Closed brittandeyoung closed 10 months ago
This PR has been automatically marked as stale because it has been open 30 days with no activity. Remove stale label or comment or this PR will be closed in 10 days
This is still an active PR, just waiting on a review.
I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.
Update bucket references to use
bucket
field as it is known before applyDescription
This PR updates all the references for the s3 bucket to use the
bucket
field as it is know before apply. This resolves IaC scanning tools false positives as it cannot link the acl and other required settings to the bucket without thebucket
field being known. This happens when targeting the plan output for scanning.Motivation and Context
Closes: #259
Scanning IaC before deploying is best practices. Since values can be changed with variables and conditionals, the best way to scan IaC is usng the plan output. In the current state, this module fails common security requirements as the
bucket
field is not known until after apply. This PR resolves this by using thebucket
field as the source, which is known during the plan.Breaking Changes
How Has This Been Tested?
examples/*
to demonstrate and validate my change(s)examples/*
projectspre-commit run -a
on my pull request