Bump clouddrove/kms/aws from 1.3.0 to 1.3.1 in /_example/complete #41

dependabot · 2023-08-28T23:11:21Z

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

Bumps clouddrove/kms/aws from 1.3.0 to 1.3.1.

Release notes

Sourced from clouddrove/kms/aws's releases.

1.3.1

✨ New Features

b3d8b40 - add deepsource & added assignees,reviewer in dependabot (commit by @Tanveer143s)

49cc3e9 - added resource and variable (commit by @theprashantyadav)

59c8ad2 - added external key resource (commit by @theprashantyadav)

946056c - added external key resource (commit by @theprashantyadav)

c651142 - changes module description (commit by @theprashantyadav)

dd64c5c - added policy data description (commit by @theprashantyadav)

f7cffa3 - added policy data description (commit by @theprashantyadav)

9e6a893 - added description and update example.tf (commit by @theprashantyadav)

0d2a455 - added description and update example.tf (commit by @theprashantyadav)

f59fbc3 - added Replica-Key and Replica-External-Key(CMK) (commit by @h1manshu98)

bb380b0 - Added example for replica key. (commit by @13archit)

🐛 Bug Fixes

95144e7 - Update workflows and examples (commit by @13archit)

caa35b8 - Update tf-checks workflow (commit by @13archit)

0d23637 - Fixed tfsec and tflint workflow (commit by @13archit)

Changelog

Sourced from clouddrove/kms/aws's changelog.

[1.3.1] - 2023-08-25

✨ New Features

b3d8b40 - add deepsource & added assignees,reviewer in dependabot (commit by @Tanveer143s)

49cc3e9 - added resource and variable (commit by @theprashantyadav)

59c8ad2 - added external key resource (commit by @theprashantyadav)

946056c - added external key resource (commit by @theprashantyadav)

c651142 - changes module description (commit by @theprashantyadav)

dd64c5c - added policy data description (commit by @theprashantyadav)

f7cffa3 - added policy data description (commit by @theprashantyadav)

9e6a893 - added description and update example.tf (commit by @theprashantyadav)

0d2a455 - added description and update example.tf (commit by @theprashantyadav)

f59fbc3 - added Replica-Key and Replica-External-Key(CMK) (commit by @h1manshu98)

bb380b0 - Added example for replica key. (commit by @13archit)

🐛 Bug Fixes

95144e7 - Update workflows and examples (commit by @13archit)

caa35b8 - Update tf-checks workflow (commit by @13archit)

0d23637 - Fixed tfsec and tflint workflow (commit by @13archit)

Commits

3bb2189 update README.md
8ee2464 Merge pull request #29 from clouddrove/feat/identos-issue-239
bb380b0 feat: Added example for replica key.
0d23637 fix: Fixed tfsec and tflint workflow
caa35b8 fix: Update tf-checks workflow
95144e7 fix: Update workflows and examples
f59fbc3 feat: added Replica-Key and Replica-External-Key(CMK)
0b1ba7c update README.md
fd30b44 Merge pull request #28 from clouddrove/issue-451
ed524c9 bug: update readme.yaml
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [clouddrove/kms/aws](https://github.com/clouddrove/terraform-aws-kms) from 1.3.0 to 1.3.1. - [Release notes](https://github.com/clouddrove/terraform-aws-kms/releases) - [Changelog](https://github.com/clouddrove/terraform-aws-kms/blob/master/CHANGELOG.md) - [Commits](clouddrove/terraform-aws-kms@1.3.0...1.3.1) --- updated-dependencies: - dependency-name: clouddrove/kms/aws dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot · 2023-08-28T23:11:23Z

Dependabot tried to add @approvers as a reviewer to this PR, but received the following error from GitHub:

POST https://api.github.com/repos/clouddrove/terraform-aws-s3/pulls/41/requested_reviewers: 422 - Reviews may only be requested from collaborators. One or more of the users or teams you specified is not a collaborator of the clouddrove/terraform-aws-s3 repository. // See: https://docs.github.com/rest/pulls/review-requests#request-reviewers-for-a-pull-request

anmolnagpal · 2023-08-28T23:14:00Z

`Terraform Security Scan` Failed

Show Output

Result #1 HIGH Bucket does not have encryption enabled 
────────────────────────────────────────────────────────────────────────────────
  main.tf:18-32
────────────────────────────────────────────────────────────────────────────────
   18  ┌ resource "aws_s3_bucket" "s3_default" {
   19  │   count = var.create_bucket == true ? 1 : 0
   20  │ 
   21  │   bucket        = module.labels.id
   22  │   force_destroy = var.force_destroy
   23  │   tags          = module.labels.tags
   24  │ 
   25  │   dynamic "object_lock_configuration" {
   26  └     for_each = var.object_lock_configuration != null ? [1] : []
   ..  
────────────────────────────────────────────────────────────────────────────────
          ID aws-s3-enable-bucket-encryption
      Impact The bucket objects could be read if compromised
  Resolution Configure bucket encryption

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/s3/enable-bucket-encryption/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#enable-default-server-side-encryption
────────────────────────────────────────────────────────────────────────────────


Result #2 HIGH Bucket does not encrypt data with a customer managed key. 
────────────────────────────────────────────────────────────────────────────────
  main.tf:18-32
────────────────────────────────────────────────────────────────────────────────
   18  ┌ resource "aws_s3_bucket" "s3_default" {
   19  │   count = var.create_bucket == true ? 1 : 0
   20  │ 
   21  │   bucket        = module.labels.id
   22  │   force_destroy = var.force_destroy
   23  │   tags          = module.labels.tags
   24  │ 
   25  │   dynamic "object_lock_configuration" {
   26  └     for_each = var.object_lock_configuration != null ? [1] : []
   ..  
────────────────────────────────────────────────────────────────────────────────
          ID aws-s3-encryption-customer-key
      Impact Using AWS managed keys does not allow for fine grained control
  Resolution Enable encryption using customer managed keys

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/s3/encryption-customer-key/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#enable-default-server-side-encryption
────────────────────────────────────────────────────────────────────────────────


Result #3 HIGH Public access block does not block public ACLs 
────────────────────────────────────────────────────────────────────────────────
  main.tf:500
────────────────────────────────────────────────────────────────────────────────
  495    resource "aws_s3_bucket_public_access_block" "this" {
  496      count = var.create_bucket && var.attach_public_policy ? 1 : 0
  497    
  498      bucket = local.attach_policy ? aws_s3_bucket_policy.s3_default[0].id : aws_s3_bucket.s3_default[0].id
  499    
  500  [   block_public_acls       = var.block_public_acls (false)
  501      block_public_policy     = var.block_public_policy
  502      ignore_public_acls      = var.ignore_public_acls
  503      restrict_public_buckets = var.restrict_public_buckets
  504    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-s3-block-public-acls
      Impact PUT calls with public ACLs specified can make objects public
  Resolution Enable blocking any PUT calls with a public ACL specified

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/s3/block-public-acls/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block#block_public_acls
────────────────────────────────────────────────────────────────────────────────


Result #4 HIGH Public access block does not block public policies 
────────────────────────────────────────────────────────────────────────────────
  main.tf:501
────────────────────────────────────────────────────────────────────────────────
  495    resource "aws_s3_bucket_public_access_block" "this" {
  496      count = var.create_bucket && var.attach_public_policy ? 1 : 0
  497    
  498      bucket = local.attach_policy ? aws_s3_bucket_policy.s3_default[0].id : aws_s3_bucket.s3_default[0].id
  499    
  500      block_public_acls       = var.block_public_acls
  501  [   block_public_policy     = var.block_public_policy (false)
  502      ignore_public_acls      = var.ignore_public_acls
  503      restrict_public_buckets = var.restrict_public_buckets
  504    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-s3-block-public-policy
      Impact Users could put a policy that allows public access
  Resolution Prevent policies that allow public access being PUT

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/s3/block-public-policy/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block#block_public_policy
────────────────────────────────────────────────────────────────────────────────


Result #5 HIGH Public access block does not ignore public ACLs 
────────────────────────────────────────────────────────────────────────────────
  main.tf:502
────────────────────────────────────────────────────────────────────────────────
  495    resource "aws_s3_bucket_public_access_block" "this" {
  496      count = var.create_bucket && var.attach_public_policy ? 1 : 0
  497    
  498      bucket = local.attach_policy ? aws_s3_bucket_policy.s3_default[0].id : aws_s3_bucket.s3_default[0].id
  499    
  500      block_public_acls       = var.block_public_acls
  501      block_public_policy     = var.block_public_policy
  502  [   ignore_public_acls      = var.ignore_public_acls (false)
  503      restrict_public_buckets = var.restrict_public_buckets
  504    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-s3-ignore-public-acls
      Impact PUT calls with public ACLs specified can make objects public
  Resolution Enable ignoring the application of public ACLs in PUT calls

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/s3/ignore-public-acls/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block#ignore_public_acls
────────────────────────────────────────────────────────────────────────────────


Result #6 HIGH Public access block does not restrict public buckets 
────────────────────────────────────────────────────────────────────────────────
  main.tf:503
────────────────────────────────────────────────────────────────────────────────
  495    resource "aws_s3_bucket_public_access_block" "this" {
  496      count = var.create_bucket && var.attach_public_policy ? 1 : 0
  497    
  498      bucket = local.attach_policy ? aws_s3_bucket_policy.s3_default[0].id : aws_s3_bucket.s3_default[0].id
  499    
  500      block_public_acls       = var.block_public_acls
  501      block_public_policy     = var.block_public_policy
  502      ignore_public_acls      = var.ignore_public_acls
  503  [   restrict_public_buckets = var.restrict_public_buckets (false)
  504    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-s3-no-public-buckets
      Impact Public buckets can be accessed by anyone
  Resolution Limit the access to public buckets to only the owner or AWS Services (eg; CloudFront)

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/s3/no-public-buckets/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block#restrict_public_buckets¡
────────────────────────────────────────────────────────────────────────────────


Result #7 MEDIUM Bucket does not have logging enabled 
────────────────────────────────────────────────────────────────────────────────
  main.tf:18-32
────────────────────────────────────────────────────────────────────────────────
   18  ┌ resource "aws_s3_bucket" "s3_default" {
   19  │   count = var.create_bucket == true ? 1 : 0
   20  │ 
   21  │   bucket        = module.labels.id
   22  │   force_destroy = var.force_destroy
   23  │   tags          = module.labels.tags
   24  │ 
   25  │   dynamic "object_lock_configuration" {
   26  └     for_each = var.object_lock_configuration != null ? [1] : []
   ..  
────────────────────────────────────────────────────────────────────────────────
          ID aws-s3-enable-bucket-logging
      Impact There is no way to determine the access to this bucket
  Resolution Add a logging block to the resource to enable access logging

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/s3/enable-bucket-logging/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket
────────────────────────────────────────────────────────────────────────────────


Result #8 MEDIUM Bucket does not have versioning enabled 
────────────────────────────────────────────────────────────────────────────────
  main.tf:18-32
────────────────────────────────────────────────────────────────────────────────
   18  ┌ resource "aws_s3_bucket" "s3_default" {
   19  │   count = var.create_bucket == true ? 1 : 0
   20  │ 
   21  │   bucket        = module.labels.id
   22  │   force_destroy = var.force_destroy
   23  │   tags          = module.labels.tags
   24  │ 
   25  │   dynamic "object_lock_configuration" {
   26  └     for_each = var.object_lock_configuration != null ? [1] : []
   ..  
────────────────────────────────────────────────────────────────────────────────
          ID aws-s3-enable-versioning
      Impact Deleted or modified data would not be recoverable
  Resolution Enable versioning to protect against accidental/malicious removal or modification

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/s3/enable-versioning/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#versioning
────────────────────────────────────────────────────────────────────────────────


  timings
  ──────────────────────────────────────────
  disk i/o             162.4µs
  parsing              77.881952ms
  adaptation           224.101µs
  checks               13.523862ms
  total                91.792315ms

  counts
  ──────────────────────────────────────────
  modules downloaded   0
  modules processed    1
  blocks processed     84
  files read           4

  results
  ──────────────────────────────────────────
  passed               4
  ignored              0
  critical             0
  high                 6
  medium               2
  low                  0

  4 passed, 8 potential problem(s) detected.

dependabot bot requested review from anmolnagpal and clouddrove-ci as code owners August 28, 2023 23:11

dependabot bot added the dependencies Pull requests that update a dependency file label Aug 28, 2023

dependabot bot assigned clouddrove-ci Aug 28, 2023

anmolnagpal approved these changes Aug 28, 2023

View reviewed changes

anmolnagpal merged commit b65024f into master Aug 28, 2023
36 checks passed

dependabot bot deleted the dependabot/terraform/_example/complete/clouddrove/kms/aws-1.3.1 branch August 28, 2023 23:42

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump clouddrove/kms/aws from 1.3.0 to 1.3.1 in /_example/complete #41

Bump clouddrove/kms/aws from 1.3.0 to 1.3.1 in /_example/complete #41

dependabot bot commented on behalf of github Aug 28, 2023 •

edited

Loading

dependabot bot commented on behalf of github Aug 28, 2023

anmolnagpal commented Aug 28, 2023

Bump clouddrove/kms/aws from 1.3.0 to 1.3.1 in /_example/complete #41

Bump clouddrove/kms/aws from 1.3.0 to 1.3.1 in /_example/complete #41

Conversation

dependabot bot commented on behalf of github Aug 28, 2023 • edited Loading

1.3.1

✨ New Features

🐛 Bug Fixes

[1.3.1] - 2023-08-25

✨ New Features

🐛 Bug Fixes

dependabot bot commented on behalf of github Aug 28, 2023

anmolnagpal commented Aug 28, 2023

Terraform Security Scan Failed

dependabot bot commented on behalf of github Aug 28, 2023 •

edited

Loading

`Terraform Security Scan` Failed