lint(pre-commit): add trivy check on terraform directory (issues igno…

…red)

.lint/trivy/trivy-scan.sh

@@ -0,0 +1,6 @@
+#!/bin/bash
+set -euxo pipefail
+
+# list of the folders that we want to parse, only if a README.md exists and no .trivy_ignore
+echo "Scanning terraform configuration with trivy: aws/dual-region/terraform"
+trivy config --config .lint/trivy/trivy.yaml --ignorefile .trivyignore aws/dual-region/terraform

.lint/trivy/trivy.yaml

@@ -0,0 +1,9 @@
+---
+quiet: false
+debug: false
+format: table
+exit-code: 1
+
+misconfiguration:
+    scanners:
+        - terraform

.pre-commit-config.yaml

@@ -45,3 +45,12 @@ repos:
       rev: 1.2.11 # use tags until renovate supports sha: https://github.com/renovatebot/renovate/issues/22567
       hooks:
           - id: update-action-readmes-docker
+
+    - repo: local
+      hooks:
+          - id: trivy-scan
+            name: Trivy Scan
+            entry: .lint/trivy/trivy-scan.sh
+            language: script
+            types: [terraform]
+            pass_filenames: false

.tool-versions

@@ -27,3 +27,5 @@ shellcheck 0.10.0
 terraform 1.10.4
 
 tflint 0.55.0
+
+trivy 0.58.1

.trivyignore

@@ -0,0 +1,21 @@
+AVD-AWS-0040 #(CRITICAL): Public cluster access is enabled.
+AVD-AWS-0041 #(CRITICAL): Cluster allows access from a public CIDR: 0.0.0.0/0
+AVD-AWS-0104 #(CRITICAL): Security group rule allows egress to multiple public internet addresses.
+
+AVD-AWS-0086 #(HIGH): No public access block so not blocking public acls
+AVD-AWS-0087 #(HIGH): No public access block so not blocking public policies
+AVD-AWS-0088 #(HIGH): Bucket does not have encryption enabled
+AVD-AWS-0091 #(HIGH): No public access block so not blocking public acls
+AVD-AWS-0093 #(HIGH): No public access block so not restricting public buckets
+AVD-AWS-0132 #(HIGH): Bucket does not encrypt data with a customer managed key.
+
+AVD-AWS-0343 #(MEDIUM): Cluster does not have Deletion Protection enabled
+AVD-AWS-0178 #(MEDIUM): VPC does not have VPC Flow Logs enabled.
+AVD-AWS-0038 #(MEDIUM): Control plane scheduler logging is not enabled.
+AVD-AWS-0077 #(MEDIUM): Cluster instance has very low backup retention period.
+AVD-AWS-0090 #(MEDIUM): Bucket does not have versioning enabled
+
+AVD-AWS-0133 #(LOW): Instance does not have performance insights enabled.
+AVD-AWS-0089 #(LOW): Bucket has logging disabled
+AVD-AWS-0094 #(LOW): Bucket does not have a corresponding public access block.
+AVD-AWS-0143 #(LOW): One or more policies are attached directly to a user