Merge pull request #5 from DNXLabs/feature/checkov

Feature/checkov

.github/workflows/docs.yml

@@ -1,6 +1,9 @@
 name: Generate terraform docs
 
 on: [pull_request]
+
+permissions: read-all
+
 jobs:
   docs:
     runs-on: ubuntu-latest

.github/workflows/documentation.yml

@@ -5,6 +5,9 @@ on:
     branches:
       - master
 
+permissions: read-all
+
+
 jobs:
   docs:
     runs-on: ubuntu-latest

.github/workflows/lint.yml

@@ -2,6 +2,8 @@ name: Lint
 
 on: [push]
 
+permissions: read-all
+
 jobs:
   tflint:
     name: Lint

.github/workflows/scan.yml

@@ -0,0 +1,19 @@
+name: Scan
+
+on: [push]
+
+permissions: read-all
+
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v3
+      - name: Run Checkov action
+        id: checkov
+        uses: bridgecrewio/checkov-action@v12
+        with:
+          directory: .
+          framework: terraform
+          skip_check: CKV2_AWS_5

_variables.tf

@@ -20,4 +20,10 @@ variable "app_network_access_type" {
   type        = string
   default     = "PublicInternetOnly"
   description = "Specifies the VPC used for non-EFS traffic. The default value is PublicInternetOnly. Valid values are PublicInternetOnly and VpcOnly."
+}
+
+variable "kms_key_id" {
+  type        = string
+  default     = null
+  description = "The AWS KMS customer managed CMK used to encrypt the EFS volume attached to the domain."
 }

sagemaker_domain.tf

@@ -9,6 +9,7 @@ resource "aws_sagemaker_domain" "domain" {
   vpc_id                  = var.sagemaker_domain_vpc_id
   subnet_ids              = var.sagemaker_domain_subnet_ids
   app_network_access_type = var.app_network_access_type
+  kms_key_id              = var.kms_key_id
 
   default_user_settings {
     security_groups = [aws_security_group.sagemakerstudio.id]