Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bump clouddrove/kms/aws from 1.3.0 to 1.3.1 #30

Closed
wants to merge 1 commit into from
Closed

Bump clouddrove/kms/aws from 1.3.0 to 1.3.1 #30

wants to merge 1 commit into from

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Aug 28, 2023 •
edited
Loading

Bumps clouddrove/kms/aws from 1.3.0 to 1.3.1.

Release notes

Sourced from clouddrove/kms/aws's releases.

1.3.1

✨ New Features

🐛 Bug Fixes

Changelog

Sourced from clouddrove/kms/aws's changelog.

[1.3.1] - 2023-08-25

✨ New Features

🐛 Bug Fixes

Commits
  • 3bb2189 update README.md
  • 8ee2464 Merge pull request #29 from clouddrove/feat/identos-issue-239
  • bb380b0 feat: Added example for replica key.
  • 0d23637 fix: Fixed tfsec and tflint workflow
  • caa35b8 fix: Update tf-checks workflow
  • 95144e7 fix: Update workflows and examples
  • f59fbc3 feat: added Replica-Key and Replica-External-Key(CMK)
  • 0b1ba7c update README.md
  • fd30b44 Merge pull request #28 from clouddrove/issue-451
  • ed524c9 bug: update readme.yaml
  • Additional commits viewable in compare view

Dependabot compatibility score

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot
Bump clouddrove/kms/aws from 1.3.0 to 1.3.1
adee1e7 
Bumps [clouddrove/kms/aws](https://github.com/clouddrove/terraform-aws-kms) from 1.3.0 to 1.3.1.
- [Release notes](https://github.com/clouddrove/terraform-aws-kms/releases)
- [Changelog](https://github.com/clouddrove/terraform-aws-kms/blob/master/CHANGELOG.md)
- [Commits](clouddrove/terraform-aws-kms@1.3.0...1.3.1)

---
updated-dependencies:
- dependency-name: clouddrove/kms/aws
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file terraform Pull requests that update Terraform code labels Aug 28, 2023
@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Aug 28, 2023

Dependabot tried to add @approvers as a reviewer to this PR, but received the following error from GitHub:

POST https://api.github.com/repos/clouddrove/terraform-aws-secure-baseline/pulls/30/requested_reviewers: 422 - Reviews may only be requested from collaborators. One or more of the users or teams you specified is not a collaborator of the clouddrove/terraform-aws-secure-baseline repository. // See: https://docs.github.com/rest/pulls/review-requests#request-reviewers-for-a-pull-request

@anmolnagpal
Copy link
Contributor

Terraform Security Scan Failed

Show Output 
Result #1 HIGH No public access block so not ignoring public acls 
────────────────────────────────────────────────────────────────────────────────
  modules/guardduty/main.tf:22-26
   via main.tf:116-138 (module.guardduty)
────────────────────────────────────────────────────────────────────────────────
   22    resource "aws_s3_bucket" "bucket" {
   23      count         = var.enabled ? 1 : 0
   24      bucket        = var.bucket_name
   25      force_destroy = true
   26    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-s3-ignore-public-acls
      Impact PUT calls with public ACLs specified can make objects public
  Resolution Enable ignoring the application of public ACLs in PUT calls

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/s3/ignore-public-acls/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block#ignore_public_acls
────────────────────────────────────────────────────────────────────────────────


Result #2 HIGH No public access block so not restricting public buckets 
────────────────────────────────────────────────────────────────────────────────
  modules/guardduty/main.tf:22-26
   via main.tf:116-138 (module.guardduty)
────────────────────────────────────────────────────────────────────────────────
   22    resource "aws_s3_bucket" "bucket" {
   23      count         = var.enabled ? 1 : 0
   24      bucket        = var.bucket_name
   25      force_destroy = true
   26    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-s3-no-public-buckets
      Impact Public buckets can be accessed by anyone
  Resolution Limit the access to public buckets to only the owner or AWS Services (eg; CloudFront)

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/s3/no-public-buckets/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block#restrict_public_buckets¡
────────────────────────────────────────────────────────────────────────────────


Result #3 MEDIUM Bucket does not have logging enabled 
────────────────────────────────────────────────────────────────────────────────
  modules/guardduty/main.tf:22-26
   via main.tf:116-138 (module.guardduty)
────────────────────────────────────────────────────────────────────────────────
   22    resource "aws_s3_bucket" "bucket" {
   23      count         = var.enabled ? 1 : 0
   24      bucket        = var.bucket_name
   25      force_destroy = true
   26    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-s3-enable-bucket-logging
      Impact There is no way to determine the access to this bucket
  Resolution Add a logging block to the resource to enable access logging

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/s3/enable-bucket-logging/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket
────────────────────────────────────────────────────────────────────────────────


Result #4 MEDIUM Bucket does not have versioning enabled 
────────────────────────────────────────────────────────────────────────────────
  modules/guardduty/main.tf:22-26
   via main.tf:116-138 (module.guardduty)
────────────────────────────────────────────────────────────────────────────────
   22    resource "aws_s3_bucket" "bucket" {
   23      count         = var.enabled ? 1 : 0
   24      bucket        = var.bucket_name
   25      force_destroy = true
   26    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-s3-enable-versioning
      Impact Deleted or modified data would not be recoverable
  Resolution Enable versioning to protect against accidental/malicious removal or modification

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/s3/enable-versioning/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#versioning
────────────────────────────────────────────────────────────────────────────────


Result #5 MEDIUM Password policy allows a maximum password age of greater than 90 days. 
────────────────────────────────────────────────────────────────────────────────
  modules/iam/main.tf:28
   via main.tf:229-251 (module.aws-iam-baseline)
────────────────────────────────────────────────────────────────────────────────
   19    resource "aws_iam_account_password_policy" "default" {
   20      count                          = var.aws_iam_account_password_policy ? 1 : 0
   21      minimum_password_length        = var.minimum_password_length
   22      password_reuse_prevention      = var.password_reuse_prevention
   23      require_lowercase_characters   = var.require_lowercase_characters
   24      require_numbers                = var.require_numbers
   25      require_uppercase_characters   = var.require_uppercase_characters
   26      require_symbols                = var.require_symbols
   27      allow_users_to_change_password = var.allow_users_to_change_password
   ..  
────────────────────────────────────────────────────────────────────────────────
          ID aws-iam-set-max-password-age
      Impact Long life password increase the likelihood of a password eventually being compromised
  Resolution Limit the password duration with an expiry in the policy

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/iam/set-max-password-age/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_account_password_policy
────────────────────────────────────────────────────────────────────────────────


Result #6 LOW Log group is not encrypted. 
────────────────────────────────────────────────────────────────────────────────
  modules/cloudtrail/main.tf:135-140
   via main.tf:5-30 (module.cloudtrail)
────────────────────────────────────────────────────────────────────────────────
  135    resource "aws_cloudwatch_log_group" "cloudtrail_events" {
  136      count             = var.enabled ? 1 : 0
  137      name              = var.cloudwatch_logs_group_name
  138      retention_in_days = var.cloudwatch_logs_retention_in_days
  139      tags              = module.labels.tags
  140    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-cloudwatch-log-group-customer-key
      Impact Log data may be leaked if the logs are compromised. No auditing of who have viewed the logs.
  Resolution Enable CMK encryption of CloudWatch Log Groups

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/cloudwatch/log-group-customer-key/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group#kms_key_id
────────────────────────────────────────────────────────────────────────────────


Result #7 LOW Bucket does not have a corresponding public access block. 
────────────────────────────────────────────────────────────────────────────────
  modules/guardduty/main.tf:22-26
   via main.tf:116-138 (module.guardduty)
────────────────────────────────────────────────────────────────────────────────
   22    resource "aws_s3_bucket" "bucket" {
   23      count         = var.enabled ? 1 : 0
   24      bucket        = var.bucket_name
   25      force_destroy = true
   26    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-s3-specify-public-access-block
      Impact Public access policies may be applied to sensitive data buckets
  Resolution Define a aws_s3_bucket_public_access_block for the given bucket to control public access policies

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/s3/specify-public-access-block/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block#bucket
────────────────────────────────────────────────────────────────────────────────


  timings
  ──────────────────────────────────────────
  disk i/o             869.106µs
  parsing              1.113133368s
  adaptation           2.258219ms
  checks               15.714931ms
  total                1.131975624s

  counts
  ──────────────────────────────────────────
  modules downloaded   0
  modules processed    11
  blocks processed     507
  files read           41

  results
  ──────────────────────────────────────────
  passed               13
  ignored              4
  critical             0
  high                 2
  medium               3
  low                  2

  13 passed, 4 ignored, 7 potential problem(s) detected.

@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Sep 29, 2023

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot dependabot bot deleted the dependabot/terraform/clouddrove/kms/aws-1.3.1 branch September 29, 2023 04:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees

@clouddrove-ci clouddrove-ci

Labels
dependencies Pull requests that update a dependency file terraform Pull requests that update Terraform code
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@anmolnagpal @clouddrove-ci