Exclude CKV2_AWS_67 to workaround checkov bug

Works around apparent bug in checkov bridgecrewio/checkov#6294 The KMS key rotation is not configured on the aws_s3_bucket_server_side_encryption_configuration resource so it does not make sense to check for it there. Key rotation is outside the scope of this module.
aws-samples · May 13, 2024 · 01729f7 · 01729f7
1 parent 3faedfb
commit 01729f7
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 0 deletions.
diff --git a/terraform-modules/cur-setup-destination/main.tf b/terraform-modules/cur-setup-destination/main.tf
@@ -12,6 +12,7 @@ resource "aws_s3_bucket" "this" {
 }
 
 resource "aws_s3_bucket_server_side_encryption_configuration" "this" {
+  # checkov:skip=CKV2_AWS_67:KMS Key rotation is not in scope for this module as we do not create the key
   bucket = aws_s3_bucket.this.bucket
   rule {
     apply_server_side_encryption_by_default {

diff --git a/terraform-modules/cur-setup-source/main.tf b/terraform-modules/cur-setup-source/main.tf
@@ -11,6 +11,7 @@ resource "aws_s3_bucket" "this" {
 }
 
 resource "aws_s3_bucket_server_side_encryption_configuration" "this" {
+  # checkov:skip=CKV2_AWS_67:KMS Key rotation is not in scope for this module as we do not create the key
   bucket = aws_s3_bucket.this.bucket
   rule {
     apply_server_side_encryption_by_default {