Skip to content

Commit f4d0bc3

Browse files
using-systemusing-system
authored
Merge pull request #33 from using-system/features/fix-checkov-issues
Features/fix checkov issues
2 parents e5a6fa7 + 45550ce commit f4d0bc3

File tree

40 files changed

+87
-64
lines changed

40 files changed

+87
-64
lines changed

‎github/actions/checkov/entrypoint.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,4 +4,4 @@ if [ ! -f $1/checkov.yml ]; then
44
cp /config_empty.yml $1/checkov.yml
55
fi
66

7-
checkov -d $1 --config-file $1/checkov.yml
7+
checkov -d $1 --config-file $1/checkov.yml -o github_failed_only

‎terraform/modules/az-aca/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ No requirements.
77

88
| Name | Version |
99
|------|---------|
10-
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | 3.78.0 |
10+
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | 3.82.0 |
1111

1212
## Modules
1313

‎terraform/modules/az-acae-storage/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ No requirements.
77

88
| Name | Version |
99
|------|---------|
10-
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | 3.78.0 |
10+
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | 3.82.0 |
1111

1212
## Modules
1313

‎terraform/modules/az-acae/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ No requirements.
77

88
| Name | Version |
99
|------|---------|
10-
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | 3.78.0 |
10+
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | 3.82.0 |
1111

1212
## Modules
1313

‎terraform/modules/az-acr/README.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ No requirements.
77

88
| Name | Version |
99
|------|---------|
10-
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | 3.78.0 |
10+
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | 3.82.0 |
1111

1212
## Modules
1313

@@ -40,6 +40,7 @@ No modules.
4040
| <a name="input_sku"></a> [sku](#input\_sku) | The SKU name of the container registry. | `string` | `"Premium"` | no |
4141
| <a name="input_tags"></a> [tags](#input\_tags) | Tags to associate with resources. | `map(string)` | n/a | yes |
4242
| <a name="input_trust_policy_enabled"></a> [trust\_policy\_enabled](#input\_trust\_policy\_enabled) | Determines if the trust policy is enabled | `bool` | `true` | no |
43+
| <a name="input_zone_redundancy_enabled"></a> [zone\_redundancy\_enabled](#input\_zone\_redundancy\_enabled) | Determines if the zone redundancy is enabled | `bool` | `true` | no |
4344

4445
## Outputs
4546

‎terraform/modules/az-acr/main.tf

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,10 +21,13 @@ resource "azurerm_container_registry" "acr" {
2121
for_each = var.georeplication_locations
2222

2323
content {
24-
location = georeplications.value
24+
location = georeplications.value
25+
zone_redundancy_enabled = true
2526
}
2627
}
2728

29+
zone_redundancy_enabled = var.zone_redundancy_enabled
30+
2831
identity {
2932
type = var.identity_type
3033
identity_ids = var.identity_ids

‎terraform/modules/az-acr/tests/acr_not_secure.tftest.hcl

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ run "plan" {
2525
trust_policy_enabled = false
2626
retention_policy_enabled = false
2727
enable_lock_on_acr = false
28+
zone_redundancy_enabled = false
2829
network_rule_bypass_option = "AzureServices"
2930

3031
tags = { Environment = "Test" }
@@ -105,6 +106,11 @@ run "plan" {
105106
error_message = "acr georeplications must be empty"
106107
}
107108

109+
assert {
110+
condition = azurerm_container_registry.acr.zone_redundancy_enabled == false
111+
error_message = "acr zone_redundancy_enabled must be set to true"
112+
}
113+
108114
assert {
109115
condition = length(azurerm_container_registry.acr.tags) == 1
110116
error_message = "acr tags must contains one element"
@@ -133,6 +139,7 @@ run "apply" {
133139
trust_policy_enabled = false
134140
retention_policy_enabled = false
135141
enable_lock_on_acr = false
142+
zone_redundancy_enabled = false
136143
network_rule_bypass_option = "AzureServices"
137144

138145
tags = { Environment = "Test" }

‎terraform/modules/az-acr/tests/acr_secure.tftest.hcl

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,6 +101,11 @@ run "plan" {
101101
error_message = "acr georeplications must be empty"
102102
}
103103

104+
assert {
105+
condition = azurerm_container_registry.acr.zone_redundancy_enabled == true
106+
error_message = "acr zone_redundancy_enabled must be set to true"
107+
}
108+
104109
assert {
105110
condition = length(azurerm_container_registry.acr.tags) == 1
106111
error_message = "acr tags must contains one element"

‎terraform/modules/az-acr/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,12 @@ variable "trust_policy_enabled" {
6969
default = true
7070
}
7171

72+
variable "zone_redundancy_enabled" {
73+
description = "Determines if the zone redundancy is enabled"
74+
type = bool
75+
default = true
76+
}
77+
7278
variable "identity_type" {
7379
description = "The type of identity used for the acr."
7480
type = string

‎terraform/modules/az-ad-security-group-members/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ No requirements.
77

88
| Name | Version |
99
|------|---------|
10-
| <a name="provider_azuread"></a> [azuread](#provider\_azuread) | 2.45.0 |
10+
| <a name="provider_azuread"></a> [azuread](#provider\_azuread) | 2.46.0 |
1111

1212
## Modules
1313

‎terraform/modules/az-ad-security-group/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ No requirements.
77

88
| Name | Version |
99
|------|---------|
10-
| <a name="provider_azuread"></a> [azuread](#provider\_azuread) | 2.45.0 |
10+
| <a name="provider_azuread"></a> [azuread](#provider\_azuread) | 2.46.0 |
1111

1212
## Modules
1313

‎terraform/modules/az-aks/README.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ No requirements.
77

88
| Name | Version |
99
|------|---------|
10-
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | 3.78.0 |
10+
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | 3.82.0 |
1111
| <a name="provider_tls"></a> [tls](#provider\_tls) | 4.0.4 |
1212

1313
## Modules
@@ -25,7 +25,7 @@ No modules.
2525

2626
| Name | Description | Type | Default | Required |
2727
|------|-------------|------|---------|:--------:|
28-
| <a name="input_configuration"></a> [configuration](#input\_configuration) | AKS configuration | <pre>object({<br> version = string<br> sku = string<br> private_cluster = bool<br> user_assigned_identity_id = string<br> admin_username = optional(string)<br> local_account_disabled = optional(bool, true)<br> disk_encryption_set_id = optional(string)<br> public_ssh_key = optional(string)<br> automatic_channel_upgrade = optional(string)<br> kv_key_management_service_id = optional(string)<br> node_pool = object({<br> type = string<br> count = number<br> vm_size = string<br> availability_zones = list(number)<br> os_disk_size = number,<br> max_pods = optional(number, 110)<br> temporary_name_for_rotation = optional(string)<br> })<br> rbac = object({<br> enabled = bool<br> admin_group_object_ids = optional(list(string), [])<br> tenant_id = string<br> })<br> addon = object({<br> enable_open_service_mesh = bool<br> enable_azure_policy = bool<br> })<br> network_profile = object({<br> network_plugin = optional(string, "azure"),<br> network_policy = optional(string, "azure"),<br> load_balancer_sku = optional(string, "standard"),<br> outbound_type = optional(string, "userDefinedRouting"),<br> })<br><br> })</pre> | n/a | yes |
28+
| <a name="input_configuration"></a> [configuration](#input\_configuration) | AKS configuration | <pre>object({<br> version = string<br> sku = string<br> private_cluster = bool<br> user_assigned_identity_id = string<br> admin_username = optional(string)<br> local_account_disabled = optional(bool, true)<br> disk_encryption_set_id = optional(string)<br> public_ssh_key = optional(string)<br> automatic_channel_upgrade = optional(string)<br> kv_key_management_service_id = optional(string)<br> node_pool = object({<br> type = string<br> count = number<br> vm_size = string<br> availability_zones = list(number)<br> os_disk_size = number,<br> max_pods = optional(number, 110)<br> temporary_name_for_rotation = optional(string)<br> only_critical_addons_enabled = optional(bool, true)<br> })<br> rbac = object({<br> enabled = bool<br> admin_group_object_ids = optional(list(string), [])<br> tenant_id = string<br> })<br> addon = object({<br> enable_open_service_mesh = bool<br> enable_azure_policy = bool<br> })<br> network_profile = object({<br> network_plugin = optional(string, "azure"),<br> network_policy = optional(string, "azure"),<br> load_balancer_sku = optional(string, "standard"),<br> outbound_type = optional(string, "userDefinedRouting"),<br> })<br><br> })</pre> | n/a | yes |
2929
| <a name="input_location"></a> [location](#input\_location) | Azure Region Location | `any` | n/a | yes |
3030
| <a name="input_log_analytics_id"></a> [log\_analytics\_id](#input\_log\_analytics\_id) | Log analytics identifier | `any` | n/a | yes |
3131
| <a name="input_name"></a> [name](#input\_name) | Naming of the aks | `any` | n/a | yes |

‎terraform/modules/az-aks/main.tf

Lines changed: 12 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -21,17 +21,18 @@ resource "azurerm_kubernetes_cluster" "aks" {
2121
automatic_channel_upgrade = var.configuration.automatic_channel_upgrade
2222

2323
default_node_pool {
24-
name = "defaultpool"
25-
node_count = var.configuration.node_pool.count
26-
vm_size = var.configuration.node_pool.vm_size
27-
zones = var.configuration.node_pool.availability_zones
28-
os_disk_type = "Ephemeral"
29-
os_disk_size_gb = var.configuration.node_pool.os_disk_size
30-
type = var.configuration.node_pool.type
31-
vnet_subnet_id = var.subnet_id
32-
max_pods = var.configuration.node_pool.max_pods
33-
temporary_name_for_rotation = var.configuration.node_pool.temporary_name_for_rotation
34-
enable_host_encryption = true
24+
name = "defaultpool"
25+
node_count = var.configuration.node_pool.count
26+
vm_size = var.configuration.node_pool.vm_size
27+
zones = var.configuration.node_pool.availability_zones
28+
os_disk_type = "Ephemeral"
29+
os_disk_size_gb = var.configuration.node_pool.os_disk_size
30+
type = var.configuration.node_pool.type
31+
vnet_subnet_id = var.subnet_id
32+
max_pods = var.configuration.node_pool.max_pods
33+
temporary_name_for_rotation = var.configuration.node_pool.temporary_name_for_rotation
34+
enable_host_encryption = true
35+
only_critical_addons_enabled = var.configuration.node_pool.only_critical_addons_enabled
3536
}
3637

3738
identity {

‎terraform/modules/az-aks/variables.tf

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -24,13 +24,14 @@ variable "configuration" {
2424
automatic_channel_upgrade = optional(string)
2525
kv_key_management_service_id = optional(string)
2626
node_pool = object({
27-
type = string
28-
count = number
29-
vm_size = string
30-
availability_zones = list(number)
31-
os_disk_size = number,
32-
max_pods = optional(number, 110)
33-
temporary_name_for_rotation = optional(string)
27+
type = string
28+
count = number
29+
vm_size = string
30+
availability_zones = list(number)
31+
os_disk_size = number,
32+
max_pods = optional(number, 110)
33+
temporary_name_for_rotation = optional(string)
34+
only_critical_addons_enabled = optional(bool, true)
3435
})
3536
rbac = object({
3637
enabled = bool

‎terraform/modules/az-analytics/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ No requirements.
77

88
| Name | Version |
99
|------|---------|
10-
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | 3.78.0 |
10+
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | 3.82.0 |
1111

1212
## Modules
1313

‎terraform/modules/az-assigned-identity/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ No requirements.
77

88
| Name | Version |
99
|------|---------|
10-
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | 3.78.0 |
10+
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | 3.82.0 |
1111

1212
## Modules
1313

‎terraform/modules/az-bastion/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ No requirements.
77

88
| Name | Version |
99
|------|---------|
10-
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | 3.78.0 |
10+
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | 3.82.0 |
1111

1212
## Modules
1313

‎terraform/modules/az-des/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ No requirements.
77

88
| Name | Version |
99
|------|---------|
10-
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | 3.78.0 |
10+
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | 3.82.0 |
1111

1212
## Modules
1313

‎terraform/modules/az-dns-zone-vnet-link/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ No requirements.
77

88
| Name | Version |
99
|------|---------|
10-
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | 3.78.0 |
10+
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | 3.82.0 |
1111

1212
## Modules
1313

‎terraform/modules/az-dns-zone/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ No requirements.
77

88
| Name | Version |
99
|------|---------|
10-
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | 3.78.0 |
10+
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | 3.82.0 |
1111

1212
## Modules
1313

‎terraform/modules/az-iam/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ No requirements.
77

88
| Name | Version |
99
|------|---------|
10-
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | 3.78.0 |
10+
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | 3.82.0 |
1111

1212
## Modules
1313

‎terraform/modules/az-kv-key/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ No requirements.
77

88
| Name | Version |
99
|------|---------|
10-
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | 3.78.0 |
10+
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | 3.82.0 |
1111

1212
## Modules
1313

‎terraform/modules/az-kv-secret/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ No requirements.
77

88
| Name | Version |
99
|------|---------|
10-
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | 3.78.0 |
10+
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | 3.82.0 |
1111

1212
## Modules
1313

‎terraform/modules/az-kv/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ No requirements.
77

88
| Name | Version |
99
|------|---------|
10-
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | 3.78.0 |
10+
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | 3.82.0 |
1111

1212
## Modules
1313

‎terraform/modules/az-kv/tests/setup_with_vnet/main.tf

Lines changed: 6 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -8,23 +8,18 @@ resource "azurerm_virtual_network" "test" {
88
resource_group_name = data.azurerm_resource_group.test.name
99
address_space = ["10.0.0.0/16"]
1010

11-
subnet {
12-
name = "Subnet1"
13-
address_prefix = "10.0.0.0/23"
14-
}
15-
1611
tags = {
1712
environment = "Test"
1813
}
1914
}
2015

21-
data "azurerm_subnet" "test" {
22-
23-
depends_on = [azurerm_virtual_network.test]
24-
16+
resource "azurerm_subnet" "test" {
2517
name = "Subnet1"
26-
virtual_network_name = azurerm_virtual_network.test.name
2718
resource_group_name = data.azurerm_resource_group.test.name
19+
virtual_network_name = azurerm_virtual_network.test.name
20+
address_prefixes = ["10.0.0.0/23"]
21+
22+
service_endpoints = ["Microsoft.KeyVault"]
2823
}
2924

3025
output "resource_group_name" {
@@ -36,5 +31,5 @@ output "resource_group_location" {
3631
}
3732

3833
output "subnet_id" {
39-
value = data.azurerm_subnet.test.id
34+
value = azurerm_subnet.test.id
4035
}

‎terraform/modules/az-nat-gtw-subnet-assoc/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ No requirements.
77

88
| Name | Version |
99
|------|---------|
10-
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | 3.78.0 |
10+
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | 3.82.0 |
1111

1212
## Modules
1313

‎terraform/modules/az-nat-gtw/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ No requirements.
77

88
| Name | Version |
99
|------|---------|
10-
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | 3.78.0 |
10+
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | 3.82.0 |
1111

1212
## Modules
1313

‎terraform/modules/az-nsg/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ No requirements.
77

88
| Name | Version |
99
|------|---------|
10-
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | 3.78.0 |
10+
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | 3.82.0 |
1111

1212
## Modules
1313

‎terraform/modules/az-pep/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ No requirements.
77

88
| Name | Version |
99
|------|---------|
10-
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | 3.78.0 |
10+
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | 3.82.0 |
1111

1212
## Modules
1313

‎terraform/modules/az-rg/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ No requirements.
77

88
| Name | Version |
99
|------|---------|
10-
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | 3.78.0 |
10+
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | 3.82.0 |
1111

1212
## Modules
1313

‎terraform/modules/az-routetable/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ No requirements.
77

88
| Name | Version |
99
|------|---------|
10-
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | 3.78.0 |
10+
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | 3.82.0 |
1111

1212
## Modules
1313

‎terraform/modules/az-storage-share/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ No requirements.
77

88
| Name | Version |
99
|------|---------|
10-
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | 3.78.0 |
10+
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | 3.82.0 |
1111

1212
## Modules
1313

0 commit comments

Comments
 (0)