chore: change instance type #2
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Contributor
Change detected in the following directories:
|
Contributor
|
Run pre-commit at [INFO] Initializing environment for https://github.com/pre-commit/pre-commit-hooks.
[INFO] Initializing environment for https://github.com/gitleaks/gitleaks.
[INFO] Initializing environment for https://github.com/antonbabenko/pre-commit-terraform.
[INFO] Installing environment for https://github.com/pre-commit/pre-commit-hooks.
[INFO] Once installed this environment will be reused.
[INFO] This may take a few minutes...
[INFO] Installing environment for https://github.com/gitleaks/gitleaks.
[INFO] Once installed this environment will be reused.
[INFO] This may take a few minutes...
check yaml...........................................(no files to check)Skipped
fix end of files.........................................................Passed
trim trailing whitespace.................................................Passed
check for added large files..............................................Passed
detect private key.......................................................Passed
Detect hardcoded secrets.................................................Passed
Terraform fmt............................................................Passed
Terraform docs...........................................................Passed
Terraform validate with tflint...........................................Failed
- hook id: terraform_tflint
- exit code: 2
�[0m�[32mCommand 'tflint --init' successfully done:�[0m
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.10.0)
Installing "aws" plugin...
Installed "aws" (source: github.com/terraform-linters/tflint-ruleset-aws, version: 0.37.0)
�[0m�[33mTFLint in community-days/live/introduction-ec2/:�[0m
4 issue(s) found:
Warning: terraform "required_version" attribute is required (terraform_required_version)
on main.tf line 1:
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.10.0/docs/rules/terraform_required_version.md
Warning: Missing version constraint for provider "aws" in `required_providers` (terraform_required_providers)
on main.tf line 19:
19: resource "aws_instance" "community_demo" {
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.10.0/docs/rules/terraform_required_providers.md
Warning: Module should include an empty outputs.tf file (terraform_standard_module_structure)
on outputs.tf line 1:
(source code not available)
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.10.0/docs/rules/terraform_standard_module_structure.md
Warning: Module should include an empty variables.tf file (terraform_standard_module_structure)
on variables.tf line 1:
(source code not available)
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.10.0/docs/rules/terraform_standard_module_structure.md
Terraform validate.......................................................Passed
Terraform validate with trivy............................................Failed
- hook id: terraform_trivy
- exit code: 1
2025-01-24T17:11:04Z INFO [misconfig] Misconfiguration scanning is enabled
2025-01-24T17:11:04Z INFO [misconfig] Need to update the built-in checks
2025-01-24T17:11:04Z INFO [misconfig] Downloading the built-in checks...
164.50 KiB / 164.50 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2025-01-24T17:11:06Z INFO [terraform scanner] Scanning root module file_path="."
2025-01-24T17:11:06Z INFO Detected config files num=2
main.tf (terraform)
===================
Tests: 2 (SUCCESSES: 0, FAILURES: 2)
Failures: 2 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 2, CRITICAL: 0)
AVD-AWS-0028 (HIGH): Instance does not require IMDS access to require a token.
════════════════════════════════════════
IMDS v2 (Instance Metadata Service) introduced session authentication tokens which improve security when talking to IMDS.
By default <code>aws_instance</code> resource sets IMDS session auth tokens to be optional.
To fully protect IMDS you need to enable session tokens by using <code>metadata_options</code> block and its <code>http_tokens</code> variable set to <code>required</code>.
See https://avd.aquasec.com/misconfig/avd-aws-0028
────────────────────────────────────────
main.tf:19-35
────────────────────────────────────────
19 ┌ resource "aws_instance" "community_demo" {
20 │ instance_type = "t4g.large"
21 │ # instance_type = var.instance_type
22 │ ami = data.aws_ami.al2023_arm64.id
23 │
24 │ associate_public_ip_address = true
25 │
26 │ root_block_device {
27 └ volume_size = 30
..
────────────────────────────────────────
AVD-AWS-0131 (HIGH): Root block device is not encrypted.
════════════════════════════════════════
Block devices should be encrypted to ensure sensitive data is held securely at rest.
See https://avd.aquasec.com/misconfig/avd-aws-0131
────────────────────────────────────────
main.tf:19-35
────────────────────────────────────────
19 ┌ resource "aws_instance" "community_demo" {
20 │ instance_type = "t4g.large"
21 │ # instance_type = var.instance_type
22 │ ami = data.aws_ami.al2023_arm64.id
23 │
24 │ associate_public_ip_address = true
25 │
26 │ root_block_device {
27 └ volume_size = 30
..
────────────────────────────────────────
Checkov..................................................................Failed
- hook id: terraform_checkov
- exit code: 1
_ _
___| |__ ___ ___| | _______ __
/ __| '_ \ / _ \/ __| |/ / _ \ \ / /
| (__| | | | __/ (__| < (_) \ V /
\___|_| |_|\___|\___|_|\_\___/ \_/
By Prisma Cloud | version: 3.2.352
Update available 3.2.352 -> 3.2.357
Run pip3 install -U checkov to update
terraform scan results:
Passed checks: 1, Failed checks: 5, Skipped checks: 0
Check: CKV_AWS_46: "Ensure no hard-coded secrets exist in EC2 user data"
PASSED for resource: aws_instance.community_demo
File: /main.tf:19-35
Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/secrets-policies/bc-aws-secrets-1
Check: CKV_AWS_79: "Ensure Instance Metadata Service Version 1 is not enabled"
FAILED for resource: aws_instance.community_demo
File: /main.tf:19-35
Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-general-31
19 | resource "aws_instance" "community_demo" {
20 | instance_type = "t4g.large"
21 | # instance_type = var.instance_type
22 | ami = data.aws_ami.al2023_arm64.id
23 |
24 | associate_public_ip_address = true
25 |
26 | root_block_device {
27 | volume_size = 30
28 | volume_type = "gp3"
29 | }
30 |
31 | tags = {
32 | "Project" = "community-days",
33 | "Team" = ""
34 | }
35 | }
Check: CKV_AWS_126: "Ensure that detailed monitoring is enabled for EC2 instances"
FAILED for resource: aws_instance.community_demo
File: /main.tf:19-35
Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/ensure-that-detailed-monitoring-is-enabled-for-ec2-instances
19 | resource "aws_instance" "community_demo" {
20 | instance_type = "t4g.large"
21 | # instance_type = var.instance_type
22 | ami = data.aws_ami.al2023_arm64.id
23 |
24 | associate_public_ip_address = true
25 |
26 | root_block_device {
27 | volume_size = 30
28 | volume_type = "gp3"
29 | }
30 |
31 | tags = {
32 | "Project" = "community-days",
33 | "Team" = ""
34 | }
35 | }
Check: CKV_AWS_135: "Ensure that EC2 is EBS optimized"
FAILED for resource: aws_instance.community_demo
File: /main.tf:19-35
Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-ec2-is-ebs-optimized
19 | resource "aws_instance" "community_demo" {
20 | instance_type = "t4g.large"
21 | # instance_type = var.instance_type
22 | ami = data.aws_ami.al2023_arm64.id
23 |
24 | associate_public_ip_address = true
25 |
26 | root_block_device {
27 | volume_size = 30
28 | volume_type = "gp3"
29 | }
30 |
31 | tags = {
32 | "Project" = "community-days",
33 | "Team" = ""
34 | }
35 | }
Check: CKV_AWS_88: "EC2 instance should not have public IP."
FAILED for resource: aws_instance.community_demo
File: /main.tf:19-35
Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/public-policies/public-12
19 | resource "aws_instance" "community_demo" {
20 | instance_type = "t4g.large"
21 | # instance_type = var.instance_type
22 | ami = data.aws_ami.al2023_arm64.id
23 |
24 | associate_public_ip_address = true
25 |
26 | root_block_device {
27 | volume_size = 30
28 | volume_type = "gp3"
29 | }
30 |
31 | tags = {
32 | "Project" = "community-days",
33 | "Team" = ""
34 | }
35 | }
Check: CKV2_AWS_41: "Ensure an IAM role is attached to EC2 instance"
FAILED for resource: aws_instance.community_demo
File: /main.tf:19-35
Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-an-iam-role-is-attached-to-ec2-instance
19 | resource "aws_instance" "community_demo" {
20 | instance_type = "t4g.large"
21 | # instance_type = var.instance_type
22 | ami = data.aws_ami.al2023_arm64.id
23 |
24 | associate_public_ip_address = true
25 |
26 | root_block_device {
27 | volume_size = 30
28 | volume_type = "gp3"
29 | }
30 |
31 | tags = {
32 | "Project" = "community-days",
33 | "Team" = ""
34 | }
35 | }
Infracost breakdown......................................................Passed
- hook id: infracost_breakdown
- duration: 1.3s
2025-01-24T17:11:15Z INFO Autodetected 1 Terraform project across 1 root module
2025-01-24T17:11:15Z INFO Found Terraform project "main" at directory "." using Terraform var files "prod.tfvars", "dev.tfvars"
Running in "community-days/live"
Summary: {
"totalDetectedResources": 0,
"totalSupportedResources": 0,
"totalUnsupportedResources": 0,
"totalUsageBasedResources": 0,
"totalNoPriceResources": 0,
"unsupportedResourceCounts": {},
"noPriceResourceCounts": {}
}
Total Monthly Cost: 0 USD
Total Monthly Cost (diff): 0 USD
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Try change instance type