Skip to content

feat(codepipeline): add V2 pipeline and CodeDeploy deployment support#97

Open
llama90 wants to merge 2 commits intomainfrom
feat/codepipeline-v2-codedeploy
Open

feat(codepipeline): add V2 pipeline and CodeDeploy deployment support#97
llama90 wants to merge 2 commits intomainfrom
feat/codepipeline-v2-codedeploy

Conversation

@llama90
Copy link
Contributor

@llama90 llama90 commented Feb 22, 2026

Major enhancement to CodePipeline module adding V2 pipeline support, CodeStarSourceConnection, optional build stage, and CodeDeploy deployment.

New Features

Pipeline V2 Support

  • Add pipeline_type variable (V1/V2, default: V2)
  • Add execution_mode for V2 pipelines (QUEUED/SUPERSEDED/PARALLEL)

CodeStarSourceConnection (GitHub V2)

  • Support CodeStarSourceConnection provider (in addition to GitHub V1)
  • Handle both codestar-connections and codeconnections ARN formats
  • Configurable detect_changes and output_artifact_format
  • Custom artifact names and action namespaces

Optional Build Stage

  • Add enable_build_stage flag (default: false)
  • Support pipelines without CodeBuild (Source → Deploy directly)
  • Backward compatible with existing CodeBuild configurations

CodeDeploy Deployment Stage

  • Add enable_deploy_stage flag (default: true)
  • Support multiple CodeDeploy deployments in parallel
  • Configurable action names, namespaces, and run orders
  • Auto-configure IAM permissions for CodeDeploy operations

Flexible Resource Management

  • Optional artifact bucket creation (create_artifact_bucket)
  • Optional service role creation (create_service_role)
  • Support using existing S3 buckets and IAM roles

Enhanced IAM Permissions

  • Dynamic IAM policy based on enabled stages
  • CodeStarSourceConnection permissions
  • CodeBuild permissions (when enabled)
  • CodeDeploy permissions (when enabled)

Breaking Changes

None - all new features use optional parameters with sensible defaults.

Migration Guide

Existing configurations will continue to work without changes.
To use new features, add the relevant variables to your configuration.

🤖 Generated with Claude Code

Major enhancement to CodePipeline module adding V2 pipeline support, CodeStarSourceConnection, optional build stage, and CodeDeploy deployment.

## New Features

### Pipeline V2 Support
- Add `pipeline_type` variable (V1/V2, default: V2)
- Add `execution_mode` for V2 pipelines (QUEUED/SUPERSEDED/PARALLEL)

### CodeStarSourceConnection (GitHub V2)
- Support `CodeStarSourceConnection` provider (in addition to GitHub V1)
- Handle both `codestar-connections` and `codeconnections` ARN formats
- Configurable `detect_changes` and `output_artifact_format`
- Custom artifact names and action namespaces

### Optional Build Stage
- Add `enable_build_stage` flag (default: false)
- Support pipelines without CodeBuild (Source → Deploy directly)
- Backward compatible with existing CodeBuild configurations

### CodeDeploy Deployment Stage
- Add `enable_deploy_stage` flag (default: true)
- Support multiple CodeDeploy deployments in parallel
- Configurable action names, namespaces, and run orders
- Auto-configure IAM permissions for CodeDeploy operations

### Flexible Resource Management
- Optional artifact bucket creation (`create_artifact_bucket`)
- Optional service role creation (`create_service_role`)
- Support using existing S3 buckets and IAM roles

### Enhanced IAM Permissions
- Dynamic IAM policy based on enabled stages
- CodeStarSourceConnection permissions
- CodeBuild permissions (when enabled)
- CodeDeploy permissions (when enabled)

## Breaking Changes
None - all new features use optional parameters with sensible defaults.

## Migration Guide
Existing configurations will continue to work without changes.
To use new features, add the relevant variables to your configuration.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
@github-actions
Copy link
Contributor

🔍 Terraform Check Results

📊 Summary

All checks passed!

Check Status Issues Scope
🖌 Format ✅ success - All modules
🤖 Validate ✅ success - All modules
🔍 TFLint ✅ success 0 issue(s) terraform
🔒 Trivy ✅ success 0 critical, 0 high, 29 medium terraform

🔍 TFLint Details (0 issue(s))
Running TFLint on changed modules:
terraform

=== Checking terraform ===
🔒 Trivy Security Details (29 issue(s))
Running Trivy on changed modules:
terraform

=== Scanning terraform ===

Report Summary

┌───────────────────────────────────────────────────────┬───────────┬───────────────────┐
│                        Target                         │   Type    │ Misconfigurations │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ _template/tests/basic                                 │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/alb-target-group/tests/basic                      │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/alb-target-group/tests/with_listener_rule         │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/alb/main.tf                                       │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/alb/tests/basic                                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/alb/tests/host_based                              │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/alb/tests/https                                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/alb/tests/multi_target                            │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/alb/tests/path_based                              │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/amazonmq-rabbitmq/tests/basic                     │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/amazonmq/main.tf                                  │ terraform │         3         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/amazonmq/tests/basic                              │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ami/tests/basic                                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/api-gateway/main.tf                               │ terraform │         6         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/api-gateway/tests/basic                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/autoscaling/tests/basic                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/autoscaling/tests/with-instance-profile           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/autoscaling/tests/with-step-scaling               │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/autoscaling/tests/with-warm-pool                  │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/aws-lb-controller-role/tests/basic                │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/bedrock/main.tf                                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/bedrock/tests/advanced                            │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/bedrock/tests/basic                               │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/cloudfront/main.tf                                │ terraform │         5         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/cloudfront/tests/alb_origin                       │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/cloudfront/tests/basic                            │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/cloudfront/tests/lambda_edge                      │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/cloudfront/tests/multi_origin                     │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/cloudfront/tests/s3_oac                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/cloudtrail/tests/basic                            │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/cloudwatch-alarm/tests/basic                      │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/cloudwatch-dashboard/tests/basic                  │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/cloudwatch-dashboard/tests/custom-metrics         │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/cloudwatch-dashboard/tests/pipeline               │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/codebuild/main.tf                                 │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/codebuild/tests/basic                             │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/codebuild/tests/custom_compute                    │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/codebuild/tests/with_pipeline                     │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/codedeploy/tests/basic                            │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/codedeploy/tests/ec2                              │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/codedeploy/tests/ecs                              │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/codedeploy/tests/lambda                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/codepipeline/main.tf                              │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/codepipeline/tests/basic                          │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/dynamodb/tests/advanced                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/dynamodb/tests/basic                              │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ec2/tests/basic                                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ec2/tests/spot_instance                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ec2/tests/user_data                               │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ec2/tests/with_ebs                                │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ec2/tests/with_eip                                │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ecr/main.tf                                       │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ecr/tests/basic                                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ecs-cluster/main.tf                               │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ecs-cluster/tests/basic                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ecs-cluster/tests/with_capacity_providers         │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ecs-execution-role/tests/basic                    │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ecs-execution-role/tests/with_additional_policies │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ecs-service/main.tf                               │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ecs-service/tests/basic                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ecs-service/tests/with_autoscaling                │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ecs-task-role/tests/basic                         │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ecs-task-role/tests/with_policies                 │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/eks-app-deployment/tests/basic                    │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/eks-lb-controller/tests/basic                     │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/eks-node-role/tests/basic                         │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/eks/main.tf                                       │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/eks/tests/basic                                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/elasticache/tests/advanced                        │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/elasticache/tests/basic                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/eventbridge/tests/basic                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/eventbridge/tests/basic/main.tf                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/eventbridge/tests/cross_account                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/eventbridge/tests/cross_account/main.tf           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/eventbridge/tests/pattern                         │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/eventbridge/tests/scheduled                       │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/eventbridge/tests/scheduled/main.tf               │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-group-policy-attachment/tests/basic           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-group-policy/main.tf                          │ terraform │         2         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-group-policy/tests/advanced                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-group-policy/tests/basic                      │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-group/main.tf                                 │ terraform │         2         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-group/tests/advanced                          │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-group/tests/basic                             │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-policy/tests/basic                            │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-policy/tests/with_policy_document             │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-user-group-membership/tests/basic             │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-user-group-membership/tests/multiple-groups   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-user/main.tf                                  │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-user/tests/advanced                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-user/tests/basic                              │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/instance-profile/tests/advanced                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/instance-profile/tests/basic                      │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/internet-gateway/tests/basic                      │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/key-pair/tests/basic                              │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/lambda/main.tf                                    │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/lambda/tests/basic                                │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/lambda/tests/event-source-mapping                 │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/lambda/tests/go                                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/lambda/tests/python                               │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/lambda/tests/typescript                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/launch-template/tests/advanced                    │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/launch-template/tests/basic                       │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/managed-prefix-list/tests/basic                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/nat-gateway/tests/basic                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/parameter-store/tests/basic                       │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/rds-option-group/tests/basic                      │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/rds-parameter-group/tests/advanced                │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/rds-parameter-group/tests/basic                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/rds/main.tf                                       │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/rds/tests/advanced                                │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/rds/tests/basic                                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/route-table/tests/basic                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/s3/main.tf                                        │ terraform │         1         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/s3/tests/basic                                    │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/scp/tests/basic                                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/secrets-manager/tests/basic                       │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/security-group/main.tf                            │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/security-group/tests/basic                        │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/security-groups/tests/basic                       │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/sns/tests/basic                                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/sqs/tests/basic                                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/stack/audit-logging/tests/basic                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/stack/networking/tests/basic                      │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/stack/networking/tests/no-nat                     │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/stack/networking/tests/single-nat                 │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/subnet/main.tf                                    │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/subnet/tests/basic                                │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/vpc/main.tf                                       │ terraform │        10         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/vpc/tests/basic                                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/vpc/tests/no_default_nacl                         │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ gcp/cloud-functions/main.tf                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ gcp/cloud-functions/tests/basic                       │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ gcp/gcs/main.tf                                       │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ gcp/gcs/tests/basic                                   │ terraform │         0         │
└───────────────────────────────────────────────────────┴───────────┴───────────────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


aws/amazonmq/main.tf (terraform)
================================
Tests: 3 (SUCCESSES: 0, FAILURES: 3)
Failures: 3 (MEDIUM: 3, HIGH: 0, CRITICAL: 0)

AVD-AWS-0070 (MEDIUM): Broker does not have audit logging enabled.
════════════════════════════════════════
Logging should be enabled to allow tracing of issues and activity to be investigated more fully. Logs provide additional information and context which is often invalauble during investigation


See https://avd.aquasec.com/misconfig/avd-aws-0070
────────────────────────────────────────
 aws/amazonmq/main.tf:118
   via aws/amazonmq/main.tf:116-119 (logs)
    via aws/amazonmq/main.tf:14-143 (aws_mq_broker.this)
     via aws/amazonmq/tests/basic/main.tf:177-203 (module.test_activemq_minimal)
────────────────────────────────────────
  14   resource "aws_mq_broker" "this" {
  ..   
 118 [     audit   = var.enable_audit_log
 ...   
 143   }
────────────────────────────────────────


AVD-AWS-0070 (MEDIUM): Broker does not have audit logging enabled.
════════════════════════════════════════
Logging should be enabled to allow tracing of issues and activity to be investigated more fully. Logs provide additional information and context which is often invalauble during investigation


See https://avd.aquasec.com/misconfig/avd-aws-0070
────────────────────────────────────────
 aws/amazonmq/main.tf:118
   via aws/amazonmq/main.tf:116-119 (logs)
    via aws/amazonmq/main.tf:14-143 (aws_mq_broker.this)
     via aws/amazonmq/tests/basic/main.tf:144-174 (module.test_activemq_with_external_config)
────────────────────────────────────────
  14   resource "aws_mq_broker" "this" {
  ..   
 118 [     audit   = var.enable_audit_log
 ...   
 143   }
────────────────────────────────────────


AVD-AWS-0070 (MEDIUM): Broker does not have audit logging enabled.
════════════════════════════════════════
Logging should be enabled to allow tracing of issues and activity to be investigated more fully. Logs provide additional information and context which is often invalauble during investigation


See https://avd.aquasec.com/misconfig/avd-aws-0070
────────────────────────────────────────
 aws/amazonmq/main.tf:118
   via aws/amazonmq/main.tf:116-119 (logs)
    via aws/amazonmq/main.tf:14-143 (aws_mq_broker.this)
     via aws/amazonmq/tests/basic/main.tf:60-96 (module.test_rabbitmq_cluster)
────────────────────────────────────────
  14   resource "aws_mq_broker" "this" {
  ..   
 118 [     audit   = var.enable_audit_log
 ...   
 143   }
────────────────────────────────────────



aws/api-gateway/main.tf (terraform)
===================================
Tests: 6 (SUCCESSES: 0, FAILURES: 6)
Failures: 6 (MEDIUM: 6, HIGH: 0, CRITICAL: 0)

AVD-AWS-0001 (MEDIUM): Access logging is not configured.
════════════════════════════════════════
API Gateway stages should have access log settings block configured to track all access to a particular stage. This should be applied to both v1 and v2 gateway stages.


See https://avd.aquasec.com/misconfig/avd-aws-0001
────────────────────────────────────────
 aws/api-gateway/main.tf:315-346
   via aws/api-gateway/tests/basic/main.tf:29-57 (module.basic_api)
────────────────────────────────────────
 315 ┌ resource "aws_api_gateway_stage" "this" {
 316 │   rest_api_id   = aws_api_gateway_rest_api.this.id
 317 │   deployment_id = aws_api_gateway_deployment.this.id
 318 │   stage_name    = var.stage_name
 319 │   description   = var.stage_description
 320 │ 
 321 │   xray_tracing_enabled  = var.xray_tracing_enabled
 322 │   cache_cluster_enabled = var.cache_cluster_enabled
 323 └   cache_cluster_size    = var.cache_cluster_size
 ...   
────────────────────────────────────────


AVD-AWS-0001 (MEDIUM): Access logging is not configured.
════════════════════════════════════════
API Gateway stages should have access log settings block configured to track all access to a particular stage. This should be applied to both v1 and v2 gateway stages.


See https://avd.aquasec.com/misconfig/avd-aws-0001
────────────────────────────────────────
 aws/api-gateway/main.tf:315-346
   via aws/api-gateway/tests/basic/main.tf:350-381 (module.cached_api)
────────────────────────────────────────
 315 ┌ resource "aws_api_gateway_stage" "this" {
 316 │   rest_api_id   = aws_api_gateway_rest_api.this.id
 317 │   deployment_id = aws_api_gateway_deployment.this.id
 318 │   stage_name    = var.stage_name
 319 │   description   = var.stage_description
 320 │ 
 321 │   xray_tracing_enabled  = var.xray_tracing_enabled
 322 │   cache_cluster_enabled = var.cache_cluster_enabled
 323 └   cache_cluster_size    = var.cache_cluster_size
 ...   
────────────────────────────────────────


AVD-AWS-0001 (MEDIUM): Access logging is not configured.
════════════════════════════════════════
API Gateway stages should have access log settings block configured to track all access to a particular stage. This should be applied to both v1 and v2 gateway stages.


See https://avd.aquasec.com/misconfig/avd-aws-0001
────────────────────────────────────────
 aws/api-gateway/main.tf:315-346
   via aws/api-gateway/tests/basic/main.tf:388-457 (module.custom_responses_api)
────────────────────────────────────────
 315 ┌ resource "aws_api_gateway_stage" "this" {
 316 │   rest_api_id   = aws_api_gateway_rest_api.this.id
 317 │   deployment_id = aws_api_gateway_deployment.this.id
 318 │   stage_name    = var.stage_name
 319 │   description   = var.stage_description
 320 │ 
 321 │   xray_tracing_enabled  = var.xray_tracing_enabled
 322 │   cache_cluster_enabled = var.cache_cluster_enabled
 323 └   cache_cluster_size    = var.cache_cluster_size
 ...   
────────────────────────────────────────


AVD-AWS-0001 (MEDIUM): Access logging is not configured.
════════════════════════════════════════
API Gateway stages should have access log settings block configured to track all access to a particular stage. This should be applied to both v1 and v2 gateway stages.


See https://avd.aquasec.com/misconfig/avd-aws-0001
────────────────────────────────────────
 aws/api-gateway/main.tf:315-346
   via aws/api-gateway/tests/basic/main.tf:64-104 (module.lambda_api)
────────────────────────────────────────
 315 ┌ resource "aws_api_gateway_stage" "this" {
 316 │   rest_api_id   = aws_api_gateway_rest_api.this.id
 317 │   deployment_id = aws_api_gateway_deployment.this.id
 318 │   stage_name    = var.stage_name
 319 │   description   = var.stage_description
 320 │ 
 321 │   xray_tracing_enabled  = var.xray_tracing_enabled
 322 │   cache_cluster_enabled = var.cache_cluster_enabled
 323 └   cache_cluster_size    = var.cache_cluster_size
 ...   
────────────────────────────────────────


AVD-AWS-0001 (MEDIUM): Access logging is not configured.
════════════════════════════════════════
API Gateway stages should have access log settings block configured to track all access to a particular stage. This should be applied to both v1 and v2 gateway stages.


See https://avd.aquasec.com/misconfig/avd-aws-0001
────────────────────────────────────────
 aws/api-gateway/main.tf:315-346
   via aws/api-gateway/tests/basic/main.tf:174-259 (module.secured_api)
────────────────────────────────────────
 315 ┌ resource "aws_api_gateway_stage" "this" {
 316 │   rest_api_id   = aws_api_gateway_rest_api.this.id
 317 │   deployment_id = aws_api_gateway_deployment.this.id
 318 │   stage_name    = var.stage_name
 319 │   description   = var.stage_description
 320 │ 
 321 │   xray_tracing_enabled  = var.xray_tracing_enabled
 322 │   cache_cluster_enabled = var.cache_cluster_enabled
 323 └   cache_cluster_size    = var.cache_cluster_size
 ...   
────────────────────────────────────────


AVD-AWS-0001 (MEDIUM): Access logging is not configured.
════════════════════════════════════════
API Gateway stages should have access log settings block configured to track all access to a particular stage. This should be applied to both v1 and v2 gateway stages.


See https://avd.aquasec.com/misconfig/avd-aws-0001
────────────────────────────────────────
 aws/api-gateway/main.tf:315-346
   via aws/api-gateway/tests/basic/main.tf:266-343 (module.validated_api)
────────────────────────────────────────
 315 ┌ resource "aws_api_gateway_stage" "this" {
 316 │   rest_api_id   = aws_api_gateway_rest_api.this.id
 317 │   deployment_id = aws_api_gateway_deployment.this.id
 318 │   stage_name    = var.stage_name
 319 │   description   = var.stage_description
 320 │ 
 321 │   xray_tracing_enabled  = var.xray_tracing_enabled
 322 │   cache_cluster_enabled = var.cache_cluster_enabled
 323 └   cache_cluster_size    = var.cache_cluster_size
 ...   
────────────────────────────────────────



aws/cloudfront/main.tf (terraform)
==================================
Tests: 5 (SUCCESSES: 0, FAILURES: 5)
Failures: 5 (MEDIUM: 5, HIGH: 0, CRITICAL: 0)

AVD-AWS-0010 (MEDIUM): Distribution does not have logging enabled
════════════════════════════════════════
You should configure CloudFront Access Logging to create log files that contain detailed information about every user request that CloudFront receives


See https://avd.aquasec.com/misconfig/avd-aws-0010
────────────────────────────────────────
 aws/cloudfront/main.tf:56-312
   via aws/cloudfront/tests/alb_origin/main.tf:27-141 (module.test_alb_origin)
────────────────────────────────────────
  56 ┌ resource "aws_cloudfront_distribution" "this" {
  57 │   enabled             = var.enabled
  58 │   is_ipv6_enabled     = var.is_ipv6_enabled
  59 │   comment             = var.distribution_name
  60 │   default_root_object = var.default_root_object
  61 │   price_class         = var.price_class
  62 │   http_version        = var.http_version
  63 │   web_acl_id          = var.web_acl_id
  64 └   retain_on_delete    = var.retain_on_delete
  ..   
────────────────────────────────────────


AVD-AWS-0010 (MEDIUM): Distribution does not have logging enabled
════════════════════════════════════════
You should configure CloudFront Access Logging to create log files that contain detailed information about every user request that CloudFront receives


See https://avd.aquasec.com/misconfig/avd-aws-0010
────────────────────────────────────────
 aws/cloudfront/main.tf:56-312
   via aws/cloudfront/tests/basic/main.tf:26-82 (module.test_basic)
────────────────────────────────────────
  56 ┌ resource "aws_cloudfront_distribution" "this" {
  57 │   enabled             = var.enabled
  58 │   is_ipv6_enabled     = var.is_ipv6_enabled
  59 │   comment             = var.distribution_name
  60 │   default_root_object = var.default_root_object
  61 │   price_class         = var.price_class
  62 │   http_version        = var.http_version
  63 │   web_acl_id          = var.web_acl_id
  64 └   retain_on_delete    = var.retain_on_delete
  ..   
────────────────────────────────────────


AVD-AWS-0010 (MEDIUM): Distribution does not have logging enabled
════════════════════════════════════════
You should configure CloudFront Access Logging to create log files that contain detailed information about every user request that CloudFront receives


See https://avd.aquasec.com/misconfig/avd-aws-0010
────────────────────────────────────────
 aws/cloudfront/main.tf:56-312
   via aws/cloudfront/tests/lambda_edge/main.tf:30-155 (module.test_lambda_edge)
────────────────────────────────────────
  56 ┌ resource "aws_cloudfront_distribution" "this" {
  57 │   enabled             = var.enabled
  58 │   is_ipv6_enabled     = var.is_ipv6_enabled
  59 │   comment             = var.distribution_name
  60 │   default_root_object = var.default_root_object
  61 │   price_class         = var.price_class
  62 │   http_version        = var.http_version
  63 │   web_acl_id          = var.web_acl_id
  64 └   retain_on_delete    = var.retain_on_delete
  ..   
────────────────────────────────────────


AVD-AWS-0010 (MEDIUM): Distribution does not have logging enabled
════════════════════════════════════════
You should configure CloudFront Access Logging to create log files that contain detailed information about every user request that CloudFront receives


See https://avd.aquasec.com/misconfig/avd-aws-0010
────────────────────────────────────────
 aws/cloudfront/main.tf:56-312
   via aws/cloudfront/tests/multi_origin/main.tf:27-215 (module.test_multi_origin)
────────────────────────────────────────
  56 ┌ resource "aws_cloudfront_distribution" "this" {
  57 │   enabled             = var.enabled
  58 │   is_ipv6_enabled     = var.is_ipv6_enabled
  59 │   comment             = var.distribution_name
  60 │   default_root_object = var.default_root_object
  61 │   price_class         = var.price_class
  62 │   http_version        = var.http_version
  63 │   web_acl_id          = var.web_acl_id
  64 └   retain_on_delete    = var.retain_on_delete
  ..   
────────────────────────────────────────


AVD-AWS-0010 (MEDIUM): Distribution does not have logging enabled
════════════════════════════════════════
You should configure CloudFront Access Logging to create log files that contain detailed information about every user request that CloudFront receives


See https://avd.aquasec.com/misconfig/avd-aws-0010
────────────────────────────────────────
 aws/cloudfront/main.tf:56-312
   via aws/cloudfront/tests/s3_oac/main.tf:27-113 (module.test_s3_oac)
────────────────────────────────────────
  56 ┌ resource "aws_cloudfront_distribution" "this" {
  57 │   enabled             = var.enabled
  58 │   is_ipv6_enabled     = var.is_ipv6_enabled
  59 │   comment             = var.distribution_name
  60 │   default_root_object = var.default_root_object
  61 │   price_class         = var.price_class
  62 │   http_version        = var.http_version
  63 │   web_acl_id          = var.web_acl_id
  64 └   retain_on_delete    = var.retain_on_delete
  ..   
────────────────────────────────────────



aws/iam-group-policy/main.tf (terraform)
========================================
Tests: 2 (SUCCESSES: 0, FAILURES: 2)
Failures: 2 (MEDIUM: 2, HIGH: 0, CRITICAL: 0)

AVD-AWS-0123 (MEDIUM): Multi-Factor authentication is not enforced for group
════════════════════════════════════════
IAM groups should be protected with multi factor authentication to add safe guards to password compromise.


See https://avd.aquasec.com/misconfig/aws-iam-enforce-mfa
────────────────────────────────────────
 aws/iam-group-policy/main.tf:176-186
   via aws/iam-group-policy/tests/advanced/main.tf:23-71 (module.iam_group_policy)
────────────────────────────────────────
 176 ┌ resource "aws_iam_group" "this" {
 177 │   name = var.name
 178 │   path = var.path
 179 │ 
 180 │   lifecycle {
 181 │     precondition {
 182 │       condition     = length(local.all_inline_policies) <= 10
 183 │       error_message = "IAM groups support at most 10 inline policies. Reduce built-in policy toggles or custom_policy_statements."
 184 └     }
 ...   
────────────────────────────────────────


AVD-AWS-0123 (MEDIUM): Multi-Factor authentication is not enforced for group
════════════════════════════════════════
IAM groups should be protected with multi factor authentication to add safe guards to password compromise.


See https://avd.aquasec.com/misconfig/aws-iam-enforce-mfa
────────────────────────────────────────
 aws/iam-group-policy/main.tf:176-186
   via aws/iam-group-policy/tests/basic/main.tf:23-32 (module.iam_group_policy)
────────────────────────────────────────
 176 ┌ resource "aws_iam_group" "this" {
 177 │   name = var.name
 178 │   path = var.path
 179 │ 
 180 │   lifecycle {
 181 │     precondition {
 182 │       condition     = length(local.all_inline_policies) <= 10
 183 │       error_message = "IAM groups support at most 10 inline policies. Reduce built-in policy toggles or custom_policy_statements."
 184 └     }
 ...   
────────────────────────────────────────



aws/iam-group/main.tf (terraform)
=================================
Tests: 2 (SUCCESSES: 0, FAILURES: 2)
Failures: 2 (MEDIUM: 2, HIGH: 0, CRITICAL: 0)

AVD-AWS-0123 (MEDIUM): Multi-Factor authentication is not enforced for group
════════════════════════════════════════
IAM groups should be protected with multi factor authentication to add safe guards to password compromise.


See https://avd.aquasec.com/misconfig/aws-iam-enforce-mfa
────────────────────────────────────────
 aws/iam-group/main.tf:16-19
   via aws/iam-group/tests/advanced/main.tf:40-85 (module.iam_group)
────────────────────────────────────────
  16 ┌ resource "aws_iam_group" "this" {
  17 │   name = var.name
  18 │   path = var.path
  19 └ }
────────────────────────────────────────


AVD-AWS-0123 (MEDIUM): Multi-Factor authentication is not enforced for group
════════════════════════════════════════
IAM groups should be protected with multi factor authentication to add safe guards to password compromise.


See https://avd.aquasec.com/misconfig/aws-iam-enforce-mfa
────────────────────────────────────────
 aws/iam-group/main.tf:16-19
   via aws/iam-group/tests/basic/main.tf:26-34 (module.iam_group)
────────────────────────────────────────
  16 ┌ resource "aws_iam_group" "this" {
  17 │   name = var.name
  18 │   path = var.path
  19 └ }
────────────────────────────────────────



aws/s3/main.tf (terraform)
==========================
Tests: 1 (SUCCESSES: 0, FAILURES: 1)
Failures: 1 (MEDIUM: 1, HIGH: 0, CRITICAL: 0)

AVD-AWS-0090 (MEDIUM): Bucket does not have versioning enabled
════════════════════════════════════════
Versioning in Amazon S3 is a means of keeping multiple variants of an object in the same bucket.

You can use the S3 Versioning feature to preserve, retrieve, and restore every version of every object stored in your buckets.

With versioning you can recover more easily from both unintended user actions and application failures.

When you enable versioning, also keep in mind the potential costs of storing noncurrent versions of objects. To help manage those costs, consider setting up an S3 Lifecycle configuration.


See https://avd.aquasec.com/misconfig/avd-aws-0090
────────────────────────────────────────
 aws/s3/main.tf:33
   via aws/s3/main.tf:32-34 (versioning_configuration)
    via aws/s3/main.tf:29-35 (aws_s3_bucket_versioning.this)
     via aws/s3/tests/basic/main.tf:121-132 (module.no_versioning_bucket)
────────────────────────────────────────
  29   resource "aws_s3_bucket_versioning" "this" {
  30     bucket = aws_s3_bucket.this.id
  31   
  32     versioning_configuration {
  33 [     status = var.versioning_enabled ? "Enabled" : "Suspended"
  34     }
  35   }
────────────────────────────────────────



aws/vpc/main.tf (terraform)
===========================
Tests: 10 (SUCCESSES: 0, FAILURES: 10)
Failures: 10 (MEDIUM: 10, HIGH: 0, CRITICAL: 0)

AVD-AWS-0178 (MEDIUM): VPC does not have VPC Flow Logs enabled.
════════════════════════════════════════
VPC Flow Logs provide visibility into network traffic that traverses the VPC and can be used to detect anomalous traffic or insight during security workflows.


See https://avd.aquasec.com/misconfig/aws-autoscaling-enable-at-rest-encryption
────────────────────────────────────────
 aws/vpc/main.tf:12-26
   via aws/stack/networking/main.tf:47-61 (module.vpc)
    via aws/stack/networking/tests/basic/main.tf:23-34 (module.networking)
────────────────────────────────────────
  12 ┌ resource "aws_vpc" "this" {
  13 │   cidr_block                           = var.cidr_block
  14 │   enable_dns_support                   = var.enable_dns_support
  15 │   enable_dns_hostnames                 = var.enable_dns_hostnames
  16 │   assign_generated_ipv6_cidr_block     = var.enable_ipv6
  17 │   instance_tenancy                     = var.instance_tenancy
  18 │   enable_network_address_usage_metrics = var.enable_network_address_usage_metrics
  19 │ 
  20 └   tags = merge(
  ..   
────────────────────────────────────────


AVD-AWS-0178 (MEDIUM): VPC does not have VPC Flow Logs enabled.
════════════════════════════════════════
VPC Flow Logs provide visibility into network traffic that traverses the VPC and can be used to detect anomalous traffic or insight during security workflows.


See https://avd.aquasec.com/misconfig/aws-autoscaling-enable-at-rest-encryption
────────────────────────────────────────
 aws/vpc/main.tf:12-26
   via aws/stack/networking/main.tf:47-61 (module.vpc)
    via aws/stack/networking/tests/no-nat/main.tf:23-37 (module.networking)
────────────────────────────────────────
  12 ┌ resource "aws_vpc" "this" {
  13 │   cidr_block                           = var.cidr_block
  14 │   enable_dns_support                   = var.enable_dns_support
  15 │   enable_dns_hostnames                 = var.enable_dns_hostnames
  16 │   assign_generated_ipv6_cidr_block     = var.enable_ipv6
  17 │   instance_tenancy                     = var.instance_tenancy
  18 │   enable_network_address_usage_metrics = var.enable_network_address_usage_metrics
  19 │ 
  20 └   tags = merge(
  ..   
────────────────────────────────────────


AVD-AWS-0178 (MEDIUM): VPC does not have VPC Flow Logs enabled.
════════════════════════════════════════
VPC Flow Logs provide visibility into network traffic that traverses the VPC and can be used to detect anomalous traffic or insight during security workflows.


See https://avd.aquasec.com/misconfig/aws-autoscaling-enable-at-rest-encryption
────────────────────────────────────────
 aws/vpc/main.tf:12-26
   via aws/stack/networking/main.tf:47-61 (module.vpc)
    via aws/stack/networking/tests/single-nat/main.tf:23-34 (module.networking)
────────────────────────────────────────
  12 ┌ resource "aws_vpc" "this" {
  13 │   cidr_block                           = var.cidr_block
  14 │   enable_dns_support                   = var.enable_dns_support
  15 │   enable_dns_hostnames                 = var.enable_dns_hostnames
  16 │   assign_generated_ipv6_cidr_block     = var.enable_ipv6
  17 │   instance_tenancy                     = var.instance_tenancy
  18 │   enable_network_address_usage_metrics = var.enable_network_address_usage_metrics
  19 │ 
  20 └   tags = merge(
  ..   
────────────────────────────────────────


AVD-AWS-0178 (MEDIUM): VPC does not have VPC Flow Logs enabled.
════════════════════════════════════════
VPC Flow Logs provide visibility into network traffic that traverses the VPC and can be used to detect anomalous traffic or insight during security workflows.


See https://avd.aquasec.com/misconfig/aws-autoscaling-enable-at-rest-encryption
────────────────────────────────────────
 aws/vpc/main.tf:12-26
   via aws/vpc/tests/basic/main.tf:23-36 (module.test_vpc)
────────────────────────────────────────
  12 ┌ resource "aws_vpc" "this" {
  13 │   cidr_block                           = var.cidr_block
  14 │   enable_dns_support                   = var.enable_dns_support
  15 │   enable_dns_hostnames                 = var.enable_dns_hostnames
  16 │   assign_generated_ipv6_cidr_block     = var.enable_ipv6
  17 │   instance_tenancy                     = var.instance_tenancy
  18 │   enable_network_address_usage_metrics = var.enable_network_address_usage_metrics
  19 │ 
  20 └   tags = merge(
  ..   
────────────────────────────────────────


AVD-AWS-0178 (MEDIUM): VPC does not have VPC Flow Logs enabled.
════════════════════════════════════════
VPC Flow Logs provide visibility into network traffic that traverses the VPC and can be used to detect anomalous traffic or insight during security workflows.


See https://avd.aquasec.com/misconfig/aws-autoscaling-enable-at-rest-encryption
────────────────────────────────────────
 aws/vpc/main.tf:12-26
   via aws/vpc/tests/no_default_nacl/main.tf:23-39 (module.test_vpc_no_default_nacl)
────────────────────────────────────────
  12 ┌ resource "aws_vpc" "this" {
  13 │   cidr_block                           = var.cidr_block
  14 │   enable_dns_support                   = var.enable_dns_support
  15 │   enable_dns_hostnames                 = var.enable_dns_hostnames
  16 │   assign_generated_ipv6_cidr_block     = var.enable_ipv6
  17 │   instance_tenancy                     = var.instance_tenancy
  18 │   enable_network_address_usage_metrics = var.enable_network_address_usage_metrics
  19 │ 
  20 └   tags = merge(
  ..   
────────────────────────────────────────


AVD-AWS-0178 (MEDIUM): VPC does not have VPC Flow Logs enabled.
════════════════════════════════════════
VPC Flow Logs provide visibility into network traffic that traverses the VPC and can be used to detect anomalous traffic or insight during security workflows.


See https://avd.aquasec.com/misconfig/aws-autoscaling-enable-at-rest-encryption
────────────────────────────────────────
 aws/vpc/main.tf:12-26
   via aws/internet-gateway/tests/basic/main.tf:23-28 (module.vpc)
────────────────────────────────────────
  12 ┌ resource "aws_vpc" "this" {
  13 │   cidr_block                           = var.cidr_block
  14 │   enable_dns_support                   = var.enable_dns_support
  15 │   enable_dns_hostnames                 = var.enable_dns_hostnames
  16 │   assign_generated_ipv6_cidr_block     = var.enable_ipv6
  17 │   instance_tenancy                     = var.instance_tenancy
  18 │   enable_network_address_usage_metrics = var.enable_network_address_usage_metrics
  19 │ 
  20 └   tags = merge(
  ..   
────────────────────────────────────────


AVD-AWS-0178 (MEDIUM): VPC does not have VPC Flow Logs enabled.
════════════════════════════════════════
VPC Flow Logs provide visibility into network traffic that traverses the VPC and can be used to detect anomalous traffic or insight during security workflows.


See https://avd.aquasec.com/misconfig/aws-autoscaling-enable-at-rest-encryption
────────────────────────────────────────
 aws/vpc/main.tf:12-26
   via aws/nat-gateway/tests/basic/main.tf:23-28 (module.vpc)
────────────────────────────────────────
  12 ┌ resource "aws_vpc" "this" {
  13 │   cidr_block                           = var.cidr_block
  14 │   enable_dns_support                   = var.enable_dns_support
  15 │   enable_dns_hostnames                 = var.enable_dns_hostnames
  16 │   assign_generated_ipv6_cidr_block     = var.enable_ipv6
  17 │   instance_tenancy                     = var.instance_tenancy
  18 │   enable_network_address_usage_metrics = var.enable_network_address_usage_metrics
  19 │ 
  20 └   tags = merge(
  ..   
────────────────────────────────────────


AVD-AWS-0178 (MEDIUM): VPC does not have VPC Flow Logs enabled.
════════════════════════════════════════
VPC Flow Logs provide visibility into network traffic that traverses the VPC and can be used to detect anomalous traffic or insight during security workflows.


See https://avd.aquasec.com/misconfig/aws-autoscaling-enable-at-rest-encryption
────────────────────────────────────────
 aws/vpc/main.tf:12-26
   via aws/route-table/tests/basic/main.tf:23-28 (module.vpc)
────────────────────────────────────────
  12 ┌ resource "aws_vpc" "this" {
  13 │   cidr_block                           = var.cidr_block
  14 │   enable_dns_support                   = var.enable_dns_support
  15 │   enable_dns_hostnames                 = var.enable_dns_hostnames
  16 │   assign_generated_ipv6_cidr_block     = var.enable_ipv6
  17 │   instance_tenancy                     = var.instance_tenancy
  18 │   enable_network_address_usage_metrics = var.enable_network_address_usage_metrics
  19 │ 
  20 └   tags = merge(
  ..   
────────────────────────────────────────


AVD-AWS-0178 (MEDIUM): VPC does not have VPC Flow Logs enabled.
════════════════════════════════════════
VPC Flow Logs provide visibility into network traffic that traverses the VPC and can be used to detect anomalous traffic or insight during security workflows.


See https://avd.aquasec.com/misconfig/aws-autoscaling-enable-at-rest-encryption
────────────────────────────────────────
 aws/vpc/main.tf:12-26
   via aws/security-group/tests/basic/main.tf:23-28 (module.vpc)
────────────────────────────────────────
  12 ┌ resource "aws_vpc" "this" {
  13 │   cidr_block                           = var.cidr_block
  14 │   enable_dns_support                   = var.enable_dns_support
  15 │   enable_dns_hostnames                 = var.enable_dns_hostnames
  16 │   assign_generated_ipv6_cidr_block     = var.enable_ipv6
  17 │   instance_tenancy                     = var.instance_tenancy
  18 │   enable_network_address_usage_metrics = var.enable_network_address_usage_metrics
  19 │ 
  20 └   tags = merge(
  ..   
────────────────────────────────────────


AVD-AWS-0178 (MEDIUM): VPC does not have VPC Flow Logs enabled.
════════════════════════════════════════
VPC Flow Logs provide visibility into network traffic that traverses the VPC and can be used to detect anomalous traffic or insight during security workflows.


See https://avd.aquasec.com/misconfig/aws-autoscaling-enable-at-rest-encryption
────────────────────────────────────────
 aws/vpc/main.tf:12-26
   via aws/subnet/tests/basic/main.tf:23-28 (module.vpc)
────────────────────────────────────────
  12 ┌ resource "aws_vpc" "this" {
  13 │   cidr_block                           = var.cidr_block
  14 │   enable_dns_support                   = var.enable_dns_support
  15 │   enable_dns_hostnames                 = var.enable_dns_hostnames
  16 │   assign_generated_ipv6_cidr_block     = var.enable_ipv6
  17 │   instance_tenancy                     = var.instance_tenancy
  18 │   enable_network_address_usage_metrics = var.enable_network_address_usage_metrics
  19 │ 
  20 └   tags = merge(
  ..   
────────────────────────────────────────

👤 Pusher: @llama90 | 🔄 Action: pull_request | ⚙️ Workflow: Terraform Check

Update basic test to use new variables:
- Set source_provider = "GitHub" (V1)
- Enable build stage explicitly
- Disable deploy stage for basic test

Fixes validation errors in basic test.
@github-actions
Copy link
Contributor

🔍 Terraform Check Results

📊 Summary

All checks passed!

Check Status Issues Scope
🖌 Format ✅ success - All modules
🤖 Validate ✅ success - All modules
🔍 TFLint ✅ success 0 issue(s) terraform
🔒 Trivy ✅ success 0 critical, 0 high, 29 medium terraform

🔍 TFLint Details (0 issue(s))
Running TFLint on changed modules:
terraform

=== Checking terraform ===
🔒 Trivy Security Details (29 issue(s))
Running Trivy on changed modules:
terraform

=== Scanning terraform ===

Report Summary

┌───────────────────────────────────────────────────────┬───────────┬───────────────────┐
│                        Target                         │   Type    │ Misconfigurations │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ _template/tests/basic                                 │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/alb-target-group/tests/basic                      │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/alb-target-group/tests/with_listener_rule         │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/alb/main.tf                                       │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/alb/tests/basic                                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/alb/tests/host_based                              │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/alb/tests/https                                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/alb/tests/multi_target                            │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/alb/tests/path_based                              │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/amazonmq-rabbitmq/tests/basic                     │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/amazonmq/main.tf                                  │ terraform │         3         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/amazonmq/tests/basic                              │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ami/tests/basic                                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/api-gateway/main.tf                               │ terraform │         6         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/api-gateway/tests/basic                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/autoscaling/tests/basic                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/autoscaling/tests/with-instance-profile           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/autoscaling/tests/with-step-scaling               │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/autoscaling/tests/with-warm-pool                  │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/aws-lb-controller-role/tests/basic                │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/bedrock/main.tf                                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/bedrock/tests/advanced                            │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/bedrock/tests/basic                               │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/cloudfront/main.tf                                │ terraform │         5         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/cloudfront/tests/alb_origin                       │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/cloudfront/tests/basic                            │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/cloudfront/tests/lambda_edge                      │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/cloudfront/tests/multi_origin                     │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/cloudfront/tests/s3_oac                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/cloudtrail/tests/basic                            │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/cloudwatch-alarm/tests/basic                      │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/cloudwatch-dashboard/tests/basic                  │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/cloudwatch-dashboard/tests/custom-metrics         │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/cloudwatch-dashboard/tests/pipeline               │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/codebuild/main.tf                                 │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/codebuild/tests/basic                             │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/codebuild/tests/custom_compute                    │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/codebuild/tests/with_pipeline                     │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/codedeploy/tests/basic                            │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/codedeploy/tests/ec2                              │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/codedeploy/tests/ecs                              │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/codedeploy/tests/lambda                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/codepipeline/main.tf                              │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/codepipeline/tests/basic                          │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/dynamodb/tests/advanced                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/dynamodb/tests/basic                              │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ec2/tests/basic                                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ec2/tests/spot_instance                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ec2/tests/user_data                               │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ec2/tests/with_ebs                                │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ec2/tests/with_eip                                │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ecr/main.tf                                       │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ecr/tests/basic                                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ecs-cluster/main.tf                               │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ecs-cluster/tests/basic                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ecs-cluster/tests/with_capacity_providers         │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ecs-execution-role/tests/basic                    │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ecs-execution-role/tests/with_additional_policies │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ecs-service/main.tf                               │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ecs-service/tests/basic                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ecs-service/tests/with_autoscaling                │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ecs-task-role/tests/basic                         │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/ecs-task-role/tests/with_policies                 │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/eks-app-deployment/tests/basic                    │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/eks-lb-controller/tests/basic                     │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/eks-node-role/tests/basic                         │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/eks/main.tf                                       │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/eks/tests/basic                                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/elasticache/tests/advanced                        │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/elasticache/tests/basic                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/eventbridge/tests/basic                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/eventbridge/tests/basic/main.tf                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/eventbridge/tests/cross_account                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/eventbridge/tests/cross_account/main.tf           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/eventbridge/tests/pattern                         │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/eventbridge/tests/scheduled                       │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/eventbridge/tests/scheduled/main.tf               │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-group-policy-attachment/tests/basic           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-group-policy/main.tf                          │ terraform │         2         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-group-policy/tests/advanced                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-group-policy/tests/basic                      │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-group/main.tf                                 │ terraform │         2         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-group/tests/advanced                          │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-group/tests/basic                             │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-policy/tests/basic                            │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-policy/tests/with_policy_document             │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-user-group-membership/tests/basic             │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-user-group-membership/tests/multiple-groups   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-user/main.tf                                  │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-user/tests/advanced                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/iam-user/tests/basic                              │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/instance-profile/tests/advanced                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/instance-profile/tests/basic                      │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/internet-gateway/tests/basic                      │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/key-pair/tests/basic                              │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/lambda/main.tf                                    │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/lambda/tests/basic                                │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/lambda/tests/event-source-mapping                 │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/lambda/tests/go                                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/lambda/tests/python                               │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/lambda/tests/typescript                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/launch-template/tests/advanced                    │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/launch-template/tests/basic                       │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/managed-prefix-list/tests/basic                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/nat-gateway/tests/basic                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/parameter-store/tests/basic                       │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/rds-option-group/tests/basic                      │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/rds-parameter-group/tests/advanced                │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/rds-parameter-group/tests/basic                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/rds/main.tf                                       │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/rds/tests/advanced                                │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/rds/tests/basic                                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/route-table/tests/basic                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/s3/main.tf                                        │ terraform │         1         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/s3/tests/basic                                    │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/scp/tests/basic                                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/secrets-manager/tests/basic                       │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/security-group/main.tf                            │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/security-group/tests/basic                        │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/security-groups/tests/basic                       │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/sns/tests/basic                                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/sqs/tests/basic                                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/stack/audit-logging/tests/basic                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/stack/networking/tests/basic                      │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/stack/networking/tests/no-nat                     │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/stack/networking/tests/single-nat                 │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/subnet/main.tf                                    │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/subnet/tests/basic                                │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/vpc/main.tf                                       │ terraform │        10         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/vpc/tests/basic                                   │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ aws/vpc/tests/no_default_nacl                         │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ gcp/cloud-functions/main.tf                           │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ gcp/cloud-functions/tests/basic                       │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ gcp/gcs/main.tf                                       │ terraform │         0         │
├───────────────────────────────────────────────────────┼───────────┼───────────────────┤
│ gcp/gcs/tests/basic                                   │ terraform │         0         │
└───────────────────────────────────────────────────────┴───────────┴───────────────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


aws/amazonmq/main.tf (terraform)
================================
Tests: 3 (SUCCESSES: 0, FAILURES: 3)
Failures: 3 (MEDIUM: 3, HIGH: 0, CRITICAL: 0)

AVD-AWS-0070 (MEDIUM): Broker does not have audit logging enabled.
════════════════════════════════════════
Logging should be enabled to allow tracing of issues and activity to be investigated more fully. Logs provide additional information and context which is often invalauble during investigation


See https://avd.aquasec.com/misconfig/avd-aws-0070
────────────────────────────────────────
 aws/amazonmq/main.tf:118
   via aws/amazonmq/main.tf:116-119 (logs)
    via aws/amazonmq/main.tf:14-143 (aws_mq_broker.this)
     via aws/amazonmq/tests/basic/main.tf:177-203 (module.test_activemq_minimal)
────────────────────────────────────────
  14   resource "aws_mq_broker" "this" {
  ..   
 118 [     audit   = var.enable_audit_log
 ...   
 143   }
────────────────────────────────────────


AVD-AWS-0070 (MEDIUM): Broker does not have audit logging enabled.
════════════════════════════════════════
Logging should be enabled to allow tracing of issues and activity to be investigated more fully. Logs provide additional information and context which is often invalauble during investigation


See https://avd.aquasec.com/misconfig/avd-aws-0070
────────────────────────────────────────
 aws/amazonmq/main.tf:118
   via aws/amazonmq/main.tf:116-119 (logs)
    via aws/amazonmq/main.tf:14-143 (aws_mq_broker.this)
     via aws/amazonmq/tests/basic/main.tf:144-174 (module.test_activemq_with_external_config)
────────────────────────────────────────
  14   resource "aws_mq_broker" "this" {
  ..   
 118 [     audit   = var.enable_audit_log
 ...   
 143   }
────────────────────────────────────────


AVD-AWS-0070 (MEDIUM): Broker does not have audit logging enabled.
════════════════════════════════════════
Logging should be enabled to allow tracing of issues and activity to be investigated more fully. Logs provide additional information and context which is often invalauble during investigation


See https://avd.aquasec.com/misconfig/avd-aws-0070
────────────────────────────────────────
 aws/amazonmq/main.tf:118
   via aws/amazonmq/main.tf:116-119 (logs)
    via aws/amazonmq/main.tf:14-143 (aws_mq_broker.this)
     via aws/amazonmq/tests/basic/main.tf:60-96 (module.test_rabbitmq_cluster)
────────────────────────────────────────
  14   resource "aws_mq_broker" "this" {
  ..   
 118 [     audit   = var.enable_audit_log
 ...   
 143   }
────────────────────────────────────────



aws/api-gateway/main.tf (terraform)
===================================
Tests: 6 (SUCCESSES: 0, FAILURES: 6)
Failures: 6 (MEDIUM: 6, HIGH: 0, CRITICAL: 0)

AVD-AWS-0001 (MEDIUM): Access logging is not configured.
════════════════════════════════════════
API Gateway stages should have access log settings block configured to track all access to a particular stage. This should be applied to both v1 and v2 gateway stages.


See https://avd.aquasec.com/misconfig/avd-aws-0001
────────────────────────────────────────
 aws/api-gateway/main.tf:315-346
   via aws/api-gateway/tests/basic/main.tf:29-57 (module.basic_api)
────────────────────────────────────────
 315 ┌ resource "aws_api_gateway_stage" "this" {
 316 │   rest_api_id   = aws_api_gateway_rest_api.this.id
 317 │   deployment_id = aws_api_gateway_deployment.this.id
 318 │   stage_name    = var.stage_name
 319 │   description   = var.stage_description
 320 │ 
 321 │   xray_tracing_enabled  = var.xray_tracing_enabled
 322 │   cache_cluster_enabled = var.cache_cluster_enabled
 323 └   cache_cluster_size    = var.cache_cluster_size
 ...   
────────────────────────────────────────


AVD-AWS-0001 (MEDIUM): Access logging is not configured.
════════════════════════════════════════
API Gateway stages should have access log settings block configured to track all access to a particular stage. This should be applied to both v1 and v2 gateway stages.


See https://avd.aquasec.com/misconfig/avd-aws-0001
────────────────────────────────────────
 aws/api-gateway/main.tf:315-346
   via aws/api-gateway/tests/basic/main.tf:350-381 (module.cached_api)
────────────────────────────────────────
 315 ┌ resource "aws_api_gateway_stage" "this" {
 316 │   rest_api_id   = aws_api_gateway_rest_api.this.id
 317 │   deployment_id = aws_api_gateway_deployment.this.id
 318 │   stage_name    = var.stage_name
 319 │   description   = var.stage_description
 320 │ 
 321 │   xray_tracing_enabled  = var.xray_tracing_enabled
 322 │   cache_cluster_enabled = var.cache_cluster_enabled
 323 └   cache_cluster_size    = var.cache_cluster_size
 ...   
────────────────────────────────────────


AVD-AWS-0001 (MEDIUM): Access logging is not configured.
════════════════════════════════════════
API Gateway stages should have access log settings block configured to track all access to a particular stage. This should be applied to both v1 and v2 gateway stages.


See https://avd.aquasec.com/misconfig/avd-aws-0001
────────────────────────────────────────
 aws/api-gateway/main.tf:315-346
   via aws/api-gateway/tests/basic/main.tf:388-457 (module.custom_responses_api)
────────────────────────────────────────
 315 ┌ resource "aws_api_gateway_stage" "this" {
 316 │   rest_api_id   = aws_api_gateway_rest_api.this.id
 317 │   deployment_id = aws_api_gateway_deployment.this.id
 318 │   stage_name    = var.stage_name
 319 │   description   = var.stage_description
 320 │ 
 321 │   xray_tracing_enabled  = var.xray_tracing_enabled
 322 │   cache_cluster_enabled = var.cache_cluster_enabled
 323 └   cache_cluster_size    = var.cache_cluster_size
 ...   
────────────────────────────────────────


AVD-AWS-0001 (MEDIUM): Access logging is not configured.
════════════════════════════════════════
API Gateway stages should have access log settings block configured to track all access to a particular stage. This should be applied to both v1 and v2 gateway stages.


See https://avd.aquasec.com/misconfig/avd-aws-0001
────────────────────────────────────────
 aws/api-gateway/main.tf:315-346
   via aws/api-gateway/tests/basic/main.tf:64-104 (module.lambda_api)
────────────────────────────────────────
 315 ┌ resource "aws_api_gateway_stage" "this" {
 316 │   rest_api_id   = aws_api_gateway_rest_api.this.id
 317 │   deployment_id = aws_api_gateway_deployment.this.id
 318 │   stage_name    = var.stage_name
 319 │   description   = var.stage_description
 320 │ 
 321 │   xray_tracing_enabled  = var.xray_tracing_enabled
 322 │   cache_cluster_enabled = var.cache_cluster_enabled
 323 └   cache_cluster_size    = var.cache_cluster_size
 ...   
────────────────────────────────────────


AVD-AWS-0001 (MEDIUM): Access logging is not configured.
════════════════════════════════════════
API Gateway stages should have access log settings block configured to track all access to a particular stage. This should be applied to both v1 and v2 gateway stages.


See https://avd.aquasec.com/misconfig/avd-aws-0001
────────────────────────────────────────
 aws/api-gateway/main.tf:315-346
   via aws/api-gateway/tests/basic/main.tf:174-259 (module.secured_api)
────────────────────────────────────────
 315 ┌ resource "aws_api_gateway_stage" "this" {
 316 │   rest_api_id   = aws_api_gateway_rest_api.this.id
 317 │   deployment_id = aws_api_gateway_deployment.this.id
 318 │   stage_name    = var.stage_name
 319 │   description   = var.stage_description
 320 │ 
 321 │   xray_tracing_enabled  = var.xray_tracing_enabled
 322 │   cache_cluster_enabled = var.cache_cluster_enabled
 323 └   cache_cluster_size    = var.cache_cluster_size
 ...   
────────────────────────────────────────


AVD-AWS-0001 (MEDIUM): Access logging is not configured.
════════════════════════════════════════
API Gateway stages should have access log settings block configured to track all access to a particular stage. This should be applied to both v1 and v2 gateway stages.


See https://avd.aquasec.com/misconfig/avd-aws-0001
────────────────────────────────────────
 aws/api-gateway/main.tf:315-346
   via aws/api-gateway/tests/basic/main.tf:266-343 (module.validated_api)
────────────────────────────────────────
 315 ┌ resource "aws_api_gateway_stage" "this" {
 316 │   rest_api_id   = aws_api_gateway_rest_api.this.id
 317 │   deployment_id = aws_api_gateway_deployment.this.id
 318 │   stage_name    = var.stage_name
 319 │   description   = var.stage_description
 320 │ 
 321 │   xray_tracing_enabled  = var.xray_tracing_enabled
 322 │   cache_cluster_enabled = var.cache_cluster_enabled
 323 └   cache_cluster_size    = var.cache_cluster_size
 ...   
────────────────────────────────────────



aws/cloudfront/main.tf (terraform)
==================================
Tests: 5 (SUCCESSES: 0, FAILURES: 5)
Failures: 5 (MEDIUM: 5, HIGH: 0, CRITICAL: 0)

AVD-AWS-0010 (MEDIUM): Distribution does not have logging enabled
════════════════════════════════════════
You should configure CloudFront Access Logging to create log files that contain detailed information about every user request that CloudFront receives


See https://avd.aquasec.com/misconfig/avd-aws-0010
────────────────────────────────────────
 aws/cloudfront/main.tf:56-312
   via aws/cloudfront/tests/alb_origin/main.tf:27-141 (module.test_alb_origin)
────────────────────────────────────────
  56 ┌ resource "aws_cloudfront_distribution" "this" {
  57 │   enabled             = var.enabled
  58 │   is_ipv6_enabled     = var.is_ipv6_enabled
  59 │   comment             = var.distribution_name
  60 │   default_root_object = var.default_root_object
  61 │   price_class         = var.price_class
  62 │   http_version        = var.http_version
  63 │   web_acl_id          = var.web_acl_id
  64 └   retain_on_delete    = var.retain_on_delete
  ..   
────────────────────────────────────────


AVD-AWS-0010 (MEDIUM): Distribution does not have logging enabled
════════════════════════════════════════
You should configure CloudFront Access Logging to create log files that contain detailed information about every user request that CloudFront receives


See https://avd.aquasec.com/misconfig/avd-aws-0010
────────────────────────────────────────
 aws/cloudfront/main.tf:56-312
   via aws/cloudfront/tests/basic/main.tf:26-82 (module.test_basic)
────────────────────────────────────────
  56 ┌ resource "aws_cloudfront_distribution" "this" {
  57 │   enabled             = var.enabled
  58 │   is_ipv6_enabled     = var.is_ipv6_enabled
  59 │   comment             = var.distribution_name
  60 │   default_root_object = var.default_root_object
  61 │   price_class         = var.price_class
  62 │   http_version        = var.http_version
  63 │   web_acl_id          = var.web_acl_id
  64 └   retain_on_delete    = var.retain_on_delete
  ..   
────────────────────────────────────────


AVD-AWS-0010 (MEDIUM): Distribution does not have logging enabled
════════════════════════════════════════
You should configure CloudFront Access Logging to create log files that contain detailed information about every user request that CloudFront receives


See https://avd.aquasec.com/misconfig/avd-aws-0010
────────────────────────────────────────
 aws/cloudfront/main.tf:56-312
   via aws/cloudfront/tests/lambda_edge/main.tf:30-155 (module.test_lambda_edge)
────────────────────────────────────────
  56 ┌ resource "aws_cloudfront_distribution" "this" {
  57 │   enabled             = var.enabled
  58 │   is_ipv6_enabled     = var.is_ipv6_enabled
  59 │   comment             = var.distribution_name
  60 │   default_root_object = var.default_root_object
  61 │   price_class         = var.price_class
  62 │   http_version        = var.http_version
  63 │   web_acl_id          = var.web_acl_id
  64 └   retain_on_delete    = var.retain_on_delete
  ..   
────────────────────────────────────────


AVD-AWS-0010 (MEDIUM): Distribution does not have logging enabled
════════════════════════════════════════
You should configure CloudFront Access Logging to create log files that contain detailed information about every user request that CloudFront receives


See https://avd.aquasec.com/misconfig/avd-aws-0010
────────────────────────────────────────
 aws/cloudfront/main.tf:56-312
   via aws/cloudfront/tests/multi_origin/main.tf:27-215 (module.test_multi_origin)
────────────────────────────────────────
  56 ┌ resource "aws_cloudfront_distribution" "this" {
  57 │   enabled             = var.enabled
  58 │   is_ipv6_enabled     = var.is_ipv6_enabled
  59 │   comment             = var.distribution_name
  60 │   default_root_object = var.default_root_object
  61 │   price_class         = var.price_class
  62 │   http_version        = var.http_version
  63 │   web_acl_id          = var.web_acl_id
  64 └   retain_on_delete    = var.retain_on_delete
  ..   
────────────────────────────────────────


AVD-AWS-0010 (MEDIUM): Distribution does not have logging enabled
════════════════════════════════════════
You should configure CloudFront Access Logging to create log files that contain detailed information about every user request that CloudFront receives


See https://avd.aquasec.com/misconfig/avd-aws-0010
────────────────────────────────────────
 aws/cloudfront/main.tf:56-312
   via aws/cloudfront/tests/s3_oac/main.tf:27-113 (module.test_s3_oac)
────────────────────────────────────────
  56 ┌ resource "aws_cloudfront_distribution" "this" {
  57 │   enabled             = var.enabled
  58 │   is_ipv6_enabled     = var.is_ipv6_enabled
  59 │   comment             = var.distribution_name
  60 │   default_root_object = var.default_root_object
  61 │   price_class         = var.price_class
  62 │   http_version        = var.http_version
  63 │   web_acl_id          = var.web_acl_id
  64 └   retain_on_delete    = var.retain_on_delete
  ..   
────────────────────────────────────────



aws/iam-group-policy/main.tf (terraform)
========================================
Tests: 2 (SUCCESSES: 0, FAILURES: 2)
Failures: 2 (MEDIUM: 2, HIGH: 0, CRITICAL: 0)

AVD-AWS-0123 (MEDIUM): Multi-Factor authentication is not enforced for group
════════════════════════════════════════
IAM groups should be protected with multi factor authentication to add safe guards to password compromise.


See https://avd.aquasec.com/misconfig/aws-iam-enforce-mfa
────────────────────────────────────────
 aws/iam-group-policy/main.tf:176-186
   via aws/iam-group-policy/tests/advanced/main.tf:23-71 (module.iam_group_policy)
────────────────────────────────────────
 176 ┌ resource "aws_iam_group" "this" {
 177 │   name = var.name
 178 │   path = var.path
 179 │ 
 180 │   lifecycle {
 181 │     precondition {
 182 │       condition     = length(local.all_inline_policies) <= 10
 183 │       error_message = "IAM groups support at most 10 inline policies. Reduce built-in policy toggles or custom_policy_statements."
 184 └     }
 ...   
────────────────────────────────────────


AVD-AWS-0123 (MEDIUM): Multi-Factor authentication is not enforced for group
════════════════════════════════════════
IAM groups should be protected with multi factor authentication to add safe guards to password compromise.


See https://avd.aquasec.com/misconfig/aws-iam-enforce-mfa
────────────────────────────────────────
 aws/iam-group-policy/main.tf:176-186
   via aws/iam-group-policy/tests/basic/main.tf:23-32 (module.iam_group_policy)
────────────────────────────────────────
 176 ┌ resource "aws_iam_group" "this" {
 177 │   name = var.name
 178 │   path = var.path
 179 │ 
 180 │   lifecycle {
 181 │     precondition {
 182 │       condition     = length(local.all_inline_policies) <= 10
 183 │       error_message = "IAM groups support at most 10 inline policies. Reduce built-in policy toggles or custom_policy_statements."
 184 └     }
 ...   
────────────────────────────────────────



aws/iam-group/main.tf (terraform)
=================================
Tests: 2 (SUCCESSES: 0, FAILURES: 2)
Failures: 2 (MEDIUM: 2, HIGH: 0, CRITICAL: 0)

AVD-AWS-0123 (MEDIUM): Multi-Factor authentication is not enforced for group
════════════════════════════════════════
IAM groups should be protected with multi factor authentication to add safe guards to password compromise.


See https://avd.aquasec.com/misconfig/aws-iam-enforce-mfa
────────────────────────────────────────
 aws/iam-group/main.tf:16-19
   via aws/iam-group/tests/advanced/main.tf:40-85 (module.iam_group)
────────────────────────────────────────
  16 ┌ resource "aws_iam_group" "this" {
  17 │   name = var.name
  18 │   path = var.path
  19 └ }
────────────────────────────────────────


AVD-AWS-0123 (MEDIUM): Multi-Factor authentication is not enforced for group
════════════════════════════════════════
IAM groups should be protected with multi factor authentication to add safe guards to password compromise.


See https://avd.aquasec.com/misconfig/aws-iam-enforce-mfa
────────────────────────────────────────
 aws/iam-group/main.tf:16-19
   via aws/iam-group/tests/basic/main.tf:26-34 (module.iam_group)
────────────────────────────────────────
  16 ┌ resource "aws_iam_group" "this" {
  17 │   name = var.name
  18 │   path = var.path
  19 └ }
────────────────────────────────────────



aws/s3/main.tf (terraform)
==========================
Tests: 1 (SUCCESSES: 0, FAILURES: 1)
Failures: 1 (MEDIUM: 1, HIGH: 0, CRITICAL: 0)

AVD-AWS-0090 (MEDIUM): Bucket does not have versioning enabled
════════════════════════════════════════
Versioning in Amazon S3 is a means of keeping multiple variants of an object in the same bucket.

You can use the S3 Versioning feature to preserve, retrieve, and restore every version of every object stored in your buckets.

With versioning you can recover more easily from both unintended user actions and application failures.

When you enable versioning, also keep in mind the potential costs of storing noncurrent versions of objects. To help manage those costs, consider setting up an S3 Lifecycle configuration.


See https://avd.aquasec.com/misconfig/avd-aws-0090
────────────────────────────────────────
 aws/s3/main.tf:33
   via aws/s3/main.tf:32-34 (versioning_configuration)
    via aws/s3/main.tf:29-35 (aws_s3_bucket_versioning.this)
     via aws/s3/tests/basic/main.tf:121-132 (module.no_versioning_bucket)
────────────────────────────────────────
  29   resource "aws_s3_bucket_versioning" "this" {
  30     bucket = aws_s3_bucket.this.id
  31   
  32     versioning_configuration {
  33 [     status = var.versioning_enabled ? "Enabled" : "Suspended"
  34     }
  35   }
────────────────────────────────────────



aws/vpc/main.tf (terraform)
===========================
Tests: 10 (SUCCESSES: 0, FAILURES: 10)
Failures: 10 (MEDIUM: 10, HIGH: 0, CRITICAL: 0)

AVD-AWS-0178 (MEDIUM): VPC does not have VPC Flow Logs enabled.
════════════════════════════════════════
VPC Flow Logs provide visibility into network traffic that traverses the VPC and can be used to detect anomalous traffic or insight during security workflows.


See https://avd.aquasec.com/misconfig/aws-autoscaling-enable-at-rest-encryption
────────────────────────────────────────
 aws/vpc/main.tf:12-26
   via aws/stack/networking/main.tf:47-61 (module.vpc)
    via aws/stack/networking/tests/basic/main.tf:23-34 (module.networking)
────────────────────────────────────────
  12 ┌ resource "aws_vpc" "this" {
  13 │   cidr_block                           = var.cidr_block
  14 │   enable_dns_support                   = var.enable_dns_support
  15 │   enable_dns_hostnames                 = var.enable_dns_hostnames
  16 │   assign_generated_ipv6_cidr_block     = var.enable_ipv6
  17 │   instance_tenancy                     = var.instance_tenancy
  18 │   enable_network_address_usage_metrics = var.enable_network_address_usage_metrics
  19 │ 
  20 └   tags = merge(
  ..   
────────────────────────────────────────


AVD-AWS-0178 (MEDIUM): VPC does not have VPC Flow Logs enabled.
════════════════════════════════════════
VPC Flow Logs provide visibility into network traffic that traverses the VPC and can be used to detect anomalous traffic or insight during security workflows.


See https://avd.aquasec.com/misconfig/aws-autoscaling-enable-at-rest-encryption
────────────────────────────────────────
 aws/vpc/main.tf:12-26
   via aws/stack/networking/main.tf:47-61 (module.vpc)
    via aws/stack/networking/tests/no-nat/main.tf:23-37 (module.networking)
────────────────────────────────────────
  12 ┌ resource "aws_vpc" "this" {
  13 │   cidr_block                           = var.cidr_block
  14 │   enable_dns_support                   = var.enable_dns_support
  15 │   enable_dns_hostnames                 = var.enable_dns_hostnames
  16 │   assign_generated_ipv6_cidr_block     = var.enable_ipv6
  17 │   instance_tenancy                     = var.instance_tenancy
  18 │   enable_network_address_usage_metrics = var.enable_network_address_usage_metrics
  19 │ 
  20 └   tags = merge(
  ..   
────────────────────────────────────────


AVD-AWS-0178 (MEDIUM): VPC does not have VPC Flow Logs enabled.
════════════════════════════════════════
VPC Flow Logs provide visibility into network traffic that traverses the VPC and can be used to detect anomalous traffic or insight during security workflows.


See https://avd.aquasec.com/misconfig/aws-autoscaling-enable-at-rest-encryption
────────────────────────────────────────
 aws/vpc/main.tf:12-26
   via aws/stack/networking/main.tf:47-61 (module.vpc)
    via aws/stack/networking/tests/single-nat/main.tf:23-34 (module.networking)
────────────────────────────────────────
  12 ┌ resource "aws_vpc" "this" {
  13 │   cidr_block                           = var.cidr_block
  14 │   enable_dns_support                   = var.enable_dns_support
  15 │   enable_dns_hostnames                 = var.enable_dns_hostnames
  16 │   assign_generated_ipv6_cidr_block     = var.enable_ipv6
  17 │   instance_tenancy                     = var.instance_tenancy
  18 │   enable_network_address_usage_metrics = var.enable_network_address_usage_metrics
  19 │ 
  20 └   tags = merge(
  ..   
────────────────────────────────────────


AVD-AWS-0178 (MEDIUM): VPC does not have VPC Flow Logs enabled.
════════════════════════════════════════
VPC Flow Logs provide visibility into network traffic that traverses the VPC and can be used to detect anomalous traffic or insight during security workflows.


See https://avd.aquasec.com/misconfig/aws-autoscaling-enable-at-rest-encryption
────────────────────────────────────────
 aws/vpc/main.tf:12-26
   via aws/vpc/tests/basic/main.tf:23-36 (module.test_vpc)
────────────────────────────────────────
  12 ┌ resource "aws_vpc" "this" {
  13 │   cidr_block                           = var.cidr_block
  14 │   enable_dns_support                   = var.enable_dns_support
  15 │   enable_dns_hostnames                 = var.enable_dns_hostnames
  16 │   assign_generated_ipv6_cidr_block     = var.enable_ipv6
  17 │   instance_tenancy                     = var.instance_tenancy
  18 │   enable_network_address_usage_metrics = var.enable_network_address_usage_metrics
  19 │ 
  20 └   tags = merge(
  ..   
────────────────────────────────────────


AVD-AWS-0178 (MEDIUM): VPC does not have VPC Flow Logs enabled.
════════════════════════════════════════
VPC Flow Logs provide visibility into network traffic that traverses the VPC and can be used to detect anomalous traffic or insight during security workflows.


See https://avd.aquasec.com/misconfig/aws-autoscaling-enable-at-rest-encryption
────────────────────────────────────────
 aws/vpc/main.tf:12-26
   via aws/vpc/tests/no_default_nacl/main.tf:23-39 (module.test_vpc_no_default_nacl)
────────────────────────────────────────
  12 ┌ resource "aws_vpc" "this" {
  13 │   cidr_block                           = var.cidr_block
  14 │   enable_dns_support                   = var.enable_dns_support
  15 │   enable_dns_hostnames                 = var.enable_dns_hostnames
  16 │   assign_generated_ipv6_cidr_block     = var.enable_ipv6
  17 │   instance_tenancy                     = var.instance_tenancy
  18 │   enable_network_address_usage_metrics = var.enable_network_address_usage_metrics
  19 │ 
  20 └   tags = merge(
  ..   
────────────────────────────────────────


AVD-AWS-0178 (MEDIUM): VPC does not have VPC Flow Logs enabled.
════════════════════════════════════════
VPC Flow Logs provide visibility into network traffic that traverses the VPC and can be used to detect anomalous traffic or insight during security workflows.


See https://avd.aquasec.com/misconfig/aws-autoscaling-enable-at-rest-encryption
────────────────────────────────────────
 aws/vpc/main.tf:12-26
   via aws/internet-gateway/tests/basic/main.tf:23-28 (module.vpc)
────────────────────────────────────────
  12 ┌ resource "aws_vpc" "this" {
  13 │   cidr_block                           = var.cidr_block
  14 │   enable_dns_support                   = var.enable_dns_support
  15 │   enable_dns_hostnames                 = var.enable_dns_hostnames
  16 │   assign_generated_ipv6_cidr_block     = var.enable_ipv6
  17 │   instance_tenancy                     = var.instance_tenancy
  18 │   enable_network_address_usage_metrics = var.enable_network_address_usage_metrics
  19 │ 
  20 └   tags = merge(
  ..   
────────────────────────────────────────


AVD-AWS-0178 (MEDIUM): VPC does not have VPC Flow Logs enabled.
════════════════════════════════════════
VPC Flow Logs provide visibility into network traffic that traverses the VPC and can be used to detect anomalous traffic or insight during security workflows.


See https://avd.aquasec.com/misconfig/aws-autoscaling-enable-at-rest-encryption
────────────────────────────────────────
 aws/vpc/main.tf:12-26
   via aws/nat-gateway/tests/basic/main.tf:23-28 (module.vpc)
────────────────────────────────────────
  12 ┌ resource "aws_vpc" "this" {
  13 │   cidr_block                           = var.cidr_block
  14 │   enable_dns_support                   = var.enable_dns_support
  15 │   enable_dns_hostnames                 = var.enable_dns_hostnames
  16 │   assign_generated_ipv6_cidr_block     = var.enable_ipv6
  17 │   instance_tenancy                     = var.instance_tenancy
  18 │   enable_network_address_usage_metrics = var.enable_network_address_usage_metrics
  19 │ 
  20 └   tags = merge(
  ..   
────────────────────────────────────────


AVD-AWS-0178 (MEDIUM): VPC does not have VPC Flow Logs enabled.
════════════════════════════════════════
VPC Flow Logs provide visibility into network traffic that traverses the VPC and can be used to detect anomalous traffic or insight during security workflows.


See https://avd.aquasec.com/misconfig/aws-autoscaling-enable-at-rest-encryption
────────────────────────────────────────
 aws/vpc/main.tf:12-26
   via aws/route-table/tests/basic/main.tf:23-28 (module.vpc)
────────────────────────────────────────
  12 ┌ resource "aws_vpc" "this" {
  13 │   cidr_block                           = var.cidr_block
  14 │   enable_dns_support                   = var.enable_dns_support
  15 │   enable_dns_hostnames                 = var.enable_dns_hostnames
  16 │   assign_generated_ipv6_cidr_block     = var.enable_ipv6
  17 │   instance_tenancy                     = var.instance_tenancy
  18 │   enable_network_address_usage_metrics = var.enable_network_address_usage_metrics
  19 │ 
  20 └   tags = merge(
  ..   
────────────────────────────────────────


AVD-AWS-0178 (MEDIUM): VPC does not have VPC Flow Logs enabled.
════════════════════════════════════════
VPC Flow Logs provide visibility into network traffic that traverses the VPC and can be used to detect anomalous traffic or insight during security workflows.


See https://avd.aquasec.com/misconfig/aws-autoscaling-enable-at-rest-encryption
────────────────────────────────────────
 aws/vpc/main.tf:12-26
   via aws/security-group/tests/basic/main.tf:23-28 (module.vpc)
────────────────────────────────────────
  12 ┌ resource "aws_vpc" "this" {
  13 │   cidr_block                           = var.cidr_block
  14 │   enable_dns_support                   = var.enable_dns_support
  15 │   enable_dns_hostnames                 = var.enable_dns_hostnames
  16 │   assign_generated_ipv6_cidr_block     = var.enable_ipv6
  17 │   instance_tenancy                     = var.instance_tenancy
  18 │   enable_network_address_usage_metrics = var.enable_network_address_usage_metrics
  19 │ 
  20 └   tags = merge(
  ..   
────────────────────────────────────────


AVD-AWS-0178 (MEDIUM): VPC does not have VPC Flow Logs enabled.
════════════════════════════════════════
VPC Flow Logs provide visibility into network traffic that traverses the VPC and can be used to detect anomalous traffic or insight during security workflows.


See https://avd.aquasec.com/misconfig/aws-autoscaling-enable-at-rest-encryption
────────────────────────────────────────
 aws/vpc/main.tf:12-26
   via aws/subnet/tests/basic/main.tf:23-28 (module.vpc)
────────────────────────────────────────
  12 ┌ resource "aws_vpc" "this" {
  13 │   cidr_block                           = var.cidr_block
  14 │   enable_dns_support                   = var.enable_dns_support
  15 │   enable_dns_hostnames                 = var.enable_dns_hostnames
  16 │   assign_generated_ipv6_cidr_block     = var.enable_ipv6
  17 │   instance_tenancy                     = var.instance_tenancy
  18 │   enable_network_address_usage_metrics = var.enable_network_address_usage_metrics
  19 │ 
  20 └   tags = merge(
  ..   
────────────────────────────────────────

👤 Pusher: @llama90 | 🔄 Action: pull_request | ⚙️ Workflow: Terraform Check

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant