Strip the site down to a blog with an /admin writing flow; move Tides to BTO by Sean-Michael · Pull Request #5 · Sean-Michael/Sean-Michael.dev

Sean-Michael · 2026-10-18T19:18:20Z

The site had grown into widgets, carousels, a React/Vite bundle, and a mount-S3 CLI to write posts. This strips it back to plain HTML + one stylesheet and makes writing a browser task: sign in, write, preview, publish.

What changed

Writing (/admin)

Markdown editor with htmx live preview, Cmd/Ctrl+S to save a draft, unsaved-changes warning.
Drafts, publish, unpublish, discard. Editing a published post saves a draft; the live version doesn't change until "Publish changes".
Image uploads to S3 under images/<kind>/<slug>/, served back via /images/.... Projects get GitHub/live links, tech stack, and a screenshot gallery.
Content stays markdown + frontmatter in S3 using the bucket's existing prefixes (blog/posts/, projects/published/, digests/), with drafts in sibling drafts/ prefixes. No migration, and the digest automation keeps writing to digests/. Unknown frontmatter keys are preserved on edit.

Auth

Traefik sends /admin (both hosts) through oauth2-proxy (GitHub login, allowlisted users) via forwardAuth.
The app re-checks the forwarded X-Auth-Request-User and blocks cross-site POSTs; public routes strip that header so it can't be spoofed.

Public site

Home with a dated post list, Blog (tag filter, RSS at /blog/feed.xml), Projects, Digest, About (existing prose, unchanged), Arete support/privacy pages kept at their URLs, sitemap/robots.
One stylesheet, light/dark, no frontend build. htmx loads only on the editor (pinned + SRI).

Removed / moved

Tides backend + React frontend → Sean-Michael/BTO (see Port newer dashboard from sean-michael.dev; serve under /tides; push to Docker Hub BTO#2). Compose has a tides service behind a profile, routed at /tides and /api/tides.
The JS bundle, widgets, homepage carousel, and the content CLI. Dropped astral / noaa-coops / zeep from this app's deps.

Infra / CI

infrastructure/: EC2 role can now PutObject/DeleteObject on the content bucket (versioning already on).
docker-compose.yaml: oauth2-proxy service, admin router, header-stripping middleware, tides profile.
Workflows: dropped the frontend build job and frontend/** paths.

Testing

29 tests (public pages, drafts hidden, feed/sitemap, images, admin auth + same-origin, draft→publish→unpublish, slug validation, project fields, frontmatter preservation, uploads). ruff clean.
Ran it locally and walked through new post → live preview → save draft (hidden publicly) → publish (live), in light/dark and at phone width.
Built the prod image: home 200, /admin 403 without the forwarded user.
Not verified: oauth2-proxy + Traefik end to end (only runs on the box).

Before merging (merging deploys)

terraform apply in infrastructure/ so /admin saves can write to S3.
Create a GitHub OAuth app (callback https://sean-michael.dev/oauth2/callback) and add to /opt/app/.env: OAUTH2_PROXY_CLIENT_ID, OAUTH2_PROXY_CLIENT_SECRET, OAUTH2_PROXY_COOKIE_SECRET, ADMIN_GITHUB_USERS.
Optional, for /tides: merge Port newer dashboard from sean-michael.dev; serve under /tides; push to Docker Hub BTO#2, add its Docker Hub secrets, then set COMPOSE_PROFILES=tides and TIDES_IMAGE=<dockerhub user>/bto:latest in /opt/app/.env. Until then /tides 404s.

The public site works without steps 2–3; /admin won't until step 2 is done.

🤖 Generated with Claude Code

- FastAPI + Jinja renders plain HTML from markdown in S3 (local ./content in dev) - /admin: markdown editor with htmx live preview, drafts, publish/unpublish, image uploads; behind oauth2-proxy (GitHub) in Traefik, with the app re-checking the forwarded username and blocking cross-site POSTs - Blog, projects (GitHub link + screenshots), and digests; one stylesheet, no frontend build, no widgets - Tides moved to its own repo; compose routes /tides to it behind a profile - EC2 role can now write to the content bucket

The dashboard lives in github.com/Sean-Michael/BTO; the compose service and README now reference it instead of a separate tides repo. The image default no longer fails compose interpolation while the tides profile is off.

- urllib3 2.7.0 -> 2.8.0 (PYSEC-2026-4175/4176/4177), floor raised in pyproject so it can't regress. - Terraform workflow: the upstream tfsec install script now installs into /usr/local/bin itself, so the follow-up `mv ./tfsec` failed. Download the pinned v1.28.14 release and verify its checksum instead of piping the master-branch script to bash.

github-actions · 2026-10-18T19:44:20Z

tfsec


======================================================
tfsec is joining the Trivy family

tfsec will continue to remain available 
for the time being, although our engineering 
attention will be directed at Trivy going forward.

You can read more here: 
https://github.com/aquasecurity/tfsec/discussions/1994
======================================================

�[0m�[3mResult #1�[0m �[0m�[1m�[31mCRITICAL�[39m�[0m�[39m�[0m �[1mSecurity group rule allows ingress from public internet.�[0m �[2m�[0m
�[0m�[0m�[90m────────────────────────────────────────────────────────────────────────────────
�[0m�[0m  �[3mmain.tf�[2m�[3m:49
�[0m�[0m�[90m────────────────────────────────────────────────────────────────────────────────�[39m
�[0m�[0m�[90m   30  �[0m�[0m  �[0m�[38;5;33mresource�[0m �[38;5;37m"aws_security_group"�[0m �[38;5;37m"web_sg"�[0m {�[0m
�[0m�[90m   ..  �[0m
�[0m�[31m   49  �[0m�[0m�[31m[�[39m�[0m�[0m �[0m    �[38;5;245mcidr_blocks�[0m = [�[38;5;37m"0.0.0.0/0"�[0m]�[0m
�[0m�[90m   ..  �[0m
�[0m�[90m   72  �[0m�[0m  }�[0m
�[0m�[90m────────────────────────────────────────────────────────────────────────────────�[39m
�[0m�[0m  �[2m        ID�[0m�[3m aws-ec2-no-public-ingress-sgr
�[0m�[0m  �[2m    Impact�[0m Your port exposed to the internet
�[0m�[0m  �[2mResolution�[0m Set a more restrictive cidr range
�[0m�[0m
  �[2mMore Information�[0m�[0m�[0m
  �[2m-�[0m �[34mhttps://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/ec2/no-public-ingress-sgr/�[0m�[0m
  �[2m-�[0m �[34mhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule#cidr_blocks�[0m�[0m
�[90m────────────────────────────────────────────────────────────────────────────────�[39m


�[0m�[0m�[3mResult #2�[0m �[0m�[1m�[31mCRITICAL�[39m�[0m�[39m�[0m �[1mSecurity group rule allows ingress from public internet.�[0m �[2m�[0m
�[0m�[0m�[90m────────────────────────────────────────────────────────────────────────────────
�[0m�[0m  �[3mmain.tf�[2m�[3m:58
�[0m�[0m�[90m────────────────────────────────────────────────────────────────────────────────�[39m
�[0m�[0m�[90m   30  �[0m�[0m  �[0m�[38;5;33mresource�[0m �[38;5;37m"aws_security_group"�[0m �[38;5;37m"web_sg"�[0m {�[0m
�[0m�[90m   ..  �[0m
�[0m�[31m   58  �[0m�[0m�[31m[�[39m�[0m�[0m �[0m    �[38;5;245mcidr_blocks�[0m = [�[38;5;37m"0.0.0.0/0"�[0m]�[0m
�[0m�[90m   ..  �[0m
�[0m�[90m   72  �[0m�[0m  }�[0m
�[0m�[90m────────────────────────────────────────────────────────────────────────────────�[39m
�[0m�[0m  �[2m        ID�[0m�[3m aws-ec2-no-public-ingress-sgr
�[0m�[0m  �[2m    Impact�[0m Your port exposed to the internet
�[0m�[0m  �[2mResolution�[0m Set a more restrictive cidr range
�[0m�[0m
  �[2mMore Information�[0m�[0m�[0m
  �[2m-�[0m �[34mhttps://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/ec2/no-public-ingress-sgr/�[0m�[0m
  �[2m-�[0m �[34mhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule#cidr_blocks�[0m�[0m
�[90m────────────────────────────────────────────────────────────────────────────────�[39m


�[0m�[0m�[3mResult #3�[0m �[0m�[1m�[31mCRITICAL�[39m�[0m�[39m�[0m �[1mSecurity group rule allows egress to multiple public internet addresses.�[0m �[2m�[0m
�[0m�[0m�[90m────────────────────────────────────────────────────────────────────────────────
�[0m�[0m  �[3mmain.tf�[2m�[3m:66
�[0m�[0m�[90m────────────────────────────────────────────────────────────────────────────────�[39m
�[0m�[0m�[90m   30  �[0m�[0m  �[0m�[38;5;33mresource�[0m �[38;5;37m"aws_security_group"�[0m �[38;5;37m"web_sg"�[0m {�[0m
�[0m�[90m   ..  �[0m
�[0m�[31m   66  �[0m�[0m�[31m[�[39m�[0m�[0m �[0m    �[38;5;245mcidr_blocks�[0m = [�[38;5;37m"0.0.0.0/0"�[0m]�[0m
�[0m�[90m   ..  �[0m
�[0m�[90m   72  �[0m�[0m  }�[0m
�[0m�[90m────────────────────────────────────────────────────────────────────────────────�[39m
�[0m�[0m  �[2m        ID�[0m�[3m aws-ec2-no-public-egress-sgr
�[0m�[0m  �[2m    Impact�[0m Your port is egressing data to the internet
�[0m�[0m  �[2mResolution�[0m Set a more restrictive cidr range
�[0m�[0m
  �[2mMore Information�[0m�[0m�[0m
  �[2m-�[0m �[34mhttps://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/ec2/no-public-egress-sgr/�[0m�[0m
  �[2m-�[0m �[34mhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group�[0m�[0m
�[90m────────────────────────────────────────────────────────────────────────────────�[39m


�[0m�[0m�[3mResult #4�[0m �[0m�[31mHIGH�[39m�[0m �[1mBucket does not have encryption enabled�[0m �[2m�[0m
�[0m�[0m�[90m────────────────────────────────────────────────────────────────────────────────
�[0m�[0m  �[3mmain.tf�[2m�[3m:215-221
�[0m�[0m�[90m────────────────────────────────────────────────────────────────────────────────�[39m
�[0m�[0m�[31m  215  �[0m�[0m �[0m�[0m �[0m�[38;5;33mresource�[0m �[38;5;37m"aws_s3_bucket"�[0m �[38;5;37m"content"�[0m {�[0m
�[0m�[31m  216  �[0m�[0m �[0m�[0m   �[38;5;245mbucket�[0m = �[38;5;37m"�[0m�[38;5;37m${�[0m�[38;5;33mvar�[0m.project_name�[38;5;37m}�[0m�[38;5;37m-content"�[0m
�[0m�[31m  217  �[0m�[0m �[0m�[0m �[0m�[0m
�[0m�[31m  218  �[0m�[0m �[0m�[0m   �[38;5;245mtags�[0m = {�[0m
�[0m�[31m  219  �[0m�[0m �[0m�[0m     �[38;5;245mName�[0m = �[38;5;37m"�[0m�[38;5;37m${�[0m�[38;5;33mvar�[0m.project_name�[38;5;37m}�[0m�[38;5;37m-content"�[0m
�[0m�[31m  220  �[0m�[0m �[0m�[0m �[0m  }�[0m
�[0m�[31m  221  �[0m�[0m �[0m�[0m }�[0m
�[0m�[90m────────────────────────────────────────────────────────────────────────────────�[39m
�[0m�[0m  �[2m        ID�[0m�[3m aws-s3-enable-bucket-encryption
�[0m�[0m  �[2m    Impact�[0m The bucket objects could be read if compromised
�[0m�[0m  �[2mResolution�[0m Configure bucket encryption
�[0m�[0m
  �[2mMore Information�[0m�[0m�[0m
  �[2m-�[0m �[34mhttps://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/s3/enable-bucket-encryption/�[0m�[0m
  �[2m-�[0m �[34mhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#enable-default-server-side-encryption�[0m�[0m
�[90m────────────────────────────────────────────────────────────────────────────────�[39m


�[0m�[0m�[3mResult #5�[0m �[0m�[31mHIGH�[39m�[0m �[1mBucket does not encrypt data with a customer managed key.�[0m �[2m�[0m
�[0m�[0m�[90m────────────────────────────────────────────────────────────────────────────────
�[0m�[0m  �[3mmain.tf�[3m�[2m:215-221
�[0m�[0m�[90m────────────────────────────────────────────────────────────────────────────────�[39m
�[0m�[0m�[31m  215  �[0m�[0m �[0m�[0m �[0m�[38;5;33mresource�[0m �[38;5;37m"aws_s3_bucket"�[0m �[38;5;37m"content"�[0m {�[0m
�[0m�[31m  216  �[0m�[0m �[0m�[0m   �[38;5;245mbucket�[0m = �[38;5;37m"�[0m�[38;5;37m${�[0m�[38;5;33mvar�[0m.project_name�[38;5;37m}�[0m�[38;5;37m-content"�[0m
�[0m�[31m  217  �[0m�[0m �[0m�[0m �[0m�[0m
�[0m�[31m  218  �[0m�[0m �[0m�[0m   �[38;5;245mtags�[0m = {�[0m
�[0m�[31m  219  �[0m�[0m �[0m�[0m     �[38;5;245mName�[0m = �[38;5;37m"�[0m�[38;5;37m${�[0m�[38;5;33mvar�[0m.project_name�[38;5;37m}�[0m�[38;5;37m-content"�[0m
�[0m�[31m  220  �[0m�[0m �[0m�[0m �[0m  }�[0m
�[0m�[31m  221  �[0m�[0m �[0m�[0m }�[0m
�[0m�[90m────────────────────────────────────────────────────────────────────────────────�[39m
�[0m�[0m  �[2m        ID�[0m�[3m aws-s3-encryption-customer-key
�[0m�[0m  �[2m    Impact�[0m Using AWS managed keys does not allow for fine grained control
�[0m�[0m  �[2mResolution�[0m Enable encryption using customer managed keys
�[0m�[0m
  �[2mMore Information�[0m�[0m�[0m
  �[2m-�[0m �[34mhttps://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/s3/encryption-customer-key/�[0m�[0m
  �[2m-�[0m �[34mhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#enable-default-server-side-encryption�[0m�[0m
�[90m────────────────────────────────────────────────────────────────────────────────�[39m


�[0m�[0m�[3mResult #6�[0m �[0m�[31mHIGH�[39m�[0m �[1mPublic access block does not block public policies�[0m �[2m�[0m
�[0m�[0m�[90m────────────────────────────────────────────────────────────────────────────────
�[0m�[0m  �[3mmain.tf�[2m�[3m:234
�[0m�[0m�[90m────────────────────────────────────────────────────────────────────────────────�[39m
�[0m�[0m�[90m  230  �[0m�[0m  �[38;5;33mresource�[0m �[38;5;37m"aws_s3_bucket_public_access_block"�[0m �[38;5;37m"content"�[0m {�[0m
�[0m�[90m  231  �[0m�[0m    �[38;5;245mbucket�[0m = aws_s3_bucket.content.id�[0m
�[0m�[90m  232  �[0m�[0m  �[0m
�[0m�[90m  233  �[0m�[0m    �[38;5;245mblock_public_acls�[0m       = �[38;5;166mtrue�[0m
�[0m�[31m  234  �[0m�[0m�[31m[�[39m�[0m�[0m �[0m  �[38;5;245mblock_public_policy�[0m     = �[38;5;166mfalse�[0m�[0m �[3m�[2m�[3m(false)�[0m
�[0m�[90m  235  �[0m�[0m  �[0m  �[38;5;245mignore_public_acls�[0m      = �[38;5;166mtrue�[0m
�[0m�[90m  236  �[0m�[0m  �[0m  �[38;5;245mrestrict_public_buckets�[0m = �[38;5;166mfalse�[0m
�[0m�[90m  237  �[0m�[0m  �[0m}�[0m
�[0m�[90m────────────────────────────────────────────────────────────────────────────────�[39m
�[0m�[0m  �[2m        ID�[0m�[3m aws-s3-block-public-policy
�[0m�[0m  �[2m    Impact�[0m Users could put a policy that allows public access
�[0m�[0m  �[2mResolution�[0m Prevent policies that allow public access being PUT
�[0m�[0m
  �[2mMore Information�[0m�[0m�[0m
  �[2m-�[0m �[34mhttps://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/s3/block-public-policy/�[0m�[0m
  �[2m-�[0m �[34mhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block#block_public_policy�[0m�[0m
�[90m────────────────────────────────────────────────────────────────────────────────�[39m


�[0m�[0m�[3mResult #7�[0m �[0m�[31mHIGH�[39m�[0m �[1mPublic access block does not restrict public buckets�[0m �[2m�[0m
�[0m�[0m�[90m────────────────────────────────────────────────────────────────────────────────
�[0m�[0m  �[3mmain.tf�[2m�[3m:236
�[0m�[0m�[90m────────────────────────────────────────────────────────────────────────────────�[39m
�[0m�[0m�[90m  230  �[0m�[0m  �[38;5;33mresource�[0m �[38;5;37m"aws_s3_bucket_public_access_block"�[0m �[38;5;37m"content"�[0m {�[0m
�[0m�[90m  231  �[0m�[0m    �[38;5;245mbucket�[0m = aws_s3_bucket.content.id�[0m
�[0m�[90m  232  �[0m�[0m  �[0m
�[0m�[90m  233  �[0m�[0m    �[38;5;245mblock_public_acls�[0m       = �[38;5;166mtrue�[0m
�[0m�[90m  234  �[0m�[0m  �[0m  �[38;5;245mblock_public_policy�[0m     = �[38;5;166mfalse�[0m
�[0m�[90m  235  �[0m�[0m  �[0m  �[38;5;245mignore_public_acls�[0m      = �[38;5;166mtrue�[0m
�[0m�[31m  236  �[0m�[0m�[31m[�[39m�[0m�[0m �[0m  �[38;5;245mrestrict_public_buckets�[0m = �[38;5;166mfalse�[0m�[0m �[3m�[2m�[3m(false)�[0m
�[0m�[90m  237  �[0m�[0m  �[0m}�[0m
�[0m�[90m────────────────────────────────────────────────────────────────────────────────�[39m
�[0m�[0m  �[2m        ID�[0m�[3m aws-s3-no-public-buckets
�[0m�[0m  �[2m    Impact�[0m Public buckets can be accessed by anyone
�[0m�[0m  �[2mResolution�[0m Limit the access to public buckets to only the owner or AWS Services (eg; CloudFront)
�[0m�[0m
  �[2mMore Information�[0m�[0m�[0m
  �[2m-�[0m �[34mhttps://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/s3/no-public-buckets/�[0m�[0m
  �[2m-�[0m �[34mhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block#restrict_public_buckets¡�[0m�[0m
�[90m────────────────────────────────────────────────────────────────────────────────�[39m


�[0m�[0m�[3mResult #8�[0m �[0m�[31mHIGH�[39m�[0m �[1mIAM policy document uses sensitive action 's3:GetObject' on wildcarded resource '70dde66b-c25a-4486-ba53-87f2d55968c4'�[0m �[2m�[0m
�[0m�[0m�[90m────────────────────────────────────────────────────────────────────────────────
�[0m�[0m  �[3mmain.tf�[2m�[3m:265
�[0m�[0m�[90m────────────────────────────────────────────────────────────────────────────────�[39m
�[0m�[0m�[90m  260  �[0m�[0m  �[0m�[38;5;33mresource�[0m �[38;5;37m"aws_iam_role_policy"�[0m �[38;5;37m"ec2_s3_content_read"�[0m {�[0m
�[0m�[90m  ...  �[0m
�[0m�[31m  265  �[0m�[0m�[31m[�[39m�[0m�[0m     �[38;5;245mVersion�[0m = �[38;5;37m"2012-10-17"�[0m
�[0m�[90m  ...  �[0m
�[0m�[90m  283  �[0m�[0m  }�[0m
�[0m�[90m────────────────────────────────────────────────────────────────────────────────�[39m
�[0m�[0m  �[2m        ID�[0m�[3m aws-iam-no-policy-wildcards
�[0m�[0m  �[2m    Impact�[0m Overly permissive policies may grant access to sensitive resources
�[0m�[0m  �[2mResolution�[0m Specify the exact permissions required, and to which resources they should apply instead of using wildcards.
�[0m�[0m
  �[2mMore Information�[0m�[0m�[0m
  �[2m-�[0m �[34mhttps://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/iam/no-policy-wildcards/�[0m�[0m
  �[2m-�[0m �[34mhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document�[0m�[0m
�[90m────────────────────────────────────────────────────────────────────────────────�[39m


�[0m�[0m�[3mResult #9�[0m �[0m�[31mHIGH�[39m�[0m �[1mIAM policy document uses sensitive action 's3:PutObject' on wildcarded resource '70dde66b-c25a-4486-ba53-87f2d55968c4'�[0m �[2m�[0m
�[0m�[0m�[90m────────────────────────────────────────────────────────────────────────────────
�[0m�[0m  �[3mmain.tf�[2m�[3m:291
�[0m�[0m�[90m────────────────────────────────────────────────────────────────────────────────�[39m
�[0m�[0m�[90m  286  �[0m�[0m  �[0m�[38;5;33mresource�[0m �[38;5;37m"aws_iam_user_policy"�[0m �[38;5;37m"github_actions_s3_sync"�[0m {�[0m
�[0m�[90m  ...  �[0m
�[0m�[31m  291  �[0m�[0m�[31m[�[39m�[0m�[0m     �[38;5;245mVersion�[0m = �[38;5;37m"2012-10-17"�[0m
�[0m�[90m  ...  �[0m
�[0m�[90m  308  �[0m�[0m  }�[0m
�[0m�[90m────────────────────────────────────────────────────────────────────────────────�[39m
�[0m�[0m  �[2m        ID�[0m�[3m aws-iam-no-policy-wildcards
�[0m�[0m  �[2m    Impact�[0m Overly permissive policies may grant access to sensitive resources
�[0m�[0m  �[2mResolution�[0m Specify the exact permissions required, and to which resources they should apply instead of using wildcards.
�[0m�[0m
  �[2mMore Information�[0m�[0m�[0m
  �[2m-�[0m �[34mhttps://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/iam/no-policy-wildcards/�[0m�[0m
  �[2m-�[0m �[34mhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document�[0m�[0m
�[90m────────────────────────────────────────────────────────────────────────────────�[39m


�[0m�[0m�[3mResult #10�[0m �[0m�[31mHIGH�[39m�[0m �[1mInstance does not require IMDS access to require a token�[0m �[2m�[0m
�[0m�[0m�[90m────────────────────────────────────────────────────────────────────────────────
�[0m�[0m  �[3mmain.tf�[3m�[2m:98-117
�[0m�[0m�[90m────────────────────────────────────────────────────────────────────────────────�[39m
�[0m�[0m�[31m   98  �[0m�[0m�[31m┌�[39m�[0m�[0m �[0m�[38;5;33mresource�[0m �[38;5;37m"aws_instance"�[0m �[38;5;37m"app_server"�[0m {�[0m
�[0m�[31m   99  �[0m�[0m�[31m│�[39m�[0m�[0m   �[38;5;245mami�[0m                    = �[38;5;33mdata�[0m.aws_ami.ubuntu.id�[0m
�[0m�[31m  100  �[0m�[0m�[31m│�[39m�[0m�[0m   �[38;5;245minstance_type�[0m          = �[38;5;33mvar�[0m.instance_type�[0m
�[0m�[31m  101  �[0m�[0m�[31m│�[39m�[0m�[0m   �[38;5;245mkey_name�[0m               = aws_key_pair.deployer.key_name�[0m
�[0m�[31m  102  �[0m�[0m�[31m│�[39m�[0m�[0m   �[38;5;245mvpc_security_group_ids�[0m = [aws_security_group.web_sg.id]�[0m
�[0m�[31m  103  �[0m�[0m�[31m│�[39m�[0m�[0m   �[38;5;245miam_instance_profile�[0m   = aws_iam_instance_profile.ec2_ssm_profile.name�[0m
�[0m�[31m  104  �[0m�[0m�[31m│�[39m�[0m�[0m �[0m
�[0m�[31m  105  �[0m�[0m�[31m│�[39m�[0m�[0m   root_block_device {�[0m
�[0m�[31m  106  �[0m�[0m�[31m└�[39m�[0m�[0m     �[38;5;245mvolume_size�[0m = �[38;5;37m20�[0m
�[0m�[90m  ...  �[0m
�[0m�[90m────────────────────────────────────────────────────────────────────────────────�[39m
�[0m�[0m  �[2m        ID�[0m�[3m aws-ec2-enforce-http-token-imds
�[0m�[0m  �[2m    Impact�[0m Instance metadata service can be interacted with freely
�[0m�[0m  �[2mResolution�[0m Enable HTTP token requirement for IMDS
�[0m�[0m
  �[2mMore Information�[0m�[0m�[0m
  �[2m-�[0m �[34mhttps://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/ec2/enforce-http-token-imds/�[0m�[0m
  �[2m-�[0m �[34mhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/instance#metadata-options�[0m�[0m
�[90m────────────────────────────────────────────────────────────────────────────────�[39m


�[0m�[0m�[3mResult #11�[0m �[0m�[31mHIGH�[39m�[0m �[1mRoot block device is not encrypted.�[0m �[2m�[0m
�[0m�[0m�[90m────────────────────────────────────────────────────────────────────────────────
�[0m�[0m  �[3mmain.tf�[3m�[2m:98-117
�[0m�[0m�[90m────────────────────────────────────────────────────────────────────────────────�[39m
�[0m�[0m�[31m   98  �[0m�[0m�[31m┌�[39m�[0m�[0m �[0m�[38;5;33mresource�[0m �[38;5;37m"aws_instance"�[0m �[38;5;37m"app_server"�[0m {�[0m
�[0m�[31m   99  �[0m�[0m�[31m│�[39m�[0m�[0m   �[38;5;245mami�[0m                    = �[38;5;33mdata�[0m.aws_ami.ubuntu.id�[0m
�[0m�[31m  100  �[0m�[0m�[31m│�[39m�[0m�[0m   �[38;5;245minstance_type�[0m          = �[38;5;33mvar�[0m.instance_type�[0m
�[0m�[31m  101  �[0m�[0m�[31m│�[39m�[0m�[0m   �[38;5;245mkey_name�[0m               = aws_key_pair.deployer.key_name�[0m
�[0m�[31m  102  �[0m�[0m�[31m│�[39m�[0m�[0m   �[38;5;245mvpc_security_group_ids�[0m = [aws_security_group.web_sg.id]�[0m
�[0m�[31m  103  �[0m�[0m�[31m│�[39m�[0m�[0m   �[38;5;245miam_instance_profile�[0m   = aws_iam_instance_profile.ec2_ssm_profile.name�[0m
�[0m�[31m  104  �[0m�[0m�[31m│�[39m�[0m�[0m �[0m
�[0m�[31m  105  �[0m�[0m�[31m│�[39m�[0m�[0m   root_block_device {�[0m
�[0m�[31m  106  �[0m�[0m�[31m└�[39m�[0m�[0m     �[38;5;245mvolume_size�[0m = �[38;5;37m20�[0m
�[0m�[90m  ...  �[0m
�[0m�[90m────────────────────────────────────────────────────────────────────────────────�[39m
�[0m�[0m  �[2m        ID�[0m�[3m aws-ec2-enable-at-rest-encryption
�[0m�[0m  �[2m    Impact�[0m The block device could be compromised and read from
�[0m�[0m  �[2mResolution�[0m Turn on encryption for all block devices
�[0m�[0m
  �[2mMore Information�[0m�[0m�[0m
  �[2m-�[0m �[34mhttps://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/ec2/enable-at-rest-encryption/�[0m�[0m
  �[2m-�[0m �[34mhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/instance#ebs-ephemeral-and-root-block-devices�[0m�[0m
�[90m────────────────────────────────────────────────────────────────────────────────�[39m


�[0m�[0m�[3mResult #12�[0m �[0m�[33mMEDIUM�[39m�[0m �[1mBucket does not have logging enabled�[0m �[2m�[0m
�[0m�[0m�[90m────────────────────────────────────────────────────────────────────────────────
�[0m�[0m  �[3mmain.tf�[2m�[3m:215-221
�[0m�[0m�[90m────────────────────────────────────────────────────────────────────────────────�[39m
�[0m�[0m�[31m  215  �[0m�[0m �[0m�[0m �[0m�[38;5;33mresource�[0m �[38;5;37m"aws_s3_bucket"�[0m �[38;5;37m"content"�[0m {�[0m
�[0m�[31m  216  �[0m�[0m �[0m�[0m   �[38;5;245mbucket�[0m = �[38;5;37m"�[0m�[38;5;37m${�[0m�[38;5;33mvar�[0m.project_name�[38;5;37m}�[0m�[38;5;37m-content"�[0m
�[0m�[31m  217  �[0m�[0m �[0m�[0m �[0m�[0m
�[0m�[31m  218  �[0m�[0m �[0m�[0m   �[38;5;245mtags�[0m = {�[0m
�[0m�[31m  219  �[0m�[0m �[0m�[0m     �[38;5;245mName�[0m = �[38;5;37m"�[0m�[38;5;37m${�[0m�[38;5;33mvar�[0m.project_name�[38;5;37m}�[0m�[38;5;37m-content"�[0m
�[0m�[31m  220  �[0m�[0m �[0m�[0m �[0m  }�[0m
�[0m�[31m  221  �[0m�[0m �[0m�[0m }�[0m
�[0m�[90m────────────────────────────────────────────────────────────────────────────────�[39m
�[0m�[0m  �[2m        ID�[0m�[3m aws-s3-enable-bucket-logging
�[0m�[0m  �[2m    Impact�[0m There is no way to determine the access to this bucket
�[0m�[0m  �[2mResolution�[0m Add a logging block to the resource to enable access logging
�[0m�[0m
  �[2mMore Information�[0m�[0m�[0m
  �[2m-�[0m �[34mhttps://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/s3/enable-bucket-logging/�[0m�[0m
  �[2m-�[0m �[34mhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket�[0m�[0m
�[90m────────────────────────────────────────────────────────────────────────────────�[39m


�[0m�[0m�[3mResult #13�[0m �[0m�[97mLOW�[39m�[0m �[1mOne or more policies are attached directly to a user�[0m �[2m�[0m
�[0m�[0m�[90m────────────────────────────────────────────────────────────────────────────────
�[0m�[0m  �[3mmain.tf�[2m�[3m:163-169
�[0m�[0m�[90m────────────────────────────────────────────────────────────────────────────────�[39m
�[0m�[0m�[31m  163  �[0m�[0m �[0m�[0m �[38;5;33mresource�[0m �[38;5;37m"aws_iam_user"�[0m �[38;5;37m"github_actions_deployer"�[0m {�[0m
�[0m�[31m  164  �[0m�[0m �[0m�[0m   �[38;5;245mname�[0m = �[38;5;37m"�[0m�[38;5;37m${�[0m�[38;5;33mvar�[0m.project_name�[38;5;37m}�[0m�[38;5;37m-github-deployer"�[0m
�[0m�[31m  165  �[0m�[0m �[0m�[0m �[0m�[0m
�[0m�[31m  166  �[0m�[0m �[0m�[0m   �[38;5;245mtags�[0m = {�[0m
�[0m�[31m  167  �[0m�[0m �[0m�[0m     �[38;5;245mName�[0m = �[38;5;37m"�[0m�[38;5;37m${�[0m�[38;5;33mvar�[0m.project_name�[38;5;37m}�[0m�[38;5;37m-github-deployer"�[0m
�[0m�[31m  168  �[0m�[0m �[0m�[0m �[0m  }�[0m
�[0m�[31m  169  �[0m�[0m �[0m�[0m }�[0m
�[0m�[90m────────────────────────────────────────────────────────────────────────────────�[39m
�[0m�[0m  �[2m        ID�[0m�[3m aws-iam-no-user-attached-policies
�[0m�[0m  �[2m    Impact�[0m Complex access control is difficult to manage and maintain.
�[0m�[0m  �[2mResolution�[0m Grant policies at the group level instead.
�[0m�[0m
  �[2mMore Information�[0m�[0m�[0m
  �[2m-�[0m �[34mhttps://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/iam/no-user-attached-policies/�[0m�[0m
  �[2m-�[0m �[34mhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user�[0m�[0m
�[90m────────────────────────────────────────────────────────────────────────────────�[39m


�[0m�[0m�[3mResult #14�[0m �[0m�[97mLOW�[39m�[0m �[1mSecurity group rule does not have a description.�[0m �[2m�[0m
�[0m�[0m�[90m────────────────────────────────────────────────────────────────────────────────
�[0m�[0m  �[3mmain.tf�[2m�[3m:62-67
�[0m�[0m�[90m────────────────────────────────────────────────────────────────────────────────�[39m
�[0m�[0m�[90m   30  �[0m�[0m  �[0m�[38;5;33mresource�[0m �[38;5;37m"aws_security_group"�[0m �[38;5;37m"web_sg"�[0m {�[0m
�[0m�[90m   ..  �[0m
�[0m�[31m   62  �[0m�[0m�[31m┌�[39m�[0m�[0m �[0m  egress {�[0m
�[0m�[31m   63  �[0m�[0m�[31m│�[39m�[0m�[0m     �[38;5;245mfrom_port�[0m   = �[38;5;37m0�[0m
�[0m�[31m   64  �[0m�[0m�[31m│�[39m�[0m�[0m �[0m    �[38;5;245mto_port�[0m     = �[38;5;37m0�[0m
�[0m�[31m   65  �[0m�[0m�[31m│�[39m�[0m�[0m �[0m    �[38;5;245mprotocol�[0m    = �[38;5;37m"-1"�[0m
�[0m�[31m   66  �[0m�[0m�[31m│�[39m�[0m�[0m �[0m    �[38;5;245mcidr_blocks�[0m = [�[38;5;37m"0.0.0.0/0"�[0m]�[0m
�[0m�[31m   67  �[0m�[0m�[31m└�[39m�[0m�[0m   }�[0m
�[0m�[90m   ..  �[0m
�[0m�[90m   72  �[0m�[0m  }�[0m
�[0m�[90m────────────────────────────────────────────────────────────────────────────────�[39m
�[0m�[0m  �[2m        ID�[0m�[3m aws-ec2-add-description-to-security-group-rule
�[0m�[0m  �[2m    Impact�[0m Descriptions provide context for the firewall rule reasons
�[0m�[0m  �[2mResolution�[0m Add descriptions for all security groups rules
�[0m�[0m
  �[2mMore Information�[0m�[0m�[0m
  �[2m-�[0m �[34mhttps://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/ec2/add-description-to-security-group-rule/�[0m�[0m
  �[2m-�[0m �[34mhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group�[0m�[0m
  �[2m-�[0m �[34mhttps://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule�[0m�[0m
�[90m────────────────────────────────────────────────────────────────────────────────�[39m


�[0m�[0m  �[1mtimings�[0m
  ──────────────────────────────────────────
�[0m�[0m  �[2mdisk i/o            �[0m 70.987µs
�[0m�[0m  �[2mparsing             �[0m 2.757493ms
�[0m�[0m  �[2madaptation          �[0m 1.33114ms
�[0m�[0m  �[2mchecks              �[0m 5.566215ms
�[0m�[0m  �[2mtotal               �[0m 9.725835ms
�[0m
�[0m  �[1mcounts�[0m
  ──────────────────────────────────────────
�[0m�[0m  �[2mmodules downloaded  �[0m 0
�[0m�[0m  �[2mmodules processed   �[0m 1
�[0m�[0m  �[2mblocks processed    �[0m 36
�[0m�[0m  �[2mfiles read          �[0m 4
�[0m
�[0m  �[1mresults�[0m
  ──────────────────────────────────────────
�[0m�[0m  �[2mpassed              �[0m 20
�[0m�[0m  �[2mignored             �[0m 0
�[0m�[0m  �[2mcritical            �[0m 3
�[0m�[0m  �[2mhigh                �[0m 8
�[0m�[0m  �[2mmedium              �[0m 1
�[0m�[0m  �[2mlow                 �[0m 2
�[0m
�[0m  �[31m�[1m20 passed, 14 potential problem(s) detected.

�[0m

checkov


       _               _
   ___| |__   ___  ___| | _______   __
  / __| '_ \ / _ \/ __| |/ / _ \ \ / /
 | (__| | | |  __/ (__|   < (_) \ V /
  \___|_| |_|\___|\___|_|\_\___/ \_/

By Prisma Cloud | version: 3.3.29 

terraform scan results:

Passed checks: 41, Failed checks: 18, Skipped checks: 0

Check: CKV_AWS_41: "Ensure no hard coded AWS access key and secret key exists in provider"
	PASSED for resource: aws.appregistry
	File: /main.tf:2-5
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/secrets-policies/bc-aws-secrets-5
Check: CKV_AWS_41: "Ensure no hard coded AWS access key and secret key exists in provider"
	PASSED for resource: aws.default
	File: /main.tf:15-27
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/secrets-policies/bc-aws-secrets-5
Check: CKV_AWS_25: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389"
	PASSED for resource: aws_security_group.web_sg
	File: /main.tf:30-72
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-2
Check: CKV_AWS_277: "Ensure no security groups allow ingress from 0.0.0.0:0 to port -1"
	PASSED for resource: aws_security_group.web_sg
	File: /main.tf:30-72
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-aws-security-group-does-not-allow-all-traffic-on-all-ports
Check: CKV_AWS_24: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 22"
	PASSED for resource: aws_security_group.web_sg
	File: /main.tf:30-72
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-1-port-security
Check: CKV_AWS_46: "Ensure no hard-coded secrets exist in EC2 user data"
	PASSED for resource: aws_instance.app_server
	File: /main.tf:98-117
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/secrets-policies/bc-aws-secrets-1
Check: CKV_AWS_88: "EC2 instance should not have public IP."
	PASSED for resource: aws_instance.app_server
	File: /main.tf:98-117
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/public-policies/public-12
Check: CKV_AWS_61: "Ensure AWS IAM policy does not allow assume role permission across all services"
	PASSED for resource: aws_iam_role.ec2_ssm_role
	File: /main.tf:132-151
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-iam-45
Check: CKV_AWS_274: "Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy"
	PASSED for resource: aws_iam_role.ec2_ssm_role
	File: /main.tf:132-151
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-274
Check: CKV_AWS_60: "Ensure IAM role allows only specific services or principals to assume it"
	PASSED for resource: aws_iam_role.ec2_ssm_role
	File: /main.tf:132-151
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-iam-44
Check: CKV_AWS_393: "Ensure AWS GitHub Actions OIDC authorization policies only allow safe claims and claim order on IAM role"
	PASSED for resource: aws_iam_role.ec2_ssm_role
	File: /main.tf:132-151
Check: CKV_AWS_274: "Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy"
	PASSED for resource: aws_iam_role_policy_attachment.ec2_ssm_policy
	File: /main.tf:153-156
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-274
Check: CKV_AWS_289: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
	PASSED for resource: aws_iam_user_policy.github_actions_ssm_policy
	File: /main.tf:171-208
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-289
Check: CKV_AWS_62: "Ensure IAM policies that allow full "*-*" administrative privileges are not created"
	PASSED for resource: aws_iam_user_policy.github_actions_ssm_policy
	File: /main.tf:171-208
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-iam-45
Check: CKV_AWS_287: "Ensure IAM policies does not allow credentials exposure"
	PASSED for resource: aws_iam_user_policy.github_actions_ssm_policy
	File: /main.tf:171-208
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-287
Check: CKV_AWS_355: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions"
	PASSED for resource: aws_iam_user_policy.github_actions_ssm_policy
	File: /main.tf:171-208
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-355
Check: CKV_AWS_288: "Ensure IAM policies does not allow data exfiltration"
	PASSED for resource: aws_iam_user_policy.github_actions_ssm_policy
	File: /main.tf:171-208
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-288
Check: CKV_AWS_63: "Ensure no IAM policies documents allow "*" as a statement's actions"
	PASSED for resource: aws_iam_user_policy.github_actions_ssm_policy
	File: /main.tf:171-208
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/iam-48
Check: CKV_AWS_290: "Ensure IAM policies does not allow write access without constraints"
	PASSED for resource: aws_iam_user_policy.github_actions_ssm_policy
	File: /main.tf:171-208
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-290
Check: CKV_AWS_286: "Ensure IAM policies does not allow privilege escalation"
	PASSED for resource: aws_iam_user_policy.github_actions_ssm_policy
	File: /main.tf:171-208
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-286
Check: CKV_AWS_348: "Ensure IAM root user does not have Access keys"
	PASSED for resource: aws_iam_access_key.github_actions_key
	File: /main.tf:210-212
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-348
Check: CKV_AWS_93: "Ensure S3 bucket policy does not lockout all but root user. (Prevent lockouts needing root account fixes)"
	PASSED for resource: aws_s3_bucket.content
	File: /main.tf:215-221
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/bc-aws-s3-24
Check: CKV_AWS_55: "Ensure S3 bucket has ignore public ACLs enabled"
	PASSED for resource: aws_s3_bucket_public_access_block.content
	File: /main.tf:230-237
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/bc-aws-s3-21
Check: CKV_AWS_53: "Ensure S3 bucket has block public ACLS enabled"
	PASSED for resource: aws_s3_bucket_public_access_block.content
	File: /main.tf:230-237
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/bc-aws-s3-19
Check: CKV_AWS_93: "Ensure S3 bucket policy does not lockout all but root user. (Prevent lockouts needing root account fixes)"
	PASSED for resource: aws_s3_bucket_policy.content_images_public
	File: /main.tf:239-255
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/bc-aws-s3-24
Check: CKV_AWS_62: "Ensure IAM policies that allow full "*-*" administrative privileges are not created"
	PASSED for resource: aws_iam_role_policy.ec2_s3_content_read
	File: /main.tf:260-283
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-iam-45
Check: CKV_AWS_63: "Ensure no IAM policies documents allow "*" as a statement's actions"
	PASSED for resource: aws_iam_role_policy.ec2_s3_content_read
	File: /main.tf:260-283
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/iam-48
Check: CKV_AWS_62: "Ensure IAM policies that allow full "*-*" administrative privileges are not created"
	PASSED for resource: aws_iam_user_policy.github_actions_s3_sync
	File: /main.tf:286-308
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-iam-45
Check: CKV_AWS_63: "Ensure no IAM policies documents allow "*" as a statement's actions"
	PASSED for resource: aws_iam_user_policy.github_actions_s3_sync
	File: /main.tf:286-308
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/iam-48
Check: CKV_AWS_386: "Reduce potential for WhoAMI cloud image name confusion attack"
	PASSED for resource: aws_ami.ubuntu
	File: /main.tf:81-95
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-supply-chain-policies/bc-aws-386
Check: CKV2_AWS_22: "Ensure an IAM User does not have access to the console"
	PASSED for resource: aws_iam_user.github_actions_deployer
	File: /main.tf:163-169
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-an-iam-user-does-not-have-access-to-the-console-group
Check: CKV2_AWS_56: "Ensure AWS Managed IAMFullAccess IAM policy is not used."
	PASSED for resource: aws_iam_role.ec2_ssm_role
	File: /main.tf:132-151
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-2-56
Check: CKV2_AWS_56: "Ensure AWS Managed IAMFullAccess IAM policy is not used."
	PASSED for resource: aws_iam_role_policy_attachment.ec2_ssm_policy
	File: /main.tf:153-156
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-2-56
Check: CKV_AWS_20: "S3 Bucket has an ACL defined which allows public READ access."
	PASSED for resource: aws_s3_bucket.content
	File: /main.tf:215-221
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-1-acl-read-permissions-everyone
Check: CKV2_AWS_41: "Ensure an IAM role is attached to EC2 instance"
	PASSED for resource: aws_instance.app_server
	File: /main.tf:98-117
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-an-iam-role-is-attached-to-ec2-instance
Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
	PASSED for resource: aws_security_group.web_sg
	File: /main.tf:30-72
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis
Check: CKV_AWS_21: "Ensure all data stored in the S3 bucket have versioning enabled"
	PASSED for resource: aws_s3_bucket.content
	File: /main.tf:215-221
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-16-enable-versioning
Check: CKV_AWS_57: "S3 Bucket has an ACL defined which allows public WRITE access."
	PASSED for resource: aws_s3_bucket.content
	File: /main.tf:215-221
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-2-acl-write-permissions-everyone
Check: CKV2_AWS_40: "Ensure AWS IAM policy does not allow full IAM privileges"
	PASSED for resource: aws_iam_user_policy.github_actions_ssm_policy
	File: /main.tf:171-208
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-2-40
Check: CKV2_AWS_19: "Ensure that all EIP addresses allocated to a VPC are attached to EC2 instances"
	PASSED for resource: aws_eip.app_eip
	File: /main.tf:120-127
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-all-eip-addresses-allocated-to-a-vpc-are-attached-to-ec2-instances
Check: CKV_AWS_19: "Ensure all data stored in the S3 bucket is securely encrypted at rest"
	PASSED for resource: aws_s3_bucket.content
	File: /main.tf:215-221
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-14-data-encrypted-at-rest
Check: CKV_AWS_23: "Ensure every security group and rule has a description"
	FAILED for resource: aws_security_group.web_sg
	File: /main.tf:30-72
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31

		30 | resource "aws_security_group" "web_sg" {
		31 |   name        = "${var.project_name}-web-sg"
		32 |   description = "Security group for web server"
		33 | 
		34 |   # SSH from home IP only
		35 |   ingress {
		36 |     description = "SSH from home"
		37 |     from_port   = 22
		38 |     to_port     = 22
		39 |     protocol    = "tcp"
		40 |     cidr_blocks = [var.allowed_ssh_cidr]
		41 |   }
		42 | 
		43 |   # HTTP from anywhere
		44 |   ingress {
		45 |     description = "HTTP"
		46 |     from_port   = 80
		47 |     to_port     = 80
		48 |     protocol    = "tcp"
		49 |     cidr_blocks = ["0.0.0.0/0"]
		50 |   }
		51 | 
		52 |   # HTTPS from anywhere
		53 |   ingress {
		54 |     description = "HTTPS"
		55 |     from_port   = 443
		56 |     to_port     = 443
		57 |     protocol    = "tcp"
		58 |     cidr_blocks = ["0.0.0.0/0"]
		59 |   }
		60 | 
		61 |   # All outbound
		62 |   egress {
		63 |     from_port   = 0
		64 |     to_port     = 0
		65 |     protocol    = "-1"
		66 |     cidr_blocks = ["0.0.0.0/0"]
		67 |   }
		68 | 
		69 |   tags = {
		70 |     Name = "${var.project_name}-web-sg"
		71 |   }
		72 | }

Check: CKV_AWS_260: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 80"
	FAILED for resource: aws_security_group.web_sg
	File: /main.tf:30-72
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-aws-security-groups-do-not-allow-ingress-from-00000-to-port-80

		30 | resource "aws_security_group" "web_sg" {
		31 |   name        = "${var.project_name}-web-sg"
		32 |   description = "Security group for web server"
		33 | 
		34 |   # SSH from home IP only
		35 |   ingress {
		36 |     description = "SSH from home"
		37 |     from_port   = 22
		38 |     to_port     = 22
		39 |     protocol    = "tcp"
		40 |     cidr_blocks = [var.allowed_ssh_cidr]
		41 |   }
		42 | 
		43 |   # HTTP from anywhere
		44 |   ingress {
		45 |     description = "HTTP"
		46 |     from_port   = 80
		47 |     to_port     = 80
		48 |     protocol    = "tcp"
		49 |     cidr_blocks = ["0.0.0.0/0"]
		50 |   }
		51 | 
		52 |   # HTTPS from anywhere
		53 |   ingress {
		54 |     description = "HTTPS"
		55 |     from_port   = 443
		56 |     to_port     = 443
		57 |     protocol    = "tcp"
		58 |     cidr_blocks = ["0.0.0.0/0"]
		59 |   }
		60 | 
		61 |   # All outbound
		62 |   egress {
		63 |     from_port   = 0
		64 |     to_port     = 0
		65 |     protocol    = "-1"
		66 |     cidr_blocks = ["0.0.0.0/0"]
		67 |   }
		68 | 
		69 |   tags = {
		70 |     Name = "${var.project_name}-web-sg"
		71 |   }
		72 | }

Check: CKV_AWS_382: "Ensure no security groups allow egress from 0.0.0.0:0 to port -1"
	FAILED for resource: aws_security_group.web_sg
	File: /main.tf:30-72
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/bc-aws-382

		30 | resource "aws_security_group" "web_sg" {
		31 |   name        = "${var.project_name}-web-sg"
		32 |   description = "Security group for web server"
		33 | 
		34 |   # SSH from home IP only
		35 |   ingress {
		36 |     description = "SSH from home"
		37 |     from_port   = 22
		38 |     to_port     = 22
		39 |     protocol    = "tcp"
		40 |     cidr_blocks = [var.allowed_ssh_cidr]
		41 |   }
		42 | 
		43 |   # HTTP from anywhere
		44 |   ingress {
		45 |     description = "HTTP"
		46 |     from_port   = 80
		47 |     to_port     = 80
		48 |     protocol    = "tcp"
		49 |     cidr_blocks = ["0.0.0.0/0"]
		50 |   }
		51 | 
		52 |   # HTTPS from anywhere
		53 |   ingress {
		54 |     description = "HTTPS"
		55 |     from_port   = 443
		56 |     to_port     = 443
		57 |     protocol    = "tcp"
		58 |     cidr_blocks = ["0.0.0.0/0"]
		59 |   }
		60 | 
		61 |   # All outbound
		62 |   egress {
		63 |     from_port   = 0
		64 |     to_port     = 0
		65 |     protocol    = "-1"
		66 |     cidr_blocks = ["0.0.0.0/0"]
		67 |   }
		68 | 
		69 |   tags = {
		70 |     Name = "${var.project_name}-web-sg"
		71 |   }
		72 | }

Check: CKV_AWS_135: "Ensure that EC2 is EBS optimized"
	FAILED for resource: aws_instance.app_server
	File: /main.tf:98-117
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-ec2-is-ebs-optimized

		98  | resource "aws_instance" "app_server" {
		99  |   ami                    = data.aws_ami.ubuntu.id
		100 |   instance_type          = var.instance_type
		101 |   key_name               = aws_key_pair.deployer.key_name
		102 |   vpc_security_group_ids = [aws_security_group.web_sg.id]
		103 |   iam_instance_profile   = aws_iam_instance_profile.ec2_ssm_profile.name
		104 | 
		105 |   root_block_device {
		106 |     volume_size = 20
		107 |     volume_type = "gp3"
		108 |   }
		109 | 
		110 |   user_data = templatefile("${path.module}/scripts/setup.sh", {
		111 |     docker_image = var.docker_image
		112 |   })
		113 | 
		114 |   tags = {
		115 |     Name = var.project_name
		116 |   }
		117 | }

Check: CKV_AWS_79: "Ensure Instance Metadata Service Version 1 is not enabled"
	FAILED for resource: aws_instance.app_server
	File: /main.tf:98-117
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-general-31

		98  | resource "aws_instance" "app_server" {
		99  |   ami                    = data.aws_ami.ubuntu.id
		100 |   instance_type          = var.instance_type
		101 |   key_name               = aws_key_pair.deployer.key_name
		102 |   vpc_security_group_ids = [aws_security_group.web_sg.id]
		103 |   iam_instance_profile   = aws_iam_instance_profile.ec2_ssm_profile.name
		104 | 
		105 |   root_block_device {
		106 |     volume_size = 20
		107 |     volume_type = "gp3"
		108 |   }
		109 | 
		110 |   user_data = templatefile("${path.module}/scripts/setup.sh", {
		111 |     docker_image = var.docker_image
		112 |   })
		113 | 
		114 |   tags = {
		115 |     Name = var.project_name
		116 |   }
		117 | }

Check: CKV_AWS_126: "Ensure that detailed monitoring is enabled for EC2 instances"
	FAILED for resource: aws_instance.app_server
	File: /main.tf:98-117
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/ensure-that-detailed-monitoring-is-enabled-for-ec2-instances

		98  | resource "aws_instance" "app_server" {
		99  |   ami                    = data.aws_ami.ubuntu.id
		100 |   instance_type          = var.instance_type
		101 |   key_name               = aws_key_pair.deployer.key_name
		102 |   vpc_security_group_ids = [aws_security_group.web_sg.id]
		103 |   iam_instance_profile   = aws_iam_instance_profile.ec2_ssm_profile.name
		104 | 
		105 |   root_block_device {
		106 |     volume_size = 20
		107 |     volume_type = "gp3"
		108 |   }
		109 | 
		110 |   user_data = templatefile("${path.module}/scripts/setup.sh", {
		111 |     docker_image = var.docker_image
		112 |   })
		113 | 
		114 |   tags = {
		115 |     Name = var.project_name
		116 |   }
		117 | }

Check: CKV_AWS_273: "Ensure access is controlled through SSO and not AWS IAM defined users"
	FAILED for resource: aws_iam_user.github_actions_deployer
	File: /main.tf:163-169
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-273

		163 | resource "aws_iam_user" "github_actions_deployer" {
		164 |   name = "${var.project_name}-github-deployer"
		165 | 
		166 |   tags = {
		167 |     Name = "${var.project_name}-github-deployer"
		168 |   }
		169 | }

Check: CKV_AWS_40: "Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.)"
	FAILED for resource: aws_iam_user_policy.github_actions_ssm_policy
	File: /main.tf:171-208
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/iam-16-iam-policy-privileges-1

		171 | resource "aws_iam_user_policy" "github_actions_ssm_policy" {
		172 |   name = "${var.project_name}-ssm-deploy-policy"
		173 |   user = aws_iam_user.github_actions_deployer.name
		174 | 
		175 |   policy = jsonencode({
		176 |     Version = "2012-10-17"
		177 |     Statement = [
		178 |       {
		179 |         Sid    = "SSMSendCommand"
		180 |         Effect = "Allow"
		181 |         Action = [
		182 |           "ssm:SendCommand"
		183 |         ]
		184 |         Resource = [
		185 |           "arn:aws:ssm:${data.aws_region.current.name}::document/AWS-RunShellScript",
		186 |           aws_instance.app_server.arn
		187 |         ]
		188 |       },
		189 |       {
		190 |         Sid    = "SSMGetCommandStatus"
		191 |         Effect = "Allow"
		192 |         Action = [
		193 |           "ssm:GetCommandInvocation",
		194 |           "ssm:ListCommandInvocations"
		195 |         ]
		196 |         Resource = "*"
		197 |       },
		198 |       {
		199 |         Sid    = "DescribeInstances"
		200 |         Effect = "Allow"
		201 |         Action = [
		202 |           "ec2:DescribeInstances"
		203 |         ]
		204 |         Resource = "*"
		205 |       }
		206 |     ]
		207 |   })
		208 | }

Check: CKV_AWS_56: "Ensure S3 bucket has 'restrict_public_buckets' enabled"
	FAILED for resource: aws_s3_bucket_public_access_block.content
	File: /main.tf:230-237
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/bc-aws-s3-22

		230 | resource "aws_s3_bucket_public_access_block" "content" {
		231 |   bucket = aws_s3_bucket.content.id
		232 | 
		233 |   block_public_acls       = true
		234 |   block_public_policy     = false
		235 |   ignore_public_acls      = true
		236 |   restrict_public_buckets = false
		237 | }

Check: CKV_AWS_54: "Ensure S3 bucket has block public policy enabled"
	FAILED for resource: aws_s3_bucket_public_access_block.content
	File: /main.tf:230-237
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/bc-aws-s3-20

		230 | resource "aws_s3_bucket_public_access_block" "content" {
		231 |   bucket = aws_s3_bucket.content.id
		232 | 
		233 |   block_public_acls       = true
		234 |   block_public_policy     = false
		235 |   ignore_public_acls      = true
		236 |   restrict_public_buckets = false
		237 | }

Check: CKV_AWS_70: "Ensure S3 bucket does not allow an action with any Principal"
	FAILED for resource: aws_s3_bucket_policy.content_images_public
	File: /main.tf:239-255
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/bc-aws-s3-23

		239 | resource "aws_s3_bucket_policy" "content_images_public" {
		240 |   bucket     = aws_s3_bucket.content.id
		241 |   depends_on = [aws_s3_bucket_public_access_block.content]
		242 | 
		243 |   policy = jsonencode({
		244 |     Version = "2012-10-17"
		245 |     Statement = [
		246 |       {
		247 |         Sid       = "PublicReadImages"
		248 |         Effect    = "Allow"
		249 |         Principal = "*"
		250 |         Action    = "s3:GetObject"
		251 |         Resource  = "${aws_s3_bucket.content.arn}/images/*"
		252 |       }
		253 |     ]
		254 |   })
		255 | }

Check: CKV_AWS_40: "Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.)"
	FAILED for resource: aws_iam_user_policy.github_actions_s3_sync
	File: /main.tf:286-308
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/iam-16-iam-policy-privileges-1

		286 | resource "aws_iam_user_policy" "github_actions_s3_sync" {
		287 |   name = "${var.project_name}-s3-content-sync"
		288 |   user = aws_iam_user.github_actions_deployer.name
		289 | 
		290 |   policy = jsonencode({
		291 |     Version = "2012-10-17"
		292 |     Statement = [
		293 |       {
		294 |         Sid    = "S3ContentSync"
		295 |         Effect = "Allow"
		296 |         Action = [
		297 |           "s3:PutObject",
		298 |           "s3:DeleteObject",
		299 |           "s3:ListBucket"
		300 |         ]
		301 |         Resource = [
		302 |           aws_s3_bucket.content.arn,
		303 |           "${aws_s3_bucket.content.arn}/*"
		304 |         ]
		305 |       }
		306 |     ]
		307 |   })
		308 | }

Check: CKV2_AWS_62: "Ensure S3 buckets should have event notifications enabled"
	FAILED for resource: aws_s3_bucket.content
	File: /main.tf:215-221
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-2-62

		215 | resource "aws_s3_bucket" "content" {
		216 |   bucket = "${var.project_name}-content"
		217 | 
		218 |   tags = {
		219 |     Name = "${var.project_name}-content"
		220 |   }
		221 | }

Check: CKV_AWS_145: "Ensure that S3 buckets are encrypted with KMS by default"
	FAILED for resource: aws_s3_bucket.content
	File: /main.tf:215-221
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-s3-buckets-are-encrypted-with-kms-by-default

		215 | resource "aws_s3_bucket" "content" {
		216 |   bucket = "${var.project_name}-content"
		217 | 
		218 |   tags = {
		219 |     Name = "${var.project_name}-content"
		220 |   }
		221 | }

Check: CKV_AWS_18: "Ensure the S3 bucket has access logging enabled"
	FAILED for resource: aws_s3_bucket.content
	File: /main.tf:215-221
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-13-enable-logging

		215 | resource "aws_s3_bucket" "content" {
		216 |   bucket = "${var.project_name}-content"
		217 | 
		218 |   tags = {
		219 |     Name = "${var.project_name}-content"
		220 |   }
		221 | }

Check: CKV_AWS_144: "Ensure that S3 bucket has cross-region replication enabled"
	FAILED for resource: aws_s3_bucket.content
	File: /main.tf:215-221
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-s3-bucket-has-cross-region-replication-enabled

		215 | resource "aws_s3_bucket" "content" {
		216 |   bucket = "${var.project_name}-content"
		217 | 
		218 |   tags = {
		219 |     Name = "${var.project_name}-content"
		220 |   }
		221 | }

Check: CKV2_AWS_61: "Ensure that an S3 bucket has a lifecycle configuration"
	FAILED for resource: aws_s3_bucket.content
	File: /main.tf:215-221
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-2-61

		215 | resource "aws_s3_bucket" "content" {
		216 |   bucket = "${var.project_name}-content"
		217 | 
		218 |   tags = {
		219 |     Name = "${var.project_name}-content"
		220 |   }
		221 | }

Check: CKV2_AWS_6: "Ensure that S3 bucket has a Public Access block"
	FAILED for resource: aws_s3_bucket.content
	File: /main.tf:215-221
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/s3-bucket-should-have-public-access-blocks-defaults-to-false-if-the-public-access-block-is-not-attached

		215 | resource "aws_s3_bucket" "content" {
		216 |   bucket = "${var.project_name}-content"
		217 | 
		218 |   tags = {
		219 |     Name = "${var.project_name}-content"
		220 |   }
		221 | }

Sean-Michael added 3 commits October 14, 2026 12:08

Point Tides at the existing BTO repo and image

5e8b510

The dashboard lives in github.com/Sean-Michael/BTO; the compose service and README now reference it instead of a separate tides repo. The image default no longer fails compose interpolation while the tides profile is off.

Sean-Michael merged commit 8c62ec3 into main Oct 18, 2026
12 of 13 checks passed

Navigation Menu

Repository navigation

Strip the site down to a blog with an /admin writing flow; move Tides to BTO - #5

Strip the site down to a blog with an /admin writing flow; move Tides to BTO#5
Sean-Michael merged 3 commits into
mainfrom
i-want-less

Sean-Michael commented Oct 18, 2026

Uh oh!

github-actions Bot commented Oct 18, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

Sean-Michael commented Oct 18, 2026

What changed

Testing

Before merging (merging deploys)

Uh oh!

github-actions Bot commented Oct 18, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant