025-01-06T14:46:19Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="description, pipeline_name, schedule_expression, state_machine_arn, step_function_execution_role_arn"
2025-01-06T14:46:21Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-no-public-egress-sgr" range="modules/ec2/main.tf:72"
2025-01-06T14:46:22Z	INFO	Number of language-specific files	num=0
2025-01-06T14:46:22Z	INFO	Detected config files	num=32
trivy_exitcode=0

*****************************

Running Trivy in terraform/environments/digital-prison-reporting/modules/s3_bucket
2025-01-06T14:46:22Z	INFO	[vuln] Vulnerability scanning is enabled
2025-01-06T14:46:22Z	INFO	[misconfig] Misconfiguration scanning is enabled
2025-01-06T14:46:22Z	INFO	[secret] Secret scanning is enabled
2025-01-06T14:46:22Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-01-06T14:46:22Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-01-06T14:46:23Z	INFO	[terraform scanner] Scanning root module	file_path="."
2025-01-06T14:46:23Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="tags"
2025-01-06T14:46:23Z	INFO	Number of language-specific files	num=0
2025-01-06T14:46:23Z	INFO	Detected config files	num=1
trivy_exitcode=0

@stalwartstu stalwartstu had a problem deploying to digital-prison-reporting-development January 6, 2025 14:48 — with GitHub Actions Error
@stalwartstu stalwartstu had a problem deploying to digital-prison-reporting-test January 6, 2025 14:48 — with GitHub Actions Error
@stalwartstu stalwartstu merged commit fa7df67 into main Jan 6, 2025
10 of 14 checks passed
@stalwartstu stalwartstu deleted the feature/DPR2-1576-s3-expiration branch January 6, 2025 15:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@koladeadewuyi-moj koladeadewuyi-moj koladeadewuyi-moj approved these changes

Assignees
No one assigned
Labels
environments-repository Used to exclude PRs from this repo in our Slack PR update
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@stalwartstu @koladeadewuyi-moj