Feat: Dynamically using retention policy for SFTP's log group.

[nileshgadgi]

what

• Using dynamic retention policy allocation for SFTP's Cloudwatch Log group.

why

• Default value for 30 Das and static, having dependency of retention in i-sec so did dynamic changes.

[clouddrove-ci]

Terraform Security Scan Failed

Show Output

Result #1 LOW Log group is not encrypted. 
────────────────────────────────────────────────────────────────────────────────
  main.tf:46-49
────────────────────────────────────────────────────────────────────────────────
   46    resource "aws_cloudwatch_log_group" "sftp_log_group" {
   47      name              = "/aws/transfer/${module.labels.id}"
   48      retention_in_days = var.retention_in_days
   49    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-cloudwatch-log-group-customer-key
      Impact Log data may be leaked if the logs are compromised. No auditing of who have viewed the logs.
  Resolution Enable CMK encryption of CloudWatch Log Groups

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/cloudwatch/log-group-customer-key/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group#kms_key_id
────────────────────────────────────────────────────────────────────────────────


  timings
  ──────────────────────────────────────────
  disk i/o             114.285µs
  parsing              65.123344ms
  adaptation           122.279µs
  checks               4.209587ms
  total                69.569495ms

  counts
  ──────────────────────────────────────────
  modules downloaded   0
  modules processed    1
  blocks processed     46
  files read           4

  results
  ──────────────────────────────────────────
  passed               0
  ignored              0
  critical             0
  high                 0
  medium               0
  low                  1

  1 potential problem(s) detected.

[vaibhav7797]

LGTM!

[clouddrove-ci]

Terraform Security Scan Failed

Show Output

Result #1 LOW Log group is not encrypted. 
────────────────────────────────────────────────────────────────────────────────
  main.tf:46-49
────────────────────────────────────────────────────────────────────────────────
   46    resource "aws_cloudwatch_log_group" "sftp_log_group" {
   47      name              = "/aws/transfer/${module.labels.id}"
   48      retention_in_days = var.retention_in_days
   49    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-cloudwatch-log-group-customer-key
      Impact Log data may be leaked if the logs are compromised. No auditing of who have viewed the logs.
  Resolution Enable CMK encryption of CloudWatch Log Groups

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/cloudwatch/log-group-customer-key/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group#kms_key_id
────────────────────────────────────────────────────────────────────────────────


  timings
  ──────────────────────────────────────────
  disk i/o             86.951µs
  parsing              136.732242ms
  adaptation           120.524µs
  checks               3.168633ms
  total                140.10835ms

  counts
  ──────────────────────────────────────────
  modules downloaded   0
  modules processed    1
  blocks processed     46
  files read           4

  results
  ──────────────────────────────────────────
  passed               0
  ignored              0
  critical             0
  high                 0
  medium               0
  low                  1

  1 potential problem(s) detected.