infrastructure-as-code

Description
I tried to use the state aptpkg.held as shown in the documentation, only for that state to apparently not exist.

I tried looping through state modules such as apt, pkg, and aptpkg with hold and held states, to find apt.held as the actually correct usage.

$ for major in apt pkg ap

Description

We have an air gapped environment without direct internet access. All necessary container images are mirrored to or proxied through an OnPrem registry (Artifactory). This registry uses a certificate from a private PKI. The vulnerability DB cannot be downloaded from this internal registry.

What did you expect to happen?

We expected that --insecure ignores the private PKI

Describe the bug

When creating a Lambda utilizing code from ECR, the tag_or_digest works great if the value is literally the tag or sha256: digest. This falls down when providing a CFNParameter as it's value but only when the user input is a digest, works fine with a tag still.

For example. tag_or_digest='sha256:a5ecdfb1bd870e9aa68d3921768cd2d4866be34bac3e41503f2c3c0b6db5a167' generates

Add estimation support for azurerm_iothub resources, e.g. from here: https://azure.microsoft.com/en-us/pricing/details/iot-hub/

Each SKU has a defined limit of messages per day per hub unit - so estimating this resource based solely on hub unit capacity should be sufficient - this is what the Azure pricing calculator does.

Cost details

Paid resources:

• azurerm_iothub

Describe the issue
On GCP if you apply a role via a policy that is applied none of the checks are performed. The example below should pass CKV_GCP_48 and fail CKV_GCP_44 (with my variables) but when checkov is run, no checks are run, pass or fail.

Examples\

 data "google_iam_policy" "folder" {
   binding {
     role = "roles/owner"

     members = var.a

• terrascan version: 1.9.0
• terraform version: 1.0.1

Enhancement Request

Other security scanning tools (e.g. checkov and tfsec) have a --soft-fail flag or equivalent option that allows you to always exit with 0 status.

Extremely useful when running the tool without halting a pipeline for example.

I currently use a workaround, but something more concrete would be very desira

The --prod flag has been deprecated, so we should not show that field in the output of the env show command, or in our docs:

https://aws.github.io/copilot-cli/docs/concepts/environments/
https://aws.github.io/copilot-cli/docs/commands/env-show/

Description

Add GCE support for google_project_iam_custom_role (TF)

Sources

• Terraform Resource Documentation
• GCP Resource Documentation