update module with latest changes #54

yadavprakash · 2023-07-24T13:51:58Z

what

update module with latest changes
add acl resource
add cloudwatch flow log resource

why

acl deprecation warning showing
nedd cloudwatch logs group for vpc flow log

… to be published in cloudwatch

_example/basic/example.tf

_example/vpc-flow-logs-cloudwatch/example.tf

clouddrove-ci · 2023-07-24T13:54:25Z

`Terraform Security Scan` Failed

Show Output

Result #1 MEDIUM VPC Flow Logs is not enabled for VPC  ──────────────────────────────────────────────────────────────────────────────── main.tf:25-48 ──────────────────────────────────────────────────────────────────────────────── 25 ┌ resource "aws_vpc" "default" { 26 │ count = var.enable ? 1 : 0 27 │ cidr_block = var.ipam_pool_enable ? null : var.cidr_block 28 │ ipv4_ipam_pool_id = var.ipv4_ipam_pool_id 29 │ ipv4_netmask_length = var.ipv4_netmask_length 30 │ ipv6_cidr_block = var.ipv6_cidr_block 31 │ ipv6_ipam_pool_id = var.ipv6_ipam_pool_id 32 │ ipv6_netmask_length = var.ipv6_netmask_length 33 └ instance_tenancy = var.instance_tenancy .. ──────────────────────────────────────────────────────────────────────────────── ID aws-ec2-require-vpc-flow-logs-for-all-vpcs Impact Without VPC flow logs, you risk not having enough information about network traffic flow to investigate incidents or identify security issues. Resolution Enable flow logs for VPC More Information - https://aquasecurity.github.io/tfsec/latest/checks/aws/ec2/require-vpc-flow-logs-for-all-vpcs/ ──────────────────────────────────────────────────────────────────────────────── timings ────────────────────────────────────────── disk i/o 162.401µs parsing 102.985864ms adaptation 112.601µs checks 20.482972ms total 123.743838ms counts ────────────────────────────────────────── modules downloaded 0 modules processed 1 blocks processed 93 files read 4 results ────────────────────────────────────────── passed 2 ignored 0 critical 0 high 0 medium 1 low 0 2 passed, 1 potential problem(s) detected.

clouddrove-ci · 2023-07-24T13:55:05Z

`Terraform Security Scan` Failed

Show Output

Result #1 MEDIUM VPC Flow Logs is not enabled for VPC  ──────────────────────────────────────────────────────────────────────────────── main.tf:25-48 ──────────────────────────────────────────────────────────────────────────────── 25 ┌ resource "aws_vpc" "default" { 26 │ count = var.enable ? 1 : 0 27 │ cidr_block = var.ipam_pool_enable ? null : var.cidr_block 28 │ ipv4_ipam_pool_id = var.ipv4_ipam_pool_id 29 │ ipv4_netmask_length = var.ipv4_netmask_length 30 │ ipv6_cidr_block = var.ipv6_cidr_block 31 │ ipv6_ipam_pool_id = var.ipv6_ipam_pool_id 32 │ ipv6_netmask_length = var.ipv6_netmask_length 33 └ instance_tenancy = var.instance_tenancy .. ──────────────────────────────────────────────────────────────────────────────── ID aws-ec2-require-vpc-flow-logs-for-all-vpcs Impact Without VPC flow logs, you risk not having enough information about network traffic flow to investigate incidents or identify security issues. Resolution Enable flow logs for VPC More Information - https://aquasecurity.github.io/tfsec/latest/checks/aws/ec2/require-vpc-flow-logs-for-all-vpcs/ ──────────────────────────────────────────────────────────────────────────────── timings ────────────────────────────────────────── disk i/o 151.006µs parsing 76.56701ms adaptation 96.002µs checks 13.387834ms total 90.201852ms counts ────────────────────────────────────────── modules downloaded 0 modules processed 1 blocks processed 94 files read 4 results ────────────────────────────────────────── passed 2 ignored 0 critical 0 high 0 medium 1 low 0 2 passed, 1 potential problem(s) detected.

clouddrove-ci · 2023-07-24T13:55:44Z

`Terraform Security Scan` Failed

Show Output

Result #1 MEDIUM VPC Flow Logs is not enabled for VPC  ──────────────────────────────────────────────────────────────────────────────── main.tf:25-48 ──────────────────────────────────────────────────────────────────────────────── 25 ┌ resource "aws_vpc" "default" { 26 │ count = var.enable ? 1 : 0 27 │ cidr_block = var.ipam_pool_enable ? null : var.cidr_block 28 │ ipv4_ipam_pool_id = var.ipv4_ipam_pool_id 29 │ ipv4_netmask_length = var.ipv4_netmask_length 30 │ ipv6_cidr_block = var.ipv6_cidr_block 31 │ ipv6_ipam_pool_id = var.ipv6_ipam_pool_id 32 │ ipv6_netmask_length = var.ipv6_netmask_length 33 └ instance_tenancy = var.instance_tenancy .. ──────────────────────────────────────────────────────────────────────────────── ID aws-ec2-require-vpc-flow-logs-for-all-vpcs Impact Without VPC flow logs, you risk not having enough information about network traffic flow to investigate incidents or identify security issues. Resolution Enable flow logs for VPC More Information - https://aquasecurity.github.io/tfsec/latest/checks/aws/ec2/require-vpc-flow-logs-for-all-vpcs/ ──────────────────────────────────────────────────────────────────────────────── timings ────────────────────────────────────────── disk i/o 114.4µs parsing 113.300611ms adaptation 86.4µs checks 14.698701ms total 128.200112ms counts ────────────────────────────────────────── modules downloaded 0 modules processed 1 blocks processed 94 files read 4 results ────────────────────────────────────────── passed 2 ignored 0 critical 0 high 0 medium 1 low 0 2 passed, 1 potential problem(s) detected.

clouddrove-ci · 2023-07-24T14:49:21Z

`Terraform Security Scan` Failed

Show Output

Result #1 MEDIUM VPC Flow Logs is not enabled for VPC  ──────────────────────────────────────────────────────────────────────────────── main.tf:25-48 ──────────────────────────────────────────────────────────────────────────────── 25 ┌ resource "aws_vpc" "default" { 26 │ count = var.enable ? 1 : 0 27 │ cidr_block = var.ipam_pool_enable ? null : var.cidr_block 28 │ ipv4_ipam_pool_id = var.ipv4_ipam_pool_id 29 │ ipv4_netmask_length = var.ipv4_netmask_length 30 │ ipv6_cidr_block = var.ipv6_cidr_block 31 │ ipv6_ipam_pool_id = var.ipv6_ipam_pool_id 32 │ ipv6_netmask_length = var.ipv6_netmask_length 33 └ instance_tenancy = var.instance_tenancy .. ──────────────────────────────────────────────────────────────────────────────── ID aws-ec2-require-vpc-flow-logs-for-all-vpcs Impact Without VPC flow logs, you risk not having enough information about network traffic flow to investigate incidents or identify security issues. Resolution Enable flow logs for VPC More Information - https://aquasecurity.github.io/tfsec/latest/checks/aws/ec2/require-vpc-flow-logs-for-all-vpcs/ ──────────────────────────────────────────────────────────────────────────────── timings ────────────────────────────────────────── disk i/o 132.297µs parsing 54.720944ms adaptation 85.099µs checks 13.603762ms total 68.542102ms counts ────────────────────────────────────────── modules downloaded 0 modules processed 1 blocks processed 94 files read 4 results ────────────────────────────────────────── passed 2 ignored 0 critical 0 high 0 medium 1 low 0 2 passed, 1 potential problem(s) detected.

_example/basic/example.tf

_example/complete/example.tf

+module "vpc" {
+ source = "../.."
+ name = "vpc"
+ environment = "example"
+ cidr_block = "10.0.0.0/16"
+ enable_flow_log = true
+ flow_log_destination_type = "s3" # Comment or remove when flow log destination is set "cloud-watch-logs"
+ flow_logs_bucket_name = "gc-vpc-flow-logs-bucket" # Comment or remove when flow log destination is set "cloud-watch-logs"
+ # create_flow_log_cloudwatch_iam_role = true # To be uncomment when flow log destination is set "cloud-watch-logs"
+ additional_cidr_block = ["172.3.0.0/16", "172.2.0.0/16"]
+ dhcp_options_domain_name = "service.consul"
+ dhcp_options_domain_name_servers = ["127.0.0.1", "10.10.0.2"]
+}


_example/complete/example.tf

+module "vpc" {
+ source = "../.."
+ name = "vpc"
+ environment = "example"
+ cidr_block = "10.0.0.0/16"
+ enable_flow_log = true
+ flow_log_destination_type = "s3" # Comment or remove when flow log destination is set "cloud-watch-logs"
+ flow_logs_bucket_name = "gc-vpc-flow-logs-bucket" # Comment or remove when flow log destination is set "cloud-watch-logs"
+ # create_flow_log_cloudwatch_iam_role = true # To be uncomment when flow log destination is set "cloud-watch-logs"
+ additional_cidr_block = ["172.3.0.0/16", "172.2.0.0/16"]
+ dhcp_options_domain_name = "service.consul"
+ dhcp_options_domain_name_servers = ["127.0.0.1", "10.10.0.2"]
+}


clouddrove-ci · 2023-07-24T15:58:30Z

`Terraform Security Scan` Failed

Show Output

Result #1 MEDIUM VPC Flow Logs is not enabled for VPC  ──────────────────────────────────────────────────────────────────────────────── main.tf:20-43 ──────────────────────────────────────────────────────────────────────────────── 20 ┌ resource "aws_vpc" "default" { 21 │ count = var.enable ? 1 : 0 22 │ cidr_block = var.ipam_pool_enable ? null : var.cidr_block 23 │ ipv4_ipam_pool_id = var.ipv4_ipam_pool_id 24 │ ipv4_netmask_length = var.ipv4_netmask_length 25 │ ipv6_cidr_block = var.ipv6_cidr_block 26 │ ipv6_ipam_pool_id = var.ipv6_ipam_pool_id 27 │ ipv6_netmask_length = var.ipv6_netmask_length 28 └ instance_tenancy = var.instance_tenancy .. ──────────────────────────────────────────────────────────────────────────────── ID aws-ec2-require-vpc-flow-logs-for-all-vpcs Impact Without VPC flow logs, you risk not having enough information about network traffic flow to investigate incidents or identify security issues. Resolution Enable flow logs for VPC More Information - https://aquasecurity.github.io/tfsec/latest/checks/aws/ec2/require-vpc-flow-logs-for-all-vpcs/ ──────────────────────────────────────────────────────────────────────────────── timings ────────────────────────────────────────── disk i/o 147.404µs parsing 72.704509ms adaptation 107.903µs checks 13.188364ms total 86.14818ms counts ────────────────────────────────────────── modules downloaded 0 modules processed 1 blocks processed 94 files read 4 results ────────────────────────────────────────── passed 2 ignored 0 critical 0 high 0 medium 1 low 0 2 passed, 1 potential problem(s) detected.

clouddrove-ci · 2023-07-24T16:00:58Z

`Terraform Security Scan` Failed

Show Output

Result #1 MEDIUM VPC Flow Logs is not enabled for VPC  ──────────────────────────────────────────────────────────────────────────────── main.tf:20-43 ──────────────────────────────────────────────────────────────────────────────── 20 ┌ resource "aws_vpc" "default" { 21 │ count = var.enable ? 1 : 0 22 │ cidr_block = var.ipam_pool_enable ? null : var.cidr_block 23 │ ipv4_ipam_pool_id = var.ipv4_ipam_pool_id 24 │ ipv4_netmask_length = var.ipv4_netmask_length 25 │ ipv6_cidr_block = var.ipv6_cidr_block 26 │ ipv6_ipam_pool_id = var.ipv6_ipam_pool_id 27 │ ipv6_netmask_length = var.ipv6_netmask_length 28 └ instance_tenancy = var.instance_tenancy .. ──────────────────────────────────────────────────────────────────────────────── ID aws-ec2-require-vpc-flow-logs-for-all-vpcs Impact Without VPC flow logs, you risk not having enough information about network traffic flow to investigate incidents or identify security issues. Resolution Enable flow logs for VPC More Information - https://aquasecurity.github.io/tfsec/latest/checks/aws/ec2/require-vpc-flow-logs-for-all-vpcs/ ──────────────────────────────────────────────────────────────────────────────── timings ────────────────────────────────────────── disk i/o 728.608µs parsing 84.128697ms adaptation 93.501µs checks 8.644002ms total 93.594808ms counts ────────────────────────────────────────── modules downloaded 0 modules processed 1 blocks processed 94 files read 4 results ────────────────────────────────────────── passed 2 ignored 0 critical 0 high 0 medium 1 low 0 2 passed, 1 potential problem(s) detected.

clouddrove-ci · 2023-07-25T10:19:03Z

`Terraform Security Scan` Failed

Show Output

Result #1 MEDIUM VPC Flow Logs is not enabled for VPC  ──────────────────────────────────────────────────────────────────────────────── main.tf:20-43 ──────────────────────────────────────────────────────────────────────────────── 20 ┌ resource "aws_vpc" "default" { 21 │ count = var.enable ? 1 : 0 22 │ cidr_block = var.ipam_pool_enable ? null : var.cidr_block 23 │ ipv4_ipam_pool_id = var.ipv4_ipam_pool_id 24 │ ipv4_netmask_length = var.ipv4_netmask_length 25 │ ipv6_cidr_block = var.ipv6_cidr_block 26 │ ipv6_ipam_pool_id = var.ipv6_ipam_pool_id 27 │ ipv6_netmask_length = var.ipv6_netmask_length 28 └ instance_tenancy = var.instance_tenancy .. ──────────────────────────────────────────────────────────────────────────────── ID aws-ec2-require-vpc-flow-logs-for-all-vpcs Impact Without VPC flow logs, you risk not having enough information about network traffic flow to investigate incidents or identify security issues. Resolution Enable flow logs for VPC More Information - https://aquasecurity.github.io/tfsec/latest/checks/aws/ec2/require-vpc-flow-logs-for-all-vpcs/ ──────────────────────────────────────────────────────────────────────────────── timings ────────────────────────────────────────── disk i/o 713.838µs parsing 116.283626ms adaptation 128.107µs checks 9.588913ms total 126.714484ms counts ────────────────────────────────────────── modules downloaded 0 modules processed 1 blocks processed 94 files read 4 results ────────────────────────────────────────── passed 2 ignored 0 critical 0 high 0 medium 1 low 0 2 passed, 1 potential problem(s) detected.

…ate resource

anmolnagpal and others added 9 commits July 21, 2023 19:07

fix acl deprecated warning

341f695

feat: Updated resources to be dynamic and added support for flow logs…

16ad441

… to be published in cloudwatch

feat: Added cloudwatch resource

25f99bd

feat: Added test example and modified main.tf

95a1a68

fix: Fixed kms key policy and updated example folder

309542d

update module with latest changes

93bc774

update module with latest changes

3b4742e

update module with latest changes

05ca287

update module with latest changes

3fe7295

yadavprakash requested review from anmolnagpal and clouddrove-ci as code owners July 24, 2023 13:51

clouddrove-ci self-assigned this Jul 24, 2023

update module with latest changes

be7a6ee

github-advanced-security bot found potential problems Jul 24, 2023

View reviewed changes

_example/basic/example.tf Fixed Show fixed Hide fixed

_example/vpc-flow-logs-cloudwatch/example.tf Fixed Show fixed Hide fixed

_example/vpc-flow-logs-cloudwatch/example.tf Fixed Show fixed Hide fixed

update module with latest changes

c90dc3d

fix: Fixed vulnerabilities

a0ac339

fix: Updated comments and example folder heirarchy

9537489

github-advanced-security bot found potential problems Jul 24, 2023

View reviewed changes

fix: Fixed directory in workflows

6bb0fb9

fix: Fixed _example/complete and dependabot.yml

b59d760

13archit and others added 2 commits July 25, 2023 18:27

fix: Added ignore for vpc flow log error because it enabled via separ…

8e70e44

…ate resource

fix: updated github actions

b07fc3c

dverma-cd merged commit b350e0a into master Jul 26, 2023

delete-merged-branch bot deleted the feat/issue-234-a branch July 26, 2023 13:17

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

update module with latest changes #54

update module with latest changes #54

Uh oh!

yadavprakash commented Jul 24, 2023

Uh oh!

Uh oh!

Uh oh!

clouddrove-ci commented Jul 24, 2023

clouddrove-ci commented Jul 24, 2023

clouddrove-ci commented Jul 24, 2023

clouddrove-ci commented Jul 24, 2023

Uh oh!

Uh oh!

Check warning

Check warning

clouddrove-ci commented Jul 24, 2023

clouddrove-ci commented Jul 24, 2023

clouddrove-ci commented Jul 25, 2023

Labels

7 participants

update module with latest changes #54

update module with latest changes #54

Uh oh!

Conversation

yadavprakash commented Jul 24, 2023

what

why

Uh oh!

Uh oh!

Uh oh!

clouddrove-ci commented Jul 24, 2023

Terraform Security Scan Failed

clouddrove-ci commented Jul 24, 2023

Terraform Security Scan Failed

clouddrove-ci commented Jul 24, 2023

Terraform Security Scan Failed

clouddrove-ci commented Jul 24, 2023

Terraform Security Scan Failed

Uh oh!

Uh oh!

Check warning

Check warning

clouddrove-ci commented Jul 24, 2023

Terraform Security Scan Failed

clouddrove-ci commented Jul 24, 2023

Terraform Security Scan Failed

clouddrove-ci commented Jul 25, 2023

Terraform Security Scan Failed

Labels

7 participants

`Terraform Security Scan` Failed

`Terraform Security Scan` Failed

`Terraform Security Scan` Failed

`Terraform Security Scan` Failed

`Terraform Security Scan` Failed

`Terraform Security Scan` Failed

`Terraform Security Scan` Failed