Skip to content

feat(codedeploy): add Server platform Blue/Green deployment support#96

Open
llama90 wants to merge 2 commits intomainfrom
feat/codedeploy-server-bluegreen
Open

feat(codedeploy): add Server platform Blue/Green deployment support#96
llama90 wants to merge 2 commits intomainfrom
feat/codedeploy-server-bluegreen

Conversation

@llama90
Copy link
Contributor

@llama90 llama90 commented Feb 22, 2026

Enhance CodeDeploy module to support Blue/Green deployments for EC2/On-Premises (Server) platform.

Changes

Deployment Style Support

  • Extend deployment_style block to all platforms (not just Lambda/ECS)
  • Set deployment_option based on deployment type:
    • BLUE_GREEN: WITH_TRAFFIC_CONTROL
    • IN_PLACE: WITHOUT_TRAFFIC_CONTROL

Blue/Green Configuration

  • Add deployment_ready_wait_time_in_minutes variable (optional, default: 0)
  • Support manual approval wait time for deployment readiness

Auto Scaling Groups Management

  • Add lifecycle ignore_changes for autoscaling_groups
  • CodeDeploy manages ASGs dynamically during Blue/Green deployments
  • Prevents Terraform drift for CodeDeploy-managed ASG changes

Breaking Changes

None - all changes are backward compatible with optional parameters.

🤖 Generated with Claude Code

Enhance CodeDeploy module to support Blue/Green deployments for EC2/On-Premises (Server) platform.

## Changes

### Deployment Style Support
- Extend `deployment_style` block to all platforms (not just Lambda/ECS)
- Set `deployment_option` based on deployment type:
  - BLUE_GREEN: WITH_TRAFFIC_CONTROL
  - IN_PLACE: WITHOUT_TRAFFIC_CONTROL

### Blue/Green Configuration
- Add `deployment_ready_wait_time_in_minutes` variable (optional, default: 0)
- Support manual approval wait time for deployment readiness

### Auto Scaling Groups Management
- Add lifecycle `ignore_changes` for `autoscaling_groups`
- CodeDeploy manages ASGs dynamically during Blue/Green deployments
- Prevents Terraform drift for CodeDeploy-managed ASG changes

## Breaking Changes
None - all changes are backward compatible with optional parameters.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
@github-actions
Copy link
Contributor

🔍 Terraform Check Results

📊 Summary

All checks passed!

Check Status Issues Scope
🖌 Format ✅ success - All modules
🤖 Validate ✅ success - All modules
🔍 TFLint ✅ success 0 issue(s) terraform
🔒 Trivy ✅ success 0 critical, 0 high, 29 medium terraform

🔍 TFLint Details (0 issue(s))
No issues found or TFLint did not run
🔒 Trivy Security Details (29 issue(s))
Running Trivy on changed modules:
terraform

=== Scanning terraform ===

Report Summary

┌───────────────────────────────────────────────────────┬───────────┬───────────────────┐
│                        Target                         │   Type    │ Misconfigurations │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ _template/tests/basic                                 │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/alb-target-group/tests/basic                      │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/alb-target-group/tests/with_listener_rule         │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/alb/main.tf                                       │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/alb/tests/basic                                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/alb/tests/host_based                              │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/alb/tests/https                                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/alb/tests/multi_target                            │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/alb/tests/path_based                              │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/amazonmq-rabbitmq/tests/basic                     │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/amazonmq/main.tf                                  │ terraform │         3         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/amazonmq/tests/basic                              │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ami/tests/basic                                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/api-gateway/main.tf                               │ terraform │         6         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/api-gateway/tests/basic                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/autoscaling/tests/basic                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/autoscaling/tests/with-instance-profile           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/autoscaling/tests/with-step-scaling               │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/autoscaling/tests/with-warm-pool                  │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/aws-lb-controller-role/tests/basic                │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/bedrock/main.tf                                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/bedrock/tests/advanced                            │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/bedrock/tests/basic                               │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/cloudfront/main.tf                                │ terraform │         5         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/cloudfront/tests/alb_origin                       │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/cloudfront/tests/basic                            │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/cloudfront/tests/lambda_edge                      │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/cloudfront/tests/multi_origin                     │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/cloudfront/tests/s3_oac                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/cloudtrail/tests/basic                            │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/cloudwatch-alarm/tests/basic                      │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/cloudwatch-dashboard/tests/basic                  │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/cloudwatch-dashboard/tests/custom-metrics         │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/cloudwatch-dashboard/tests/pipeline               │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/codebuild/main.tf                                 │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/codebuild/tests/basic                             │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/codebuild/tests/custom_compute                    │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/codebuild/tests/with_pipeline                     │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/codedeploy/tests/basic                            │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/codedeploy/tests/ec2                              │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/codedeploy/tests/ecs                              │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/codedeploy/tests/lambda                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/codepipeline/main.tf                              │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/codepipeline/tests/basic                          │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/dynamodb/tests/advanced                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/dynamodb/tests/basic                              │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ec2/tests/basic                                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ec2/tests/spot_instance                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ec2/tests/user_data                               │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ec2/tests/with_ebs                                │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ec2/tests/with_eip                                │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ecr/main.tf                                       │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ecr/tests/basic                                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ecs-cluster/main.tf                               │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ecs-cluster/tests/basic                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ecs-cluster/tests/with_capacity_providers         │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ecs-execution-role/tests/basic                    │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ecs-execution-role/tests/with_additional_policies │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ecs-service/main.tf                               │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ecs-service/tests/basic                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ecs-service/tests/with_autoscaling                │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ecs-task-role/tests/basic                         │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ecs-task-role/tests/with_policies                 │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/eks-app-deployment/tests/basic                    │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/eks-lb-controller/tests/basic                     │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/eks-node-role/tests/basic                         │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/eks/main.tf                                       │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/eks/tests/basic                                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/elasticache/tests/advanced                        │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/elasticache/tests/basic                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/eventbridge/tests/basic                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/eventbridge/tests/basic/main.tf                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/eventbridge/tests/cross_account                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/eventbridge/tests/cross_account/main.tf           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/eventbridge/tests/pattern                         │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/eventbridge/tests/scheduled                       │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/eventbridge/tests/scheduled/main.tf               │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-group-policy-attachment/tests/basic           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-group-policy/main.tf                          │ terraform │         2         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-group-policy/tests/advanced                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-group-policy/tests/basic                      │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-group/main.tf                                 │ terraform │         2         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-group/tests/advanced                          │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-group/tests/basic                             │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-policy/tests/basic                            │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-policy/tests/with_policy_document             │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-user-group-membership/tests/basic             │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-user-group-membership/tests/multiple-groups   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-user/main.tf                                  │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-user/tests/advanced                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-user/tests/basic                              │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/instance-profile/tests/advanced                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/instance-profile/tests/basic                      │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/internet-gateway/tests/basic                      │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/key-pair/tests/basic                              │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/lambda/main.tf                                    │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/lambda/tests/basic                                │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/lambda/tests/event-source-mapping                 │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/lambda/tests/go                                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/lambda/tests/python                               │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/lambda/tests/typescript                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/launch-template/tests/advanced                    │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/launch-template/tests/basic                       │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/managed-prefix-list/tests/basic                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/nat-gateway/tests/basic                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/parameter-store/tests/basic                       │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/rds-option-group/tests/basic                      │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/rds-parameter-group/tests/advanced                │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/rds-parameter-group/tests/basic                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/rds/main.tf                                       │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/rds/tests/advanced                                │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/rds/tests/basic                                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/route-table/tests/basic                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/s3/main.tf                                        │ terraform │         1         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/s3/tests/basic                                    │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/scp/tests/basic                                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/secrets-manager/tests/basic                       │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/security-group/main.tf                            │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/security-group/tests/basic                        │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/security-groups/tests/basic                       │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/sns/tests/basic                                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/sqs/tests/basic                                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/stack/audit-logging/tests/basic                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/stack/networking/tests/basic                      │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/stack/networking/tests/no-nat                     │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/stack/networking/tests/single-nat                 │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/subnet/main.tf                                    │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/subnet/tests/basic                                │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/vpc/main.tf                                       │ terraform │        10         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/vpc/tests/basic                                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/vpc/tests/no_default_nacl                         │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ gcp/cloud-functions/main.tf                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ gcp/cloud-functions/tests/basic                       │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ gcp/gcs/main.tf                                       │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ gcp/gcs/tests/basic                                   │ terraform │         0         │
└───────────────────────────────────────────────────────┴───────────┴───────────────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


aws/amazonmq/main.tf (terraform)
================================
Tests: 3 (SUCCESSES: 0, FAILURES: 3)
Failures: 3 (MEDIUM: 3, HIGH: 0, CRITICAL: 0)

AVD-AWS-0070 (MEDIUM): Broker does not have audit logging enabled.
════════════════════════════════════════
Logging should be enabled to allow tracing of issues and activity to be investigated more fully. Logs provide additional information and context which is often invalauble during investigation


See https://avd.aquasec.com/misconfig/avd-aws-0070
────────────────────────────────────────
 aws/amazonmq/main.tf:118
   via aws/amazonmq/main.tf:116-119 (logs)
    via aws/amazonmq/main.tf:14-143 (aws_mq_broker.this)
     via aws/amazonmq/tests/basic/main.tf:177-203 (module.test_activemq_minimal)
────────────────────────────────────────
  14   resource "aws_mq_broker" "this" {
  ..   
 118 [     audit   = var.enable_audit_log
 ...   
 143   }
────────────────────────────────────────


AVD-AWS-0070 (MEDIUM): Broker does not have audit logging enabled.
════════════════════════════════════════
Logging should be enabled to allow tracing of issues and activity to be investigated more fully. Logs provide additional information and context which is often invalauble during investigation


See https://avd.aquasec.com/misconfig/avd-aws-0070
────────────────────────────────────────
 aws/amazonmq/main.tf:118
   via aws/amazonmq/main.tf:116-119 (logs)
    via aws/amazonmq/main.tf:14-143 (aws_mq_broker.this)
     via aws/amazonmq/tests/basic/main.tf:144-174 (module.test_activemq_with_external_config)
────────────────────────────────────────
  14   resource "aws_mq_broker" "this" {
  ..   
 118 [     audit   = var.enable_audit_log
 ...   
 143   }
────────────────────────────────────────


AVD-AWS-0070 (MEDIUM): Broker does not have audit logging enabled.
════════════════════════════════════════
Logging should be enabled to allow tracing of issues and activity to be investigated more fully. Logs provide additional information and context which is often invalauble during investigation


See https://avd.aquasec.com/misconfig/avd-aws-0070
────────────────────────────────────────
 aws/amazonmq/main.tf:118
   via aws/amazonmq/main.tf:116-119 (logs)
    via aws/amazonmq/main.tf:14-143 (aws_mq_broker.this)
     via aws/amazonmq/tests/basic/main.tf:60-96 (module.test_rabbitmq_cluster)
────────────────────────────────────────
  14   resource "aws_mq_broker" "this" {
  ..   
 118 [     audit   = var.enable_audit_log
 ...   
 143   }
────────────────────────────────────────



aws/api-gateway/main.tf (terraform)
===================================
Tests: 6 (SUCCESSES: 0, FAILURES: 6)
Failures: 6 (MEDIUM: 6, HIGH: 0, CRITICAL: 0)

AVD-AWS-0001 (MEDIUM): Access logging is not configured.
════════════════════════════════════════
API Gateway stages should have access log settings block configured to track all access to a particular stage. This should be applied to both v1 and v2 gateway stages.


See https://avd.aquasec.com/misconfig/avd-aws-0001
────────────────────────────────────────
 aws/api-gateway/main.tf:315-346
   via aws/api-gateway/tests/basic/main.tf:29-57 (module.basic_api)
────────────────────────────────────────
 315 ┌ resource "aws_api_gateway_stage" "this" {
 316 │   rest_api_id   = aws_api_gateway_rest_api.this.id
 317 │   deployment_id = aws_api_gateway_deployment.this.id
 318 │   stage_name    = var.stage_name
 319 │   description   = var.stage_description
 320 │ 
 321 │   xray_tracing_enabled  = var.xray_tracing_enabled
 322 │   cache_cluster_enabled = var.cache_cluster_enabled
 323 └   cache_cluster_size    = var.cache_cluster_size
 ...   
────────────────────────────────────────


AVD-AWS-0001 (MEDIUM): Access logging is not configured.
════════════════════════════════════════
API Gateway stages should have access log settings block configured to track all access to a particular stage. This should be applied to both v1 and v2 gateway stages.


See https://avd.aquasec.com/misconfig/avd-aws-0001
────────────────────────────────────────
 aws/api-gateway/main.tf:315-346
   via aws/api-gateway/tests/basic/main.tf:350-381 (module.cached_api)
────────────────────────────────────────
 315 ┌ resource "aws_api_gateway_stage" "this" {
 316 │   rest_api_id   = aws_api_gateway_rest_api.this.id
 317 │   deployment_id = aws_api_gateway_deployment.this.id
 318 │   stage_name    = var.stage_name
 319 │   description   = var.stage_description
 320 │ 
 321 │   xray_tracing_enabled  = var.xray_tracing_enabled
 322 │   cache_cluster_enabled = var.cache_cluster_enabled
 323 └   cache_cluster_size    = var.cache_cluster_size
 ...   
────────────────────────────────────────


AVD-AWS-0001 (MEDIUM): Access logging is not configured.
════════════════════════════════════════
API Gateway stages should have access log settings block configured to track all access to a particular stage. This should be applied to both v1 and v2 gateway stages.


See https://avd.aquasec.com/misconfig/avd-aws-0001
────────────────────────────────────────
 aws/api-gateway/main.tf:315-346
   via aws/api-gateway/tests/basic/main.tf:388-457 (module.custom_responses_api)
────────────────────────────────────────
 315 ┌ resource "aws_api_gateway_stage" "this" {
 316 │   rest_api_id   = aws_api_gateway_rest_api.this.id
 317 │   deployment_id = aws_api_gateway_deployment.this.id
 318 │   stage_name    = var.stage_name
 319 │   description   = var.stage_description
 320 │ 
 321 │   xray_tracing_enabled  = var.xray_tracing_enabled
 322 │   cache_cluster_enabled = var.cache_cluster_enabled
 323 └   cache_cluster_size    = var.cache_cluster_size
 ...   
────────────────────────────────────────


AVD-AWS-0001 (MEDIUM): Access logging is not configured.
════════════════════════════════════════
API Gateway stages should have access log settings block configured to track all access to a particular stage. This should be applied to both v1 and v2 gateway stages.


See https://avd.aquasec.com/misconfig/avd-aws-0001
────────────────────────────────────────
 aws/api-gateway/main.tf:315-346
   via aws/api-gateway/tests/basic/main.tf:64-104 (module.lambda_api)
────────────────────────────────────────
 315 ┌ resource "aws_api_gateway_stage" "this" {
 316 │   rest_api_id   = aws_api_gateway_rest_api.this.id
 317 │   deployment_id = aws_api_gateway_deployment.this.id
 318 │   stage_name    = var.stage_name
 319 │   description   = var.stage_description
 320 │ 
 321 │   xray_tracing_enabled  = var.xray_tracing_enabled
 322 │   cache_cluster_enabled = var.cache_cluster_enabled
 323 └   cache_cluster_size    = var.cache_cluster_size
 ...   
────────────────────────────────────────


AVD-AWS-0001 (MEDIUM): Access logging is not configured.
════════════════════════════════════════
API Gateway stages should have access log settings block configured to track all access to a particular stage. This should be applied to both v1 and v2 gateway stages.


See https://avd.aquasec.com/misconfig/avd-aws-0001
────────────────────────────────────────
 aws/api-gateway/main.tf:315-346
   via aws/api-gateway/tests/basic/main.tf:174-259 (module.secured_api)
────────────────────────────────────────
 315 ┌ resource "aws_api_gateway_stage" "this" {
 316 │   rest_api_id   = aws_api_gateway_rest_api.this.id
 317 │   deployment_id = aws_api_gateway_deployment.this.id
 318 │   stage_name    = var.stage_name
 319 │   description   = var.stage_description
 320 │ 
 321 │   xray_tracing_enabled  = var.xray_tracing_enabled
 322 │   cache_cluster_enabled = var.cache_cluster_enabled
 323 └   cache_cluster_size    = var.cache_cluster_size
 ...   
────────────────────────────────────────


AVD-AWS-0001 (MEDIUM): Access logging is not configured.
════════════════════════════════════════
API Gateway stages should have access log settings block configured to track all access to a particular stage. This should be applied to both v1 and v2 gateway stages.


See https://avd.aquasec.com/misconfig/avd-aws-0001
────────────────────────────────────────
 aws/api-gateway/main.tf:315-346
   via aws/api-gateway/tests/basic/main.tf:266-343 (module.validated_api)
────────────────────────────────────────
 315 ┌ resource "aws_api_gateway_stage" "this" {
 316 │   rest_api_id   = aws_api_gateway_rest_api.this.id
 317 │   deployment_id = aws_api_gateway_deployment.this.id
 318 │   stage_name    = var.stage_name
 319 │   description   = var.stage_description
 320 │ 
 321 │   xray_tracing_enabled  = var.xray_tracing_enabled
 322 │   cache_cluster_enabled = var.cache_cluster_enabled
 323 └   cache_cluster_size    = var.cache_cluster_size
 ...   
────────────────────────────────────────



aws/cloudfront/main.tf (terraform)
==================================
Tests: 5 (SUCCESSES: 0, FAILURES: 5)
Failures: 5 (MEDIUM: 5, HIGH: 0, CRITICAL: 0)

AVD-AWS-0010 (MEDIUM): Distribution does not have logging enabled
════════════════════════════════════════
You should configure CloudFront Access Logging to create log files that contain detailed information about every user request that CloudFront receives


See https://avd.aquasec.com/misconfig/avd-aws-0010
────────────────────────────────────────
 aws/cloudfront/main.tf:56-312
   via aws/cloudfront/tests/alb_origin/main.tf:27-141 (module.test_alb_origin)
────────────────────────────────────────
  56 ┌ resource "aws_cloudfront_distribution" "this" {
  57 │   enabled             = var.enabled
  58 │   is_ipv6_enabled     = var.is_ipv6_enabled
  59 │   comment             = var.distribution_name
  60 │   default_root_object = var.default_root_object
  61 │   price_class         = var.price_class
  62 │   http_version        = var.http_version
  63 │   web_acl_id          = var.web_acl_id
  64 └   retain_on_delete    = var.retain_on_delete
  ..   
────────────────────────────────────────


AVD-AWS-0010 (MEDIUM): Distribution does not have logging enabled
════════════════════════════════════════
You should configure CloudFront Access Logging to create log files that contain detailed information about every user request that CloudFront receives


See https://avd.aquasec.com/misconfig/avd-aws-0010
────────────────────────────────────────
 aws/cloudfront/main.tf:56-312
   via aws/cloudfront/tests/basic/main.tf:26-82 (module.test_basic)
────────────────────────────────────────
  56 ┌ resource "aws_cloudfront_distribution" "this" {
  57 │   enabled             = var.enabled
  58 │   is_ipv6_enabled     = var.is_ipv6_enabled
  59 │   comment             = var.distribution_name
  60 │   default_root_object = var.default_root_object
  61 │   price_class         = var.price_class
  62 │   http_version        = var.http_version
  63 │   web_acl_id          = var.web_acl_id
  64 └   retain_on_delete    = var.retain_on_delete
  ..   
────────────────────────────────────────


AVD-AWS-0010 (MEDIUM): Distribution does not have logging enabled
════════════════════════════════════════
You should configure CloudFront Access Logging to create log files that contain detailed information about every user request that CloudFront receives


See https://avd.aquasec.com/misconfig/avd-aws-0010
────────────────────────────────────────
 aws/cloudfront/main.tf:56-312
   via aws/cloudfront/tests/lambda_edge/main.tf:30-155 (module.test_lambda_edge)
────────────────────────────────────────
  56 ┌ resource "aws_cloudfront_distribution" "this" {
  57 │   enabled             = var.enabled
  58 │   is_ipv6_enabled     = var.is_ipv6_enabled
  59 │   comment             = var.distribution_name
  60 │   default_root_object = var.default_root_object
  61 │   price_class         = var.price_class
  62 │   http_version        = var.http_version
  63 │   web_acl_id          = var.web_acl_id
  64 └   retain_on_delete    = var.retain_on_delete
  ..   
────────────────────────────────────────


AVD-AWS-0010 (MEDIUM): Distribution does not have logging enabled
════════════════════════════════════════
You should configure CloudFront Access Logging to create log files that contain detailed information about every user request that CloudFront receives


See https://avd.aquasec.com/misconfig/avd-aws-0010
────────────────────────────────────────
 aws/cloudfront/main.tf:56-312
   via aws/cloudfront/tests/multi_origin/main.tf:27-215 (module.test_multi_origin)
────────────────────────────────────────
  56 ┌ resource "aws_cloudfront_distribution" "this" {
  57 │   enabled             = var.enabled
  58 │   is_ipv6_enabled     = var.is_ipv6_enabled
  59 │   comment             = var.distribution_name
  60 │   default_root_object = var.default_root_object
  61 │   price_class         = var.price_class
  62 │   http_version        = var.http_version
  63 │   web_acl_id          = var.web_acl_id
  64 └   retain_on_delete    = var.retain_on_delete
  ..   
────────────────────────────────────────


AVD-AWS-0010 (MEDIUM): Distribution does not have logging enabled
════════════════════════════════════════
You should configure CloudFront Access Logging to create log files that contain detailed information about every user request that CloudFront receives


See https://avd.aquasec.com/misconfig/avd-aws-0010
────────────────────────────────────────
 aws/cloudfront/main.tf:56-312
   via aws/cloudfront/tests/s3_oac/main.tf:27-113 (module.test_s3_oac)
────────────────────────────────────────
  56 ┌ resource "aws_cloudfront_distribution" "this" {
  57 │   enabled             = var.enabled
  58 │   is_ipv6_enabled     = var.is_ipv6_enabled
  59 │   comment             = var.distribution_name
  60 │   default_root_object = var.default_root_object
  61 │   price_class         = var.price_class
  62 │   http_version        = var.http_version
  63 │   web_acl_id          = var.web_acl_id
  64 └   retain_on_delete    = var.retain_on_delete
  ..   
────────────────────────────────────────



aws/iam-group-policy/main.tf (terraform)
========================================
Tests: 2 (SUCCESSES: 0, FAILURES: 2)
Failures: 2 (MEDIUM: 2, HIGH: 0, CRITICAL: 0)

AVD-AWS-0123 (MEDIUM): Multi-Factor authentication is not enforced for group
════════════════════════════════════════
IAM groups should be protected with multi factor authentication to add safe guards to password compromise.


See https://avd.aquasec.com/misconfig/aws-iam-enforce-mfa
────────────────────────────────────────
 aws/iam-group-policy/main.tf:176-186
   via aws/iam-group-policy/tests/advanced/main.tf:23-71 (module.iam_group_policy)
────────────────────────────────────────
 176 ┌ resource "aws_iam_group" "this" {
 177 │   name = var.name
 178 │   path = var.path
 179 │ 
 180 │   lifecycle {
 181 │     precondition {
 182 │       condition     = length(local.all_inline_policies) <= 10
 183 │       error_message = "IAM groups support at most 10 inline policies. Reduce built-in policy toggles or custom_policy_statements."
 184 └     }
 ...   
────────────────────────────────────────


AVD-AWS-0123 (MEDIUM): Multi-Factor authentication is not enforced for group
════════════════════════════════════════
IAM groups should be protected with multi factor authentication to add safe guards to password compromise.


See https://avd.aquasec.com/misconfig/aws-iam-enforce-mfa
────────────────────────────────────────
 aws/iam-group-policy/main.tf:176-186
   via aws/iam-group-policy/tests/basic/main.tf:23-32 (module.iam_group_policy)
────────────────────────────────────────
 176 ┌ resource "aws_iam_group" "this" {
 177 │   name = var.name
 178 │   path = var.path
 179 │ 
 180 │   lifecycle {
 181 │     precondition {
 182 │       condition     = length(local.all_inline_policies) <= 10
 183 │       error_message = "IAM groups support at most 10 inline policies. Reduce built-in policy toggles or custom_policy_statements."
 184 └     }
 ...   
────────────────────────────────────────



aws/iam-group/main.tf (terraform)
=================================
Tests: 2 (SUCCESSES: 0, FAILURES: 2)
Failures: 2 (MEDIUM: 2, HIGH: 0, CRITICAL: 0)

AVD-AWS-0123 (MEDIUM): Multi-Factor authentication is not enforced for group
════════════════════════════════════════
IAM groups should be protected with multi factor authentication to add safe guards to password compromise.


See https://avd.aquasec.com/misconfig/aws-iam-enforce-mfa
────────────────────────────────────────
 aws/iam-group/main.tf:16-19
   via aws/iam-group/tests/advanced/main.tf:40-85 (module.iam_group)
────────────────────────────────────────
  16 ┌ resource "aws_iam_group" "this" {
  17 │   name = var.name
  18 │   path = var.path
  19 └ }
────────────────────────────────────────


AVD-AWS-0123 (MEDIUM): Multi-Factor authentication is not enforced for group
════════════════════════════════════════
IAM groups should be protected with multi factor authentication to add safe guards to password compromise.


See https://avd.aquasec.com/misconfig/aws-iam-enforce-mfa
────────────────────────────────────────
 aws/iam-group/main.tf:16-19
   via aws/iam-group/tests/basic/main.tf:26-34 (module.iam_group)
────────────────────────────────────────
  16 ┌ resource "aws_iam_group" "this" {
  17 │   name = var.name
  18 │   path = var.path
  19 └ }
────────────────────────────────────────



aws/s3/main.tf (terraform)
==========================
Tests: 1 (SUCCESSES: 0, FAILURES: 1)
Failures: 1 (MEDIUM: 1, HIGH: 0, CRITICAL: 0)

AVD-AWS-0090 (MEDIUM): Bucket does not have versioning enabled
════════════════════════════════════════
Versioning in Amazon S3 is a means of keeping multiple variants of an object in the same bucket.

You can use the S3 Versioning feature to preserve, retrieve, and restore every version of every object stored in your buckets.

With versioning you can recover more easily from both unintended user actions and application failures.

When you enable versioning, also keep in mind the potential costs of storing noncurrent versions of objects. To help manage those costs, consider setting up an S3 Lifecycle configuration.


See https://avd.aquasec.com/misconfig/avd-aws-0090
────────────────────────────────────────
 aws/s3/main.tf:33
   via aws/s3/main.tf:32-34 (versioning_configuration)
    via aws/s3/main.tf:29-35 (aws_s3_bucket_versioning.this)
     via aws/s3/tests/basic/main.tf:121-132 (module.no_versioning_bucket)
────────────────────────────────────────
  29   resource "aws_s3_bucket_versioning" "this" {
  30     bucket = aws_s3_bucket.this.id
  31   
  32     versioning_configuration {
  33 [     status = var.versioning_enabled ? "Enabled" : "Suspended"
  34     }
  35   }
────────────────────────────────────────



aws/vpc/main.tf (terraform)
===========================
Tests: 10 (SUCCESSES: 0, FAILURES: 10)
Failures: 10 (MEDIUM: 10, HIGH: 0, CRITICAL: 0)

AVD-AWS-0178 (MEDIUM): VPC does not have VPC Flow Logs enabled.
════════════════════════════════════════
VPC Flow Logs provide visibility into network traffic that traverses the VPC and can be used to detect anomalous traffic or insight during security workflows.


See https://avd.aquasec.com/misconfig/aws-autoscaling-enable-at-rest-encryption
────────────────────────────────────────
 aws/vpc/main.tf:12-26
   via aws/stack/networking/main.tf:47-61 (module.vpc)
    via aws/stack/networking/tests/basic/main.tf:23-34 (module.networking)
────────────────────────────────────────
  12 ┌ resource "aws_vpc" "this" {
  13 │   cidr_block                           = var.cidr_block
  14 │   enable_dns_support                   = var.enable_dns_support
  15 │   enable_dns_hostnames                 = var.enable_dns_hostnames
  16 │   assign_generated_ipv6_cidr_block     = var.enable_ipv6
  17 │   instance_tenancy                     = var.instance_tenancy
  18 │   enable_network_address_usage_metrics = var.enable_network_address_usage_metrics
  19 │ 
  20 └   tags = merge(
  ..   
────────────────────────────────────────


AVD-AWS-0178 (MEDIUM): VPC does not have VPC Flow Logs enabled.
════════════════════════════════════════
VPC Flow Logs provide visibility into network traffic that traverses the VPC and can be used to detect anomalous traffic or insight during security workflows.


See https://avd.aquasec.com/misconfig/aws-autoscaling-enable-at-rest-encryption
────────────────────────────────────────
 aws/vpc/main.tf:12-26
   via aws/stack/networking/main.tf:47-61 (module.vpc)
    via aws/stack/networking/tests/no-nat/main.tf:23-37 (module.networking)
────────────────────────────────────────
  12 ┌ resource "aws_vpc" "this" {
  13 │   cidr_block                           = var.cidr_block
  14 │   enable_dns_support                   = var.enable_dns_support
  15 │   enable_dns_hostnames                 = var.enable_dns_hostnames
  16 │   assign_generated_ipv6_cidr_block     = var.enable_ipv6
  17 │   instance_tenancy                     = var.instance_tenancy
  18 │   enable_network_address_usage_metrics = var.enable_network_address_usage_metrics
  19 │ 
  20 └   tags = merge(
  ..   
────────────────────────────────────────


AVD-AWS-0178 (MEDIUM): VPC does not have VPC Flow Logs enabled.
════════════════════════════════════════
VPC Flow Logs provide visibility into network traffic that traverses the VPC and can be used to detect anomalous traffic or insight during security workflows.


See https://avd.aquasec.com/misconfig/aws-autoscaling-enable-at-rest-encryption
────────────────────────────────────────
 aws/vpc/main.tf:12-26
   via aws/stack/networking/main.tf:47-61 (module.vpc)
    via aws/stack/networking/tests/single-nat/main.tf:23-34 (module.networking)
────────────────────────────────────────
  12 ┌ resource "aws_vpc" "this" {
  13 │   cidr_block                           = var.cidr_block
  14 │   enable_dns_support                   = var.enable_dns_support
  15 │   enable_dns_hostnames                 = var.enable_dns_hostnames
  16 │   assign_generated_ipv6_cidr_block     = var.enable_ipv6
  17 │   instance_tenancy                     = var.instance_tenancy
  18 │   enable_network_address_usage_metrics = var.enable_network_address_usage_metrics
  19 │ 
  20 └   tags = merge(
  ..   
────────────────────────────────────────


AVD-AWS-0178 (MEDIUM): VPC does not have VPC Flow Logs enabled.
════════════════════════════════════════
VPC Flow Logs provide visibility into network traffic that traverses the VPC and can be used to detect anomalous traffic or insight during security workflows.


See https://avd.aquasec.com/misconfig/aws-autoscaling-enable-at-rest-encryption
────────────────────────────────────────
 aws/vpc/main.tf:12-26
   via aws/vpc/tests/basic/main.tf:23-36 (module.test_vpc)
────────────────────────────────────────
  12 ┌ resource "aws_vpc" "this" {
  13 │   cidr_block                           = var.cidr_block
  14 │   enable_dns_support                   = var.enable_dns_support
  15 │   enable_dns_hostnames                 = var.enable_dns_hostnames
  16 │   assign_generated_ipv6_cidr_block     = var.enable_ipv6
  17 │   instance_tenancy                     = var.instance_tenancy
  18 │   enable_network_address_usage_metrics = var.enable_network_address_usage_metrics
  19 │ 
  20 └   tags = merge(
  ..   
────────────────────────────────────────


AVD-AWS-0178 (MEDIUM): VPC does not have VPC Flow Logs enabled.
════════════════════════════════════════
VPC Flow Logs provide visibility into network traffic that traverses the VPC and can be used to detect anomalous traffic or insight during security workflows.


See https://avd.aquasec.com/misconfig/aws-autoscaling-enable-at-rest-encryption
────────────────────────────────────────
 aws/vpc/main.tf:12-26
   via aws/vpc/tests/no_default_nacl/main.tf:23-39 (module.test_vpc_no_default_nacl)
────────────────────────────────────────
  12 ┌ resource "aws_vpc" "this" {
  13 │   cidr_block                           = var.cidr_block
  14 │   enable_dns_support                   = var.enable_dns_support
  15 │   enable_dns_hostnames                 = var.enable_dns_hostnames
  16 │   assign_generated_ipv6_cidr_block     = var.enable_ipv6
  17 │   instance_tenancy                     = var.instance_tenancy
  18 │   enable_network_address_usage_metrics = var.enable_network_address_usage_metrics
  19 │ 
  20 └   tags = merge(
  ..   
────────────────────────────────────────


AVD-AWS-0178 (MEDIUM): VPC does not have VPC Flow Logs enabled.
════════════════════════════════════════
VPC Flow Logs provide visibility into network traffic that traverses the VPC and can be used to detect anomalous traffic or insight during security workflows.


See https://avd.aquasec.com/misconfig/aws-autoscaling-enable-at-rest-encryption
────────────────────────────────────────
 aws/vpc/main.tf:12-26
   via aws/internet-gateway/tests/basic/main.tf:23-28 (module.vpc)
────────────────────────────────────────
  12 ┌ resource "aws_vpc" "this" {
  13 │   cidr_block                           = var.cidr_block
  14 │   enable_dns_support                   = var.enable_dns_support
  15 │   enable_dns_hostnames                 = var.enable_dns_hostnames
  16 │   assign_generated_ipv6_cidr_block     = var.enable_ipv6
  17 │   instance_tenancy                     = var.instance_tenancy
  18 │   enable_network_address_usage_metrics = var.enable_network_address_usage_metrics
  19 │ 
  20 └   tags = merge(
  ..   
────────────────────────────────────────


AVD-AWS-0178 (MEDIUM): VPC does not have VPC Flow Logs enabled.
════════════════════════════════════════
VPC Flow Logs provide visibility into network traffic that traverses the VPC and can be used to detect anomalous traffic or insight during security workflows.


See https://avd.aquasec.com/misconfig/aws-autoscaling-enable-at-rest-encryption
────────────────────────────────────────
 aws/vpc/main.tf:12-26
   via aws/nat-gateway/tests/basic/main.tf:23-28 (module.vpc)
────────────────────────────────────────
  12 ┌ resource "aws_vpc" "this" {
  13 │   cidr_block                           = var.cidr_block
  14 │   enable_dns_support                   = var.enable_dns_support
  15 │   enable_dns_hostnames                 = var.enable_dns_hostnames
  16 │   assign_generated_ipv6_cidr_block     = var.enable_ipv6
  17 │   instance_tenancy                     = var.instance_tenancy
  18 │   enable_network_address_usage_metrics = var.enable_network_address_usage_metrics
  19 │ 
  20 └   tags = merge(
  ..   
────────────────────────────────────────


AVD-AWS-0178 (MEDIUM): VPC does not have VPC Flow Logs enabled.
════════════════════════════════════════
VPC Flow Logs provide visibility into network traffic that traverses the VPC and can be used to detect anomalous traffic or insight during security workflows.


See https://avd.aquasec.com/misconfig/aws-autoscaling-enable-at-rest-encryption
────────────────────────────────────────
 aws/vpc/main.tf:12-26
   via aws/route-table/tests/basic/main.tf:23-28 (module.vpc)
────────────────────────────────────────
  12 ┌ resource "aws_vpc" "this" {
  13 │   cidr_block                           = var.cidr_block
  14 │   enable_dns_support                   = var.enable_dns_support
  15 │   enable_dns_hostnames                 = var.enable_dns_hostnames
  16 │   assign_generated_ipv6_cidr_block     = var.enable_ipv6
  17 │   instance_tenancy                     = var.instance_tenancy
  18 │   enable_network_address_usage_metrics = var.enable_network_address_usage_metrics
  19 │ 
  20 └   tags = merge(
  ..   
────────────────────────────────────────


AVD-AWS-0178 (MEDIUM): VPC does not have VPC Flow Logs enabled.
════════════════════════════════════════
VPC Flow Logs provide visibility into network traffic that traverses the VPC and can be used to detect anomalous traffic or insight during security workflows.


See https://avd.aquasec.com/misconfig/aws-autoscaling-enable-at-rest-encryption
────────────────────────────────────────
 aws/vpc/main.tf:12-26
   via aws/security-group/tests/basic/main.tf:23-28 (module.vpc)
────────────────────────────────────────
  12 ┌ resource "aws_vpc" "this" {
  13 │   cidr_block                           = var.cidr_block
  14 │   enable_dns_support                   = var.enable_dns_support
  15 │   enable_dns_hostnames                 = var.enable_dns_hostnames
  16 │   assign_generated_ipv6_cidr_block     = var.enable_ipv6
  17 │   instance_tenancy                     = var.instance_tenancy
  18 │   enable_network_address_usage_metrics = var.enable_network_address_usage_metrics
  19 │ 
  20 └   tags = merge(
  ..   
────────────────────────────────────────


AVD-AWS-0178 (MEDIUM): VPC does not have VPC Flow Logs enabled.
════════════════════════════════════════
VPC Flow Logs provide visibility into network traffic that traverses the VPC and can be used to detect anomalous traffic or insight during security workflows.


See https://avd.aquasec.com/misconfig/aws-autoscaling-enable-at-rest-encryption
────────────────────────────────────────
 aws/vpc/main.tf:12-26
   via aws/subnet/tests/basic/main.tf:23-28 (module.vpc)
────────────────────────────────────────
  12 ┌ resource "aws_vpc" "this" {
  13 │   cidr_block                           = var.cidr_block
  14 │   enable_dns_support                   = var.enable_dns_support
  15 │   enable_dns_hostnames                 = var.enable_dns_hostnames
  16 │   assign_generated_ipv6_cidr_block     = var.enable_ipv6
  17 │   instance_tenancy                     = var.instance_tenancy
  18 │   enable_network_address_usage_metrics = var.enable_network_address_usage_metrics
  19 │ 
  20 └   tags = merge(
  ..   
────────────────────────────────────────

👤 Pusher: @llama90 | 🔄 Action: pull_request | ⚙️ Workflow: Terraform Check

Remove lifecycle ignore_changes from module and document in README instead.

## Changes
- Remove forced ignore_changes for autoscaling_groups
- Add detailed documentation in README about Blue/Green ASG drift
- Let users decide how to handle ASG drift in their own configurations

## Rationale
- Modules should not force lifecycle behavior
- Users should have control over ignore_changes
- Better to document the issue and let users choose their approach

Fixes module flexibility and follows Terraform best practices.
@github-actions
Copy link
Contributor

🔍 Terraform Check Results

📊 Summary

All checks passed!

Check Status Issues Scope
🖌 Format ✅ success - All modules
🤖 Validate ✅ success - All modules
🔍 TFLint ✅ success 0 issue(s) terraform
🔒 Trivy ✅ success 0 critical, 0 high, 29 medium terraform

🔍 TFLint Details (0 issue(s))
Running TFLint on changed modules:
terraform

=== Checking terraform ===
🔒 Trivy Security Details (29 issue(s))
Running Trivy on changed modules:
terraform

=== Scanning terraform ===

Report Summary

┌───────────────────────────────────────────────────────┬───────────┬───────────────────┐
│                        Target                         │   Type    │ Misconfigurations │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ _template/tests/basic                                 │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/alb-target-group/tests/basic                      │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/alb-target-group/tests/with_listener_rule         │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/alb/main.tf                                       │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/alb/tests/basic                                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/alb/tests/host_based                              │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/alb/tests/https                                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/alb/tests/multi_target                            │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/alb/tests/path_based                              │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/amazonmq-rabbitmq/tests/basic                     │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/amazonmq/main.tf                                  │ terraform │         3         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/amazonmq/tests/basic                              │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ami/tests/basic                                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/api-gateway/main.tf                               │ terraform │         6         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/api-gateway/tests/basic                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/autoscaling/tests/basic                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/autoscaling/tests/with-instance-profile           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/autoscaling/tests/with-step-scaling               │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/autoscaling/tests/with-warm-pool                  │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/aws-lb-controller-role/tests/basic                │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/bedrock/main.tf                                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/bedrock/tests/advanced                            │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/bedrock/tests/basic                               │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/cloudfront/main.tf                                │ terraform │         5         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/cloudfront/tests/alb_origin                       │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/cloudfront/tests/basic                            │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/cloudfront/tests/lambda_edge                      │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/cloudfront/tests/multi_origin                     │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/cloudfront/tests/s3_oac                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/cloudtrail/tests/basic                            │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/cloudwatch-alarm/tests/basic                      │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/cloudwatch-dashboard/tests/basic                  │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/cloudwatch-dashboard/tests/custom-metrics         │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/cloudwatch-dashboard/tests/pipeline               │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/codebuild/main.tf                                 │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/codebuild/tests/basic                             │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/codebuild/tests/custom_compute                    │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/codebuild/tests/with_pipeline                     │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/codedeploy/tests/basic                            │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/codedeploy/tests/ec2                              │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/codedeploy/tests/ecs                              │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/codedeploy/tests/lambda                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/codepipeline/main.tf                              │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/codepipeline/tests/basic                          │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/dynamodb/tests/advanced                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/dynamodb/tests/basic                              │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ec2/tests/basic                                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ec2/tests/spot_instance                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ec2/tests/user_data                               │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ec2/tests/with_ebs                                │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ec2/tests/with_eip                                │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ecr/main.tf                                       │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ecr/tests/basic                                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ecs-cluster/main.tf                               │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ecs-cluster/tests/basic                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ecs-cluster/tests/with_capacity_providers         │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ecs-execution-role/tests/basic                    │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ecs-execution-role/tests/with_additional_policies │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ecs-service/main.tf                               │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ecs-service/tests/basic                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ecs-service/tests/with_autoscaling                │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ecs-task-role/tests/basic                         │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ecs-task-role/tests/with_policies                 │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/eks-app-deployment/tests/basic                    │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/eks-lb-controller/tests/basic                     │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/eks-node-role/tests/basic                         │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/eks/main.tf                                       │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/eks/tests/basic                                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/elasticache/tests/advanced                        │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/elasticache/tests/basic                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/eventbridge/tests/basic                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/eventbridge/tests/basic/main.tf                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/eventbridge/tests/cross_account                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/eventbridge/tests/cross_account/main.tf           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/eventbridge/tests/pattern                         │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/eventbridge/tests/scheduled                       │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/eventbridge/tests/scheduled/main.tf               │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-group-policy-attachment/tests/basic           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-group-policy/main.tf                          │ terraform │         2         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-group-policy/tests/advanced                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-group-policy/tests/basic                      │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-group/main.tf                                 │ terraform │         2         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-group/tests/advanced                          │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-group/tests/basic                             │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-policy/tests/basic                            │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-policy/tests/with_policy_document             │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-user-group-membership/tests/basic             │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-user-group-membership/tests/multiple-groups   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-user/main.tf                                  │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-user/tests/advanced                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-user/tests/basic                              │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/instance-profile/tests/advanced                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/instance-profile/tests/basic                      │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/internet-gateway/tests/basic                      │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/key-pair/tests/basic                              │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/lambda/main.tf                                    │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/lambda/tests/basic                                │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/lambda/tests/event-source-mapping                 │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/lambda/tests/go                                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/lambda/tests/python                               │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/lambda/tests/typescript                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/launch-template/tests/advanced                    │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/launch-template/tests/basic                       │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/managed-prefix-list/tests/basic                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/nat-gateway/tests/basic                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/parameter-store/tests/basic                       │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/rds-option-group/tests/basic                      │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/rds-parameter-group/tests/advanced                │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/rds-parameter-group/tests/basic                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/rds/main.tf                                       │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/rds/tests/advanced                                │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/rds/tests/basic                                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/route-table/tests/basic                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/s3/main.tf                                        │ terraform │         1         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/s3/tests/basic                                    │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/scp/tests/basic                                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/secrets-manager/tests/basic                       │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/security-group/main.tf                            │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/security-group/tests/basic                        │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/security-groups/tests/basic                       │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/sns/tests/basic                                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/sqs/tests/basic                                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/stack/audit-logging/tests/basic                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/stack/networking/tests/basic                      │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/stack/networking/tests/no-nat                     │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/stack/networking/tests/single-nat                 │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/subnet/main.tf                                    │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/subnet/tests/basic                                │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/vpc/main.tf                                       │ terraform │        10         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/vpc/tests/basic                                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/vpc/tests/no_default_nacl                         │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ gcp/cloud-functions/main.tf                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ gcp/cloud-functions/tests/basic                       │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ gcp/gcs/main.tf                                       │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ gcp/gcs/tests/basic                                   │ terraform │         0         │
└───────────────────────────────────────────────────────┴───────────┴───────────────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


aws/amazonmq/main.tf (terraform)
================================
Tests: 3 (SUCCESSES: 0, FAILURES: 3)
Failures: 3 (MEDIUM: 3, HIGH: 0, CRITICAL: 0)

AVD-AWS-0070 (MEDIUM): Broker does not have audit logging enabled.
════════════════════════════════════════
Logging should be enabled to allow tracing of issues and activity to be investigated more fully. Logs provide additional information and context which is often invalauble during investigation


See https://avd.aquasec.com/misconfig/avd-aws-0070
────────────────────────────────────────
 aws/amazonmq/main.tf:118
   via aws/amazonmq/main.tf:116-119 (logs)
    via aws/amazonmq/main.tf:14-143 (aws_mq_broker.this)
     via aws/amazonmq/tests/basic/main.tf:177-203 (module.test_activemq_minimal)
────────────────────────────────────────
  14   resource "aws_mq_broker" "this" {
  ..   
 118 [     audit   = var.enable_audit_log
 ...   
 143   }
────────────────────────────────────────


AVD-AWS-0070 (MEDIUM): Broker does not have audit logging enabled.
════════════════════════════════════════
Logging should be enabled to allow tracing of issues and activity to be investigated more fully. Logs provide additional information and context which is often invalauble during investigation


See https://avd.aquasec.com/misconfig/avd-aws-0070
────────────────────────────────────────
 aws/amazonmq/main.tf:118
   via aws/amazonmq/main.tf:116-119 (logs)
    via aws/amazonmq/main.tf:14-143 (aws_mq_broker.this)
     via aws/amazonmq/tests/basic/main.tf:144-174 (module.test_activemq_with_external_config)
────────────────────────────────────────
  14   resource "aws_mq_broker" "this" {
  ..   
 118 [     audit   = var.enable_audit_log
 ...   
 143   }
────────────────────────────────────────


AVD-AWS-0070 (MEDIUM): Broker does not have audit logging enabled.
════════════════════════════════════════
Logging should be enabled to allow tracing of issues and activity to be investigated more fully. Logs provide additional information and context which is often invalauble during investigation


See https://avd.aquasec.com/misconfig/avd-aws-0070
────────────────────────────────────────
 aws/amazonmq/main.tf:118
   via aws/amazonmq/main.tf:116-119 (logs)
    via aws/amazonmq/main.tf:14-143 (aws_mq_broker.this)
     via aws/amazonmq/tests/basic/main.tf:60-96 (module.test_rabbitmq_cluster)
────────────────────────────────────────
  14   resource "aws_mq_broker" "this" {
  ..   
 118 [     audit   = var.enable_audit_log
 ...   
 143   }
────────────────────────────────────────



aws/api-gateway/main.tf (terraform)
===================================
Tests: 6 (SUCCESSES: 0, FAILURES: 6)
Failures: 6 (MEDIUM: 6, HIGH: 0, CRITICAL: 0)

AVD-AWS-0001 (MEDIUM): Access logging is not configured.
════════════════════════════════════════
API Gateway stages should have access log settings block configured to track all access to a particular stage. This should be applied to both v1 and v2 gateway stages.


See https://avd.aquasec.com/misconfig/avd-aws-0001
────────────────────────────────────────
 aws/api-gateway/main.tf:315-346
   via aws/api-gateway/tests/basic/main.tf:29-57 (module.basic_api)
────────────────────────────────────────
 315 ┌ resource "aws_api_gateway_stage" "this" {
 316 │   rest_api_id   = aws_api_gateway_rest_api.this.id
 317 │   deployment_id = aws_api_gateway_deployment.this.id
 318 │   stage_name    = var.stage_name
 319 │   description   = var.stage_description
 320 │ 
 321 │   xray_tracing_enabled  = var.xray_tracing_enabled
 322 │   cache_cluster_enabled = var.cache_cluster_enabled
 323 └   cache_cluster_size    = var.cache_cluster_size
 ...   
────────────────────────────────────────


AVD-AWS-0001 (MEDIUM): Access logging is not configured.
════════════════════════════════════════
API Gateway stages should have access log settings block configured to track all access to a particular stage. This should be applied to both v1 and v2 gateway stages.


See https://avd.aquasec.com/misconfig/avd-aws-0001
────────────────────────────────────────
 aws/api-gateway/main.tf:315-346
   via aws/api-gateway/tests/basic/main.tf:350-381 (module.cached_api)
────────────────────────────────────────
 315 ┌ resource "aws_api_gateway_stage" "this" {
 316 │   rest_api_id   = aws_api_gateway_rest_api.this.id
 317 │   deployment_id = aws_api_gateway_deployment.this.id
 318 │   stage_name    = var.stage_name
 319 │   description   = var.stage_description
 320 │ 
 321 │   xray_tracing_enabled  = var.xray_tracing_enabled
 322 │   cache_cluster_enabled = var.cache_cluster_enabled
 323 └   cache_cluster_size    = var.cache_cluster_size
 ...   
────────────────────────────────────────


AVD-AWS-0001 (MEDIUM): Access logging is not configured.
════════════════════════════════════════
API Gateway stages should have access log settings block configured to track all access to a particular stage. This should be applied to both v1 and v2 gateway stages.


See https://avd.aquasec.com/misconfig/avd-aws-0001
────────────────────────────────────────
 aws/api-gateway/main.tf:315-346
   via aws/api-gateway/tests/basic/main.tf:388-457 (module.custom_responses_api)
────────────────────────────────────────
 315 ┌ resource "aws_api_gateway_stage" "this" {
 316 │   rest_api_id   = aws_api_gateway_rest_api.this.id
 317 │   deployment_id = aws_api_gateway_deployment.this.id
 318 │   stage_name    = var.stage_name
 319 │   description   = var.stage_description
 320 │ 
 321 │   xray_tracing_enabled  = var.xray_tracing_enabled
 322 │   cache_cluster_enabled = var.cache_cluster_enabled
 323 └   cache_cluster_size    = var.cache_cluster_size
 ...   
────────────────────────────────────────


AVD-AWS-0001 (MEDIUM): Access logging is not configured.
════════════════════════════════════════
API Gateway stages should have access log settings block configured to track all access to a particular stage. This should be applied to both v1 and v2 gateway stages.


See https://avd.aquasec.com/misconfig/avd-aws-0001
────────────────────────────────────────
 aws/api-gateway/main.tf:315-346
   via aws/api-gateway/tests/basic/main.tf:64-104 (module.lambda_api)
────────────────────────────────────────
 315 ┌ resource "aws_api_gateway_stage" "this" {
 316 │   rest_api_id   = aws_api_gateway_rest_api.this.id
 317 │   deployment_id = aws_api_gateway_deployment.this.id
 318 │   stage_name    = var.stage_name
 319 │   description   = var.stage_description
 320 │ 
 321 │   xray_tracing_enabled  = var.xray_tracing_enabled
 322 │   cache_cluster_enabled = var.cache_cluster_enabled
 323 └   cache_cluster_size    = var.cache_cluster_size
 ...   
────────────────────────────────────────


AVD-AWS-0001 (MEDIUM): Access logging is not configured.
════════════════════════════════════════
API Gateway stages should have access log settings block configured to track all access to a particular stage. This should be applied to both v1 and v2 gateway stages.


See https://avd.aquasec.com/misconfig/avd-aws-0001
────────────────────────────────────────
 aws/api-gateway/main.tf:315-346
   via aws/api-gateway/tests/basic/main.tf:174-259 (module.secured_api)
────────────────────────────────────────
 315 ┌ resource "aws_api_gateway_stage" "this" {
 316 │   rest_api_id   = aws_api_gateway_rest_api.this.id
 317 │   deployment_id = aws_api_gateway_deployment.this.id
 318 │   stage_name    = var.stage_name
 319 │   description   = var.stage_description
 320 │ 
 321 │   xray_tracing_enabled  = var.xray_tracing_enabled
 322 │   cache_cluster_enabled = var.cache_cluster_enabled
 323 └   cache_cluster_size    = var.cache_cluster_size
 ...   
────────────────────────────────────────


AVD-AWS-0001 (MEDIUM): Access logging is not configured.
════════════════════════════════════════
API Gateway stages should have access log settings block configured to track all access to a particular stage. This should be applied to both v1 and v2 gateway stages.


See https://avd.aquasec.com/misconfig/avd-aws-0001
────────────────────────────────────────
 aws/api-gateway/main.tf:315-346
   via aws/api-gateway/tests/basic/main.tf:266-343 (module.validated_api)
────────────────────────────────────────
 315 ┌ resource "aws_api_gateway_stage" "this" {
 316 │   rest_api_id   = aws_api_gateway_rest_api.this.id
 317 │   deployment_id = aws_api_gateway_deployment.this.id
 318 │   stage_name    = var.stage_name
 319 │   description   = var.stage_description
 320 │ 
 321 │   xray_tracing_enabled  = var.xray_tracing_enabled
 322 │   cache_cluster_enabled = var.cache_cluster_enabled
 323 └   cache_cluster_size    = var.cache_cluster_size
 ...   
────────────────────────────────────────



aws/cloudfront/main.tf (terraform)
==================================
Tests: 5 (SUCCESSES: 0, FAILURES: 5)
Failures: 5 (MEDIUM: 5, HIGH: 0, CRITICAL: 0)

AVD-AWS-0010 (MEDIUM): Distribution does not have logging enabled
════════════════════════════════════════
You should configure CloudFront Access Logging to create log files that contain detailed information about every user request that CloudFront receives


See https://avd.aquasec.com/misconfig/avd-aws-0010
────────────────────────────────────────
 aws/cloudfront/main.tf:56-312
   via aws/cloudfront/tests/alb_origin/main.tf:27-141 (module.test_alb_origin)
────────────────────────────────────────
  56 ┌ resource "aws_cloudfront_distribution" "this" {
  57 │   enabled             = var.enabled
  58 │   is_ipv6_enabled     = var.is_ipv6_enabled
  59 │   comment             = var.distribution_name
  60 │   default_root_object = var.default_root_object
  61 │   price_class         = var.price_class
  62 │   http_version        = var.http_version
  63 │   web_acl_id          = var.web_acl_id
  64 └   retain_on_delete    = var.retain_on_delete
  ..   
────────────────────────────────────────


AVD-AWS-0010 (MEDIUM): Distribution does not have logging enabled
════════════════════════════════════════
You should configure CloudFront Access Logging to create log files that contain detailed information about every user request that CloudFront receives


See https://avd.aquasec.com/misconfig/avd-aws-0010
────────────────────────────────────────
 aws/cloudfront/main.tf:56-312
   via aws/cloudfront/tests/basic/main.tf:26-82 (module.test_basic)
────────────────────────────────────────
  56 ┌ resource "aws_cloudfront_distribution" "this" {
  57 │   enabled             = var.enabled
  58 │   is_ipv6_enabled     = var.is_ipv6_enabled
  59 │   comment             = var.distribution_name
  60 │   default_root_object = var.default_root_object
  61 │   price_class         = var.price_class
  62 │   http_version        = var.http_version
  63 │   web_acl_id          = var.web_acl_id
  64 └   retain_on_delete    = var.retain_on_delete
  ..   
────────────────────────────────────────


AVD-AWS-0010 (MEDIUM): Distribution does not have logging enabled
════════════════════════════════════════
You should configure CloudFront Access Logging to create log files that contain detailed information about every user request that CloudFront receives


See https://avd.aquasec.com/misconfig/avd-aws-0010
────────────────────────────────────────
 aws/cloudfront/main.tf:56-312
   via aws/cloudfront/tests/lambda_edge/main.tf:30-155 (module.test_lambda_edge)
────────────────────────────────────────
  56 ┌ resource "aws_cloudfront_distribution" "this" {
  57 │   enabled             = var.enabled
  58 │   is_ipv6_enabled     = var.is_ipv6_enabled
  59 │   comment             = var.distribution_name
  60 │   default_root_object = var.default_root_object
  61 │   price_class         = var.price_class
  62 │   http_version        = var.http_version
  63 │   web_acl_id          = var.web_acl_id
  64 └   retain_on_delete    = var.retain_on_delete
  ..   
────────────────────────────────────────


AVD-AWS-0010 (MEDIUM): Distribution does not have logging enabled
════════════════════════════════════════
You should configure CloudFront Access Logging to create log files that contain detailed information about every user request that CloudFront receives


See https://avd.aquasec.com/misconfig/avd-aws-0010
────────────────────────────────────────
 aws/cloudfront/main.tf:56-312
   via aws/cloudfront/tests/multi_origin/main.tf:27-215 (module.test_multi_origin)
────────────────────────────────────────
  56 ┌ resource "aws_cloudfront_distribution" "this" {
  57 │   enabled             = var.enabled
  58 │   is_ipv6_enabled     = var.is_ipv6_enabled
  59 │   comment             = var.distribution_name
  60 │   default_root_object = var.default_root_object
  61 │   price_class         = var.price_class
  62 │   http_version        = var.http_version
  63 │   web_acl_id          = var.web_acl_id
  64 └   retain_on_delete    = var.retain_on_delete
  ..   
────────────────────────────────────────


AVD-AWS-0010 (MEDIUM): Distribution does not have logging enabled
════════════════════════════════════════
You should configure CloudFront Access Logging to create log files that contain detailed information about every user request that CloudFront receives


See https://avd.aquasec.com/misconfig/avd-aws-0010
────────────────────────────────────────
 aws/cloudfront/main.tf:56-312
   via aws/cloudfront/tests/s3_oac/main.tf:27-113 (module.test_s3_oac)
────────────────────────────────────────
  56 ┌ resource "aws_cloudfront_distribution" "this" {
  57 │   enabled             = var.enabled
  58 │   is_ipv6_enabled     = var.is_ipv6_enabled
  59 │   comment             = var.distribution_name
  60 │   default_root_object = var.default_root_object
  61 │   price_class         = var.price_class
  62 │   http_version        = var.http_version
  63 │   web_acl_id          = var.web_acl_id
  64 └   retain_on_delete    = var.retain_on_delete
  ..   
────────────────────────────────────────



aws/iam-group-policy/main.tf (terraform)
========================================
Tests: 2 (SUCCESSES: 0, FAILURES: 2)
Failures: 2 (MEDIUM: 2, HIGH: 0, CRITICAL: 0)

AVD-AWS-0123 (MEDIUM): Multi-Factor authentication is not enforced for group
════════════════════════════════════════
IAM groups should be protected with multi factor authentication to add safe guards to password compromise.


See https://avd.aquasec.com/misconfig/aws-iam-enforce-mfa
────────────────────────────────────────
 aws/iam-group-policy/main.tf:176-186
   via aws/iam-group-policy/tests/advanced/main.tf:23-71 (module.iam_group_policy)
────────────────────────────────────────
 176 ┌ resource "aws_iam_group" "this" {
 177 │   name = var.name
 178 │   path = var.path
 179 │ 
 180 │   lifecycle {
 181 │     precondition {
 182 │       condition     = length(local.all_inline_policies) <= 10
 183 │       error_message = "IAM groups support at most 10 inline policies. Reduce built-in policy toggles or custom_policy_statements."
 184 └     }
 ...   
────────────────────────────────────────


AVD-AWS-0123 (MEDIUM): Multi-Factor authentication is not enforced for group
════════════════════════════════════════
IAM groups should be protected with multi factor authentication to add safe guards to password compromise.


See https://avd.aquasec.com/misconfig/aws-iam-enforce-mfa
────────────────────────────────────────
 aws/iam-group-policy/main.tf:176-186
   via aws/iam-group-policy/tests/basic/main.tf:23-32 (module.iam_group_policy)
────────────────────────────────────────
 176 ┌ resource "aws_iam_group" "this" {
 177 │   name = var.name
 178 │   path = var.path
 179 │ 
 180 │   lifecycle {
 181 │     precondition {
 182 │       condition     = length(local.all_inline_policies) <= 10
 183 │       error_message = "IAM groups support at most 10 inline policies. Reduce built-in policy toggles or custom_policy_statements."
 184 └     }
 ...   
────────────────────────────────────────



aws/iam-group/main.tf (terraform)
=================================
Tests: 2 (SUCCESSES: 0, FAILURES: 2)
Failures: 2 (MEDIUM: 2, HIGH: 0, CRITICAL: 0)

AVD-AWS-0123 (MEDIUM): Multi-Factor authentication is not enforced for group
════════════════════════════════════════
IAM groups should be protected with multi factor authentication to add safe guards to password compromise.


See https://avd.aquasec.com/misconfig/aws-iam-enforce-mfa
────────────────────────────────────────
 aws/iam-group/main.tf:16-19
   via aws/iam-group/tests/advanced/main.tf:40-85 (module.iam_group)
────────────────────────────────────────
  16 ┌ resource "aws_iam_group" "this" {
  17 │   name = var.name
  18 │   path = var.path
  19 └ }
────────────────────────────────────────


AVD-AWS-0123 (MEDIUM): Multi-Factor authentication is not enforced for group
════════════════════════════════════════
IAM groups should be protected with multi factor authentication to add safe guards to password compromise.


See https://avd.aquasec.com/misconfig/aws-iam-enforce-mfa
────────────────────────────────────────
 aws/iam-group/main.tf:16-19
   via aws/iam-group/tests/basic/main.tf:26-34 (module.iam_group)
────────────────────────────────────────
  16 ┌ resource "aws_iam_group" "this" {
  17 │   name = var.name
  18 │   path = var.path
  19 └ }
────────────────────────────────────────



aws/s3/main.tf (terraform)
==========================
Tests: 1 (SUCCESSES: 0, FAILURES: 1)
Failures: 1 (MEDIUM: 1, HIGH: 0, CRITICAL: 0)

AVD-AWS-0090 (MEDIUM): Bucket does not have versioning enabled
════════════════════════════════════════
Versioning in Amazon S3 is a means of keeping multiple variants of an object in the same bucket.

You can use the S3 Versioning feature to preserve, retrieve, and restore every version of every object stored in your buckets.

With versioning you can recover more easily from both unintended user actions and application failures.

When you enable versioning, also keep in mind the potential costs of storing noncurrent versions of objects. To help manage those costs, consider setting up an S3 Lifecycle configuration.


See https://avd.aquasec.com/misconfig/avd-aws-0090
────────────────────────────────────────
 aws/s3/main.tf:33
   via aws/s3/main.tf:32-34 (versioning_configuration)
    via aws/s3/main.tf:29-35 (aws_s3_bucket_versioning.this)
     via aws/s3/tests/basic/main.tf:121-132 (module.no_versioning_bucket)
────────────────────────────────────────
  29   resource "aws_s3_bucket_versioning" "this" {
  30     bucket = aws_s3_bucket.this.id
  31   
  32     versioning_configuration {
  33 [     status = var.versioning_enabled ? "Enabled" : "Suspended"
  34     }
  35   }
────────────────────────────────────────



aws/vpc/main.tf (terraform)
===========================
Tests: 10 (SUCCESSES: 0, FAILURES: 10)
Failures: 10 (MEDIUM: 10, HIGH: 0, CRITICAL: 0)

AVD-AWS-0178 (MEDIUM): VPC does not have VPC Flow Logs enabled.
════════════════════════════════════════
VPC Flow Logs provide visibility into network traffic that traverses the VPC and can be used to detect anomalous traffic or insight during security workflows.


See https://avd.aquasec.com/misconfig/aws-autoscaling-enable-at-rest-encryption
────────────────────────────────────────
 aws/vpc/main.tf:12-26
   via aws/stack/networking/main.tf:47-61 (module.vpc)
    via aws/stack/networking/tests/basic/main.tf:23-34 (module.networking)
────────────────────────────────────────
  12 ┌ resource "aws_vpc" "this" {
  13 │   cidr_block                           = var.cidr_block
  14 │   enable_dns_support                   = var.enable_dns_support
  15 │   enable_dns_hostnames                 = var.enable_dns_hostnames
  16 │   assign_generated_ipv6_cidr_block     = var.enable_ipv6
  17 │   instance_tenancy                     = var.instance_tenancy
  18 │   enable_network_address_usage_metrics = var.enable_network_address_usage_metrics
  19 │ 
  20 └   tags = merge(
  ..   
────────────────────────────────────────


AVD-AWS-0178 (MEDIUM): VPC does not have VPC Flow Logs enabled.
════════════════════════════════════════
VPC Flow Logs provide visibility into network traffic that traverses the VPC and can be used to detect anomalous traffic or insight during security workflows.


See https://avd.aquasec.com/misconfig/aws-autoscaling-enable-at-rest-encryption
────────────────────────────────────────
 aws/vpc/main.tf:12-26
   via aws/stack/networking/main.tf:47-61 (module.vpc)
    via aws/stack/networking/tests/no-nat/main.tf:23-37 (module.networking)
────────────────────────────────────────
  12 ┌ resource "aws_vpc" "this" {
  13 │   cidr_block                           = var.cidr_block
  14 │   enable_dns_support                   = var.enable_dns_support
  15 │   enable_dns_hostnames                 = var.enable_dns_hostnames
  16 │   assign_generated_ipv6_cidr_block     = var.enable_ipv6
  17 │   instance_tenancy                     = var.instance_tenancy
  18 │   enable_network_address_usage_metrics = var.enable_network_address_usage_metrics
  19 │ 
  20 └   tags = merge(
  ..   
────────────────────────────────────────


AVD-AWS-0178 (MEDIUM): VPC does not have VPC Flow Logs enabled.
════════════════════════════════════════
VPC Flow Logs provide visibility into network traffic that traverses the VPC and can be used to detect anomalous traffic or insight during security workflows.


See https://avd.aquasec.com/misconfig/aws-autoscaling-enable-at-rest-encryption
────────────────────────────────────────
 aws/vpc/main.tf:12-26
   via aws/stack/networking/main.tf:47-61 (module.vpc)
    via aws/stack/networking/tests/single-nat/main.tf:23-34 (module.networking)
────────────────────────────────────────
  12 ┌ resource "aws_vpc" "this" {
  13 │   cidr_block                           = var.cidr_block
  14 │   enable_dns_support                   = var.enable_dns_support
  15 │   enable_dns_hostnames                 = var.enable_dns_hostnames
  16 │   assign_generated_ipv6_cidr_block     = var.enable_ipv6
  17 │   instance_tenancy                     = var.instance_tenancy
  18 │   enable_network_address_usage_metrics = var.enable_network_address_usage_metrics
  19 │ 
  20 └   tags = merge(
  ..   
────────────────────────────────────────


AVD-AWS-0178 (MEDIUM): VPC does not have VPC Flow Logs enabled.
════════════════════════════════════════
VPC Flow Logs provide visibility into network traffic that traverses the VPC and can be used to detect anomalous traffic or insight during security workflows.


See https://avd.aquasec.com/misconfig/aws-autoscaling-enable-at-rest-encryption
────────────────────────────────────────
 aws/vpc/main.tf:12-26
   via aws/vpc/tests/basic/main.tf:23-36 (module.test_vpc)
────────────────────────────────────────
  12 ┌ resource "aws_vpc" "this" {
  13 │   cidr_block                           = var.cidr_block
  14 │   enable_dns_support                   = var.enable_dns_support
  15 │   enable_dns_hostnames                 = var.enable_dns_hostnames
  16 │   assign_generated_ipv6_cidr_block     = var.enable_ipv6
  17 │   instance_tenancy                     = var.instance_tenancy
  18 │   enable_network_address_usage_metrics = var.enable_network_address_usage_metrics
  19 │ 
  20 └   tags = merge(
  ..   
────────────────────────────────────────


AVD-AWS-0178 (MEDIUM): VPC does not have VPC Flow Logs enabled.
════════════════════════════════════════
VPC Flow Logs provide visibility into network traffic that traverses the VPC and can be used to detect anomalous traffic or insight during security workflows.


See https://avd.aquasec.com/misconfig/aws-autoscaling-enable-at-rest-encryption
────────────────────────────────────────
 aws/vpc/main.tf:12-26
   via aws/vpc/tests/no_default_nacl/main.tf:23-39 (module.test_vpc_no_default_nacl)
────────────────────────────────────────
  12 ┌ resource "aws_vpc" "this" {
  13 │   cidr_block                           = var.cidr_block
  14 │   enable_dns_support                   = var.enable_dns_support
  15 │   enable_dns_hostnames                 = var.enable_dns_hostnames
  16 │   assign_generated_ipv6_cidr_block     = var.enable_ipv6
  17 │   instance_tenancy                     = var.instance_tenancy
  18 │   enable_network_address_usage_metrics = var.enable_network_address_usage_metrics
  19 │ 
  20 └   tags = merge(
  ..   
────────────────────────────────────────


AVD-AWS-0178 (MEDIUM): VPC does not have VPC Flow Logs enabled.
════════════════════════════════════════
VPC Flow Logs provide visibility into network traffic that traverses the VPC and can be used to detect anomalous traffic or insight during security workflows.


See https://avd.aquasec.com/misconfig/aws-autoscaling-enable-at-rest-encryption
────────────────────────────────────────
 aws/vpc/main.tf:12-26
   via aws/internet-gateway/tests/basic/main.tf:23-28 (module.vpc)
────────────────────────────────────────
  12 ┌ resource "aws_vpc" "this" {
  13 │   cidr_block                           = var.cidr_block
  14 │   enable_dns_support                   = var.enable_dns_support
  15 │   enable_dns_hostnames                 = var.enable_dns_hostnames
  16 │   assign_generated_ipv6_cidr_block     = var.enable_ipv6
  17 │   instance_tenancy                     = var.instance_tenancy
  18 │   enable_network_address_usage_metrics = var.enable_network_address_usage_metrics
  19 │ 
  20 └   tags = merge(
  ..   
────────────────────────────────────────


AVD-AWS-0178 (MEDIUM): VPC does not have VPC Flow Logs enabled.
════════════════════════════════════════
VPC Flow Logs provide visibility into network traffic that traverses the VPC and can be used to detect anomalous traffic or insight during security workflows.


See https://avd.aquasec.com/misconfig/aws-autoscaling-enable-at-rest-encryption
────────────────────────────────────────
 aws/vpc/main.tf:12-26
   via aws/nat-gateway/tests/basic/main.tf:23-28 (module.vpc)
────────────────────────────────────────
  12 ┌ resource "aws_vpc" "this" {
  13 │   cidr_block                           = var.cidr_block
  14 │   enable_dns_support                   = var.enable_dns_support
  15 │   enable_dns_hostnames                 = var.enable_dns_hostnames
  16 │   assign_generated_ipv6_cidr_block     = var.enable_ipv6
  17 │   instance_tenancy                     = var.instance_tenancy
  18 │   enable_network_address_usage_metrics = var.enable_network_address_usage_metrics
  19 │ 
  20 └   tags = merge(
  ..   
────────────────────────────────────────


AVD-AWS-0178 (MEDIUM): VPC does not have VPC Flow Logs enabled.
════════════════════════════════════════
VPC Flow Logs provide visibility into network traffic that traverses the VPC and can be used to detect anomalous traffic or insight during security workflows.


See https://avd.aquasec.com/misconfig/aws-autoscaling-enable-at-rest-encryption
────────────────────────────────────────
 aws/vpc/main.tf:12-26
   via aws/route-table/tests/basic/main.tf:23-28 (module.vpc)
────────────────────────────────────────
  12 ┌ resource "aws_vpc" "this" {
  13 │   cidr_block                           = var.cidr_block
  14 │   enable_dns_support                   = var.enable_dns_support
  15 │   enable_dns_hostnames                 = var.enable_dns_hostnames
  16 │   assign_generated_ipv6_cidr_block     = var.enable_ipv6
  17 │   instance_tenancy                     = var.instance_tenancy
  18 │   enable_network_address_usage_metrics = var.enable_network_address_usage_metrics
  19 │ 
  20 └   tags = merge(
  ..   
────────────────────────────────────────


AVD-AWS-0178 (MEDIUM): VPC does not have VPC Flow Logs enabled.
════════════════════════════════════════
VPC Flow Logs provide visibility into network traffic that traverses the VPC and can be used to detect anomalous traffic or insight during security workflows.


See https://avd.aquasec.com/misconfig/aws-autoscaling-enable-at-rest-encryption
────────────────────────────────────────
 aws/vpc/main.tf:12-26
   via aws/security-group/tests/basic/main.tf:23-28 (module.vpc)
────────────────────────────────────────
  12 ┌ resource "aws_vpc" "this" {
  13 │   cidr_block                           = var.cidr_block
  14 │   enable_dns_support                   = var.enable_dns_support
  15 │   enable_dns_hostnames                 = var.enable_dns_hostnames
  16 │   assign_generated_ipv6_cidr_block     = var.enable_ipv6
  17 │   instance_tenancy                     = var.instance_tenancy
  18 │   enable_network_address_usage_metrics = var.enable_network_address_usage_metrics
  19 │ 
  20 └   tags = merge(
  ..   
────────────────────────────────────────


AVD-AWS-0178 (MEDIUM): VPC does not have VPC Flow Logs enabled.
════════════════════════════════════════
VPC Flow Logs provide visibility into network traffic that traverses the VPC and can be used to detect anomalous traffic or insight during security workflows.


See https://avd.aquasec.com/misconfig/aws-autoscaling-enable-at-rest-encryption
────────────────────────────────────────
 aws/vpc/main.tf:12-26
   via aws/subnet/tests/basic/main.tf:23-28 (module.vpc)
────────────────────────────────────────
  12 ┌ resource "aws_vpc" "this" {
  13 │   cidr_block                           = var.cidr_block
  14 │   enable_dns_support                   = var.enable_dns_support
  15 │   enable_dns_hostnames                 = var.enable_dns_hostnames
  16 │   assign_generated_ipv6_cidr_block     = var.enable_ipv6
  17 │   instance_tenancy                     = var.instance_tenancy
  18 │   enable_network_address_usage_metrics = var.enable_network_address_usage_metrics
  19 │ 
  20 └   tags = merge(
  ..   
────────────────────────────────────────

👤 Pusher: @llama90 | 🔄 Action: pull_request | ⚙️ Workflow: Terraform Check

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant