Rules AC_AWS_0497,AC_AWS_0214, and AC_AWS_0207 all get triggered
What I Did
% terrascan scan -t aws
Scan Errors -
IaC Type : arm
Directory : /Users/wby/test_tfscan
Error Message : ARM files not found in the directory /Users/wby/test_tfscan
-----------------------------------------------------------------------
IaC Type : docker
Directory : /Users/wby/test_tfscan
Error Message : Dockerfile not found in the directory /Users/wby/test_tfscan
-----------------------------------------------------------------------
IaC Type : cft
Directory : /Users/wby/test_tfscan
Error Message : cft files not found in the directory /Users/wby/test_tfscan
-----------------------------------------------------------------------
IaC Type : k8s
Directory : /Users/wby/test_tfscan
Error Message : kubernetes files not found in the directory /Users/wby/test_tfscan
-----------------------------------------------------------------------
IaC Type : kustomize
Directory : /Users/wby/test_tfscan
Error Message : kustomization.y(a)ml file not found in the directory /Users/wby/test_tfscan
-----------------------------------------------------------------------
IaC Type : helm
Directory : /Users/wby/test_tfscan
Error Message : no helm charts found in directory /Users/wby/test_tfscan
-----------------------------------------------------------------------
Violation Details -
Description : Enabling S3 versioning will enable easy recovery from both unintended user actions, like deletes and overwrites
File : s3.tf
Module Name : root
Plan Root : ./
Line : 1
Severity : HIGH
-----------------------------------------------------------------------
Description : Ensure that S3 Buckets have server side encryption at rest enabled with KMS key to protect sensitive data.
File : s3.tf
Module Name : root
Plan Root : ./
Line : 1
Severity : HIGH
-----------------------------------------------------------------------
Description : Ensure S3 buckets have access logging enabled.
File : s3.tf
Module Name : root
Plan Root : ./
Line : 1
Severity : MEDIUM
-----------------------------------------------------------------------
Scan Summary -
File/Folder : /Users/wby/test_tfscan
IaC Type : terraform
Scanned At : 2022-04-15 01:16:39.200675 +0000 UTC
Policies Validated : 10
Violated Policies : 3
Low : 0
Medium : 1
High : 2
Description
Using the >=4.0 AWS provider, bucket encryption / versioning is now specified like so: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/guides/version-4-upgrade#s3-bucket-refactor
With a config like this:
Rules
AC_AWS_0497
,AC_AWS_0214
, andAC_AWS_0207
all get triggeredWhat I Did