PaloAltoNetworks / terraform-aws-vmseries-modules

Terraform Reusable Modules for VM-Series on AWS
https://registry.terraform.io/modules/PaloAltoNetworks/vmseries-modules/aws
MIT License
40 stars 49 forks source link

chore(module/bootstrap): Fix CKV2_AWS_65 - remove ACL from S3 bucket #410

Closed pimielowski closed 1 year ago

pimielowski commented 1 year ago

Description

Based on #383 findings, in Checkov https://github.com/bridgecrewio/checkov/pull/5599 was added check for disabled ACL in S3 Buckets and set object ownership to BucketOwnerEnforced which disable usage of the ACL. When this parameter is set and ACL is trying to be created it gives error in Terraform:

module.bootstrap["vmseries-01"].aws_s3_bucket_acl.this[0]: Still creating... [10s elapsed]
╷
│ Error: creating S3 Bucket (pi-chore334194cc585f9651) ACL: operation error S3: PutBucketAcl, https response error StatusCode: 400, RequestID: NK9CT6SCXPYH4WHM, HostID: dVY0b0Hu04SRZrhSLyW+fCTjtruromIxOWNRhZH2mW9Xe3IpGWmDIJ8r6u6MqAsvdVQEQNkJ6w0=, api error AccessControlListNotSupported: The bucket does not allow ACLs
│
│   with module.bootstrap["vmseries-01"].aws_s3_bucket_acl.this[0],
│   on ../../modules/bootstrap/main.tf line 66, in resource "aws_s3_bucket_acl" "this":
│   66: resource "aws_s3_bucket_acl" "this" {
│
╵

I try to create dynamic rule based on ACL creation but it sill raise the error from Chekov, so I decide to remove it completely from the codebase.

Here is also AWS documentation which was a base to create rule in Checkov -> link Also link to the Checkov info about that rule.

Another quick fix was removing unused TF file and move S3 files structure for full bootstrapping to the example that use full bootstrap.

How Has This Been Tested?

Deployed in AWS, check if everything works and if full bootstrap was done without issue.

Types of changes

Checklist

sebastianczech commented 1 year ago

/idempotence paths="examples/vmseries_standalone"

Testing job ID: 6927630901 Job result: SUCCESS