infrastructure-as-code

Terraform Version

Terraform v1.2.2
on linux_amd64
+ provider registry.terraform.io/hashicorp/aws v4.18.0
+ provider registry.terraform.io/hashicorp/random v3.3.1
+ provider registry.terraform.io/mongey/kafka v0.5.1
+ provider registry.terraform.io/scottwinkler/shell v1.7.10

Git version

git version 2.25.4

Terraform Configuration Files

1. This works, b

Description

If using the new license check feature the exit code is after every run 0, regardless of the option --exit-code 1 etc

What did you expect to happen?

The check is working in the same way like the vuln type of check, so I can define that e.g. a CRITICAL or HIGH risk license exits with exitcode 1.
That would allow to prevent the usage of risky licenses in a company e

Description
I tried to use the state aptpkg.held as shown in the documentation, only for that state to apparently not exist.

I tried looping through state modules such as apt, pkg, and aptpkg with hold and held states, to find apt.held as the actually correct usage.

$ for major in apt pkg ap

Describe the feature

When CDK automatically assumes a role (such as cdk-hnb659fds-deploy-role), currently it hard-codes the role session name to be "aws-cdk-<username>". This is not particularly useful for auditing when deployments are made via a CICD pipeline.

https://github.com/aws/aws-cdk/blob/400ad91cb926fb0a6d71039f8eba3bb63e7c8ca8/packages/aws-cdk/lib/api/aws-auth/sdk-provider.ts#L

Infracost comment is showing the "Module path" column even though it's empty.

Expected result:
If "Module path" is column is empty it should be hidden

Describe the issue
If you have more than a few failed checks, it can be difficult to scroll to the top to see the summary or in a terminal, it may even be cut off. Can we move the summary to the bottom after the policy violations?

• terrascan version: 1.9.0
• terraform version: 1.0.1

Enhancement Request

Other security scanning tools (e.g. checkov and tfsec) have a --soft-fail flag or equivalent option that allows you to always exit with 0 status.

Extremely useful when running the tool without halting a pipeline for example.

I currently use a workaround, but something more concrete would be very desira

The --prod flag has been deprecated, so we should not show that field in the output of the env show command, or in our docs:

https://aws.github.io/copilot-cli/docs/concepts/environments/
https://aws.github.io/copilot-cli/docs/commands/env-show/

Description

We discovered with @wbeuil that when creating an aws_eip resource without a eip association, refreshing the state adds a association ID to it, since an association has been cre