Repository: Dhansca/acsmarchGHA
Pull request #1: Push GHActions Tf
Author: login: Dhansca
Created: 2025-03-24T23:57:59Z | Merged: 2025-03-25T00:09:15Z



Diff:
diff --git a/.github/workflows/staging_deploy.yml b/.github/workflows/staging_deploy.yml
new file mode 100644
index 0000000..e037700
--- /dev/null
+++ b/.github/workflows/staging_deploy.yml
@@ -0,0 +1,119 @@
+name: "Terraform - Staging"
+# https://gaunacode.com/deploying-terraform-at-scale-with-github-actions
+on:
+  push:
+    branches:
+    - prod
+    paths:
+    - staging/**
+
+  pull_request:
+    branches:
+    - prod
+    paths: 
+    - staging/**
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  terraform:
+    name: "Terraform"
+    runs-on: ubuntu-latest
+    environment: staging
+    env:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      AWS_ACCESS_KEY_ID:  ${{ secrets.AWS_ACCESS_KEY_ID }}
+      AWS_SECRET_ACCESS_KEY:  ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      AWS_SESSION_TOKEN:  ${{ secrets.AWS_SESSION_TOKEN }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@v2
+        with:
+          terraform_version: 1.1.9
+          terraform_wrapper: true
+
+      - name: Terraform fmt
+        id: fmt
+        run: terraform fmt 
+        continue-on-error: true
+        working-directory: ./staging
+
+
+      - name: Terraform Init
+        id: init
+        run: terraform init
+        working-directory: ./staging
+
+           
+      - name: Terraform Validate
+        id: validate
+        run: terraform validate -no-color
+        working-directory: ./staging
+
+    
+      - name: Terraform Plan
+        id: plan
+        run: terraform plan -input=false -no-color -out tf.plan
+        working-directory: ./staging # Use your environment folder
+        continue-on-error: true
+
+      - name: Get result
+        run: echo "${{ steps.validate.outputs.stdout }}"
+      
+      - name: Terraform Show
+        id: show
+        run: terraform show -no-color tf.plan 2>&1 > /tmp/plan.txt
+        working-directory: ./staging # Use your environment folder
+          
+      - uses: actions/github-script@v6
+        if: github.event_name == 'pull_request'
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const fs = require("fs");
+            const plan = fs.readFileSync("/tmp/plan.txt", "utf8");
+            const maxGitHubBodyCharacters = 65536;
+
+            function chunkSubstr(str, size) {
+              const numChunks = Math.ceil(str.length / size)
+              const chunks = new Array(numChunks)
+              for (let i = 0, o = 0; i < numChunks; ++i, o += size) {
+                chunks[i] = str.substr(o, size)
+              }
+              return chunks
+            }
+
+            // Split the Terraform plan into chunks if it's too big and can't fit into the GitHub Action
+            var plans = chunkSubstr(plan, maxGitHubBodyCharacters); 
+            for (let i = 0; i < plans.length; i++) {
+              const output = `### ${{ inputs.plan-title }} Part # ${i + 1}
+              #### Terraform Format and Style 🖌\`${{ steps.fmt.outcome }}\`
+              #### Terraform Initialization ⚙️\`${{ steps.init.outcome }}\`
+              #### Terraform Plan 📖\`${{ steps.plan.outcome }}\`
+              <details><summary>Show Plan</summary>
+              \`\`\`\n
+              ${plans[i]}
+              \`\`\`
+              </details>
+              *Pusher: @${{ github.actor }}, Action: \`${{ github.event_name }}\`, Working Directory: \`${{ inputs.working-directory }}\`, Workflow: \`${{ github.workflow }}\`*`;   
+
+              await github.rest.issues.createComment({
+                issue_number: context.issue.number,
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                body: output
+              })
+            }
+
+      - name: Terraform Apply
+        if: github.ref == 'refs/heads/prod' && github.event_name == 'push'
+        run: terraform apply -input=false tf.plan
+        working-directory: ./staging # Use your environment folder
+        shell: bash
+        
diff --git a/.github/workflows/staging_tfsec.yml b/.github/workflows/staging_tfsec.yml
new file mode 100644
index 0000000..1b3f803
--- /dev/null
+++ b/.github/workflows/staging_tfsec.yml
@@ -0,0 +1,56 @@
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+
+name: tfsec
+
+on:
+  push:
+    branches: [ "dev", "staging"]
+    paths: 
+    - staging/**
+  pull_request:
+    branches: [ "prod" ]
+    paths: 
+    - staging/**
+
+jobs:
+  tfsec_tflint_staging:
+    name: Run tfsec sarif report
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    steps:
+      - name: Clone repo
+        uses: actions/checkout@v3
+      
+      - uses: terraform-linters/setup-tflint@v2
+        name: Setup TFLint
+        with:
+           tflint_version: v0.38.1
+           
+      - name: Show version
+        run: tflint --version
+
+      - name: Init TFLint
+        run: tflint --init
+        working-directory: ./staging
+
+      - name: Run TFLint
+        run: tflint -f compact
+        working-directory: ./staging
+
+      - name: Run tfsec
+        uses: aquasecurity/tfsec-sarif-action@9a83b5c3524f825c020e356335855741fd02745f
+        with:
+          sarif_file: tfsec.sarif
+
+      - name: Upload SARIF file
+        uses: github/codeql-action/upload-sarif@v2
+        with:
+          # Path to SARIF file relative to the root of the repository
+          sarif_file: tfsec.sarif
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..49c7248
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,2 @@
+.terraform
+.vscode
\ No newline at end of file
diff --git a/prod/main.tf b/prod/main.tf
new file mode 100644
index 0000000..fce657a
--- /dev/null
+++ b/prod/main.tf
@@ -0,0 +1,52 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "4.40.0"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = "3.4.3"
+    }
+  }
+  required_version = ">= 1.0.0"
+}
+
+provider "aws" {
+  region = "us-east-1"
+}
+
+resource "aws_instance" "GHAEC2" {
+    ami                    = "ami-0596d807260f25fc1"
+    instance_type          = "t2.micro"
+}
+
+resource "random_pet" "sg" {}
+
+data "aws_ami" "ubuntu" {
+  most_recent = true
+
+  filter {
+    name   = "name"
+    values = ["ubuntu/images/hvm-ssd/ubuntu-focal-20.04-amd64-server-*"]
+  }
+
+  filter {
+    name   = "virtualization-type"
+    values = ["hvm"]
+  }
+
+  owners = ["099720109477"] # Canonical
+}
+
+
+resource "aws_security_group" "web-sg" {
+  name = "${random_pet.sg.id}-sg"
+  ingress {
+    from_port   = 8080
+    to_port     = 8080
+    protocol    = "tcp"
+    cidr_blocks = ["1.2.3.4/32"]
+  }
+}
+
diff --git a/staging/main.tf b/staging/main.tf
new file mode 100644
index 0000000..f9be352
--- /dev/null
+++ b/staging/main.tf
@@ -0,0 +1,53 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "4.40.0"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = "3.4.3"
+    }
+  }
+  required_version = ">= 1.0.0"
+}
+
+provider "aws" {
+  region = "us-east-1"
+}
+
+resource "aws_instance" "GHAEC2" {
+    ami                    = "ami-0596d807260f25fc1"
+    instance_type          = "t2.micro"
+  }
+
+resource "random_pet" "sg" {}
+
+data "aws_ami" "ubuntu" {
+  most_recent = true
+
+  filter {
+    name   = "name"
+    values = ["ubuntu/images/hvm-ssd/ubuntu-focal-20.04-amd64-server-*"]
+  }
+
+  filter {
+    name   = "virtualization-type"
+    values = ["hvm"]
+  }
+
+  owners = ["099720109477"] # Canonical
+}
+
+
+resource "aws_security_group" "web-sg" {
+  name = "${random_pet.sg.id}-sg"
+  description = "Ingress on port 8000"
+  ingress {
+    from_port   = 8080
+    to_port     = 8080
+    protocol    = "tcp"
+    cidr_blocks = ["1.2.3.4/32"]
+  }
+}
+


Reviews:
user: login: github-advanced-security[bot]
state: COMMENTED
author_association: NONE
submitted_at: 2025-03-25T00:07:11Z

Review comments:
diff_hunk: @@ -0,0 +1,52 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "4.40.0"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = "3.4.3"
+    }
+  }
+  required_version = ">= 1.0.0"
+}
+
+provider "aws" {
+  region = "us-east-1"
+}
+
+resource "aws_instance" "GHAEC2" {
+    ami                    = "ami-0596d807260f25fc1"
+    instance_type          = "t2.micro"
+}
path: prod/main.tf
user: login: github-advanced-security[bot]
body: ## Instance with unencrypted block device.

Root block device is not encrypted.

[Show more details](https://github.com/Dhansca/acsmarchGHA/security/code-scanning/3)
created_at: 2025-03-25T00:07:10Z
author_association: NONE
diff_hunk: @@ -0,0 +1,52 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "4.40.0"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = "3.4.3"
+    }
+  }
+  required_version = ">= 1.0.0"
+}
+
+provider "aws" {
+  region = "us-east-1"
+}
+
+resource "aws_instance" "GHAEC2" {
+    ami                    = "ami-0596d807260f25fc1"
+    instance_type          = "t2.micro"
+}
path: prod/main.tf
user: login: github-advanced-security[bot]
body: ## aws_instance should activate session tokens for Instance Metadata Service.

Instance does not require IMDS access to require a token

[Show more details](https://github.com/Dhansca/acsmarchGHA/security/code-scanning/4)
created_at: 2025-03-25T00:07:10Z
author_association: NONE
diff_hunk: @@ -0,0 +1,52 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "4.40.0"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = "3.4.3"
+    }
+  }
+  required_version = ">= 1.0.0"
+}
+
+provider "aws" {
+  region = "us-east-1"
+}
+
+resource "aws_instance" "GHAEC2" {
+    ami                    = "ami-0596d807260f25fc1"
+    instance_type          = "t2.micro"
+}
+
+resource "random_pet" "sg" {}
+
+data "aws_ami" "ubuntu" {
+  most_recent = true
+
+  filter {
+    name   = "name"
+    values = ["ubuntu/images/hvm-ssd/ubuntu-focal-20.04-amd64-server-*"]
+  }
+
+  filter {
+    name   = "virtualization-type"
+    values = ["hvm"]
+  }
+
+  owners = ["099720109477"] # Canonical
+}
+
+
+resource "aws_security_group" "web-sg" {
+  name = "${random_pet.sg.id}-sg"
+  ingress {
+    from_port   = 8080
+    to_port     = 8080
+    protocol    = "tcp"
+    cidr_blocks = ["1.2.3.4/32"]
+  }
+}
path: prod/main.tf
user: login: github-advanced-security[bot]
body: ## Missing description for security group.

Security group explicitly uses the default description.

[Show more details](https://github.com/Dhansca/acsmarchGHA/security/code-scanning/1)
created_at: 2025-03-25T00:07:10Z
author_association: NONE
diff_hunk: @@ -0,0 +1,52 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "4.40.0"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = "3.4.3"
+    }
+  }
+  required_version = ">= 1.0.0"
+}
+
+provider "aws" {
+  region = "us-east-1"
+}
+
+resource "aws_instance" "GHAEC2" {
+    ami                    = "ami-0596d807260f25fc1"
+    instance_type          = "t2.micro"
+}
+
+resource "random_pet" "sg" {}
+
+data "aws_ami" "ubuntu" {
+  most_recent = true
+
+  filter {
+    name   = "name"
+    values = ["ubuntu/images/hvm-ssd/ubuntu-focal-20.04-amd64-server-*"]
+  }
+
+  filter {
+    name   = "virtualization-type"
+    values = ["hvm"]
+  }
+
+  owners = ["099720109477"] # Canonical
+}
+
+
+resource "aws_security_group" "web-sg" {
+  name = "${random_pet.sg.id}-sg"
+  ingress {
+    from_port   = 8080
+    to_port     = 8080
+    protocol    = "tcp"
+    cidr_blocks = ["1.2.3.4/32"]
+  }
path: prod/main.tf
user: login: github-advanced-security[bot]
body: ## Missing description for security group rule.

Security group rule does not have a description.

[Show more details](https://github.com/Dhansca/acsmarchGHA/security/code-scanning/2)
created_at: 2025-03-25T00:07:10Z
author_association: NONE
diff_hunk: @@ -0,0 +1,53 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "4.40.0"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = "3.4.3"
+    }
+  }
+  required_version = ">= 1.0.0"
+}
+
+provider "aws" {
+  region = "us-east-1"
+}
+
+resource "aws_instance" "GHAEC2" {
+    ami                    = "ami-0596d807260f25fc1"
+    instance_type          = "t2.micro"
+  }
path: staging/main.tf
user: login: github-advanced-security[bot]
body: ## Instance with unencrypted block device.

Root block device is not encrypted.

[Show more details](https://github.com/Dhansca/acsmarchGHA/security/code-scanning/6)
created_at: 2025-03-25T00:07:11Z
author_association: NONE
diff_hunk: @@ -0,0 +1,53 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "4.40.0"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = "3.4.3"
+    }
+  }
+  required_version = ">= 1.0.0"
+}
+
+provider "aws" {
+  region = "us-east-1"
+}
+
+resource "aws_instance" "GHAEC2" {
+    ami                    = "ami-0596d807260f25fc1"
+    instance_type          = "t2.micro"
+  }
path: staging/main.tf
user: login: github-advanced-security[bot]
body: ## aws_instance should activate session tokens for Instance Metadata Service.

Instance does not require IMDS access to require a token

[Show more details](https://github.com/Dhansca/acsmarchGHA/security/code-scanning/7)
created_at: 2025-03-25T00:07:11Z
author_association: NONE
diff_hunk: @@ -0,0 +1,53 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "4.40.0"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = "3.4.3"
+    }
+  }
+  required_version = ">= 1.0.0"
+}
+
+provider "aws" {
+  region = "us-east-1"
+}
+
+resource "aws_instance" "GHAEC2" {
+    ami                    = "ami-0596d807260f25fc1"
+    instance_type          = "t2.micro"
+  }
+
+resource "random_pet" "sg" {}
+
+data "aws_ami" "ubuntu" {
+  most_recent = true
+
+  filter {
+    name   = "name"
+    values = ["ubuntu/images/hvm-ssd/ubuntu-focal-20.04-amd64-server-*"]
+  }
+
+  filter {
+    name   = "virtualization-type"
+    values = ["hvm"]
+  }
+
+  owners = ["099720109477"] # Canonical
+}
+
+
+resource "aws_security_group" "web-sg" {
+  name = "${random_pet.sg.id}-sg"
+  description = "Ingress on port 8000"
+  ingress {
+    from_port   = 8080
+    to_port     = 8080
+    protocol    = "tcp"
+    cidr_blocks = ["1.2.3.4/32"]
+  }
path: staging/main.tf
user: login: github-advanced-security[bot]
body: ## Missing description for security group rule.

Security group rule does not have a description.

[Show more details](https://github.com/Dhansca/acsmarchGHA/security/code-scanning/5)
created_at: 2025-03-25T00:07:11Z
author_association: NONE

PR comments:
user: login: github-actions[bot]
created_at: 2025-03-25T00:06:37Z
body: ###  Part # 1
  #### Terraform Format and Style 🖌`success`
  #### Terraform Initialization ⚙️`success`
  #### Terraform Plan 📖`success`
  <details><summary>Show Plan</summary>
  ```

  [command]/home/runner/work/_temp/80f87e7f-2b09-48f2-b26e-1248a41d9ae9/terraform-bin show -no-color tf.plan

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # aws_instance.GHAEC2 will be created
  + resource "aws_instance" "GHAEC2" {
      + ami                                  = "ami-0596d807260f25fc1"
      + arn                                  = (known after apply)
      + associate_public_ip_address          = (known after apply)
      + availability_zone                    = (known after apply)
      + cpu_core_count                       = (known after apply)
      + cpu_threads_per_core                 = (known after apply)
      + disable_api_stop                     = (known after apply)
      + disable_api_termination              = (known after apply)
      + ebs_optimized                        = (known after apply)
      + get_password_data                    = false
      + host_id                              = (known after apply)
      + host_resource_group_arn              = (known after apply)
      + id                                   = (known after apply)
      + instance_initiated_shutdown_behavior = (known after apply)
      + instance_state                       = (known after apply)
      + instance_type                        = "t2.micro"
      + ipv6_address_count                   = (known after apply)
      + ipv6_addresses                       = (known after apply)
      + key_name                             = (known after apply)
      + monitoring                           = (known after apply)
      + outpost_arn                          = (known after apply)
      + password_data                        = (known after apply)
      + placement_group                      = (known after apply)
      + placement_partition_number           = (known after apply)
      + primary_network_interface_id         = (known after apply)
      + private_dns                          = (known after apply)
      + private_ip                           = (known after apply)
      + public_dns                           = (known after apply)
      + public_ip                            = (known after apply)
      + secondary_private_ips                = (known after apply)
      + security_groups                      = (known after apply)
      + source_dest_check                    = true
      + subnet_id                            = (known after apply)
      + tags_all                             = (known after apply)
      + tenancy                              = (known after apply)
      + user_data                            = (known after apply)
      + user_data_base64                     = (known after apply)
      + user_data_replace_on_change          = false
      + vpc_security_group_ids               = (known after apply)

      + capacity_reservation_specification {
          + capacity_reservation_preference = (known after apply)

          + capacity_reservation_target {
              + capacity_reservation_id                 = (known after apply)
              + capacity_reservation_resource_group_arn = (known after apply)
            }
        }

      + ebs_block_device {
          + delete_on_termination = (known after apply)
          + device_name           = (known after apply)
          + encrypted             = (known after apply)
          + iops                  = (known after apply)
          + kms_key_id            = (known after apply)
          + snapshot_id           = (known after apply)
          + tags                  = (known after apply)
          + throughput            = (known after apply)
          + volume_id             = (known after apply)
          + volume_size           = (known after apply)
          + volume_type           = (known after apply)
        }

      + enclave_options {
          + enabled = (known after apply)
        }

      + ephemeral_block_device {
          + device_name  = (known after apply)
          + no_device    = (known after apply)
          + virtual_name = (known after apply)
        }

      + maintenance_options {
          + auto_recovery = (known after apply)
        }

      + metadata_options {
          + http_endpoint               = (known after apply)
          + http_put_response_hop_limit = (known after apply)
          + http_tokens                 = (known after apply)
          + instance_metadata_tags      = (known after apply)
        }

      + network_interface {
          + delete_on_termination = (known after apply)
          + device_index          = (known after apply)
          + network_card_index    = (known after apply)
          + network_interface_id  = (known after apply)
        }

      + private_dns_name_options {
          + enable_resource_name_dns_a_record    = (known after apply)
          + enable_resource_name_dns_aaaa_record = (known after apply)
          + hostname_type                        = (known after apply)
        }

      + root_block_device {
          + delete_on_termination = (known after apply)
          + device_name           = (known after apply)
          + encrypted             = (known after apply)
          + iops                  = (known after apply)
          + kms_key_id            = (known after apply)
          + tags                  = (known after apply)
          + throughput            = (known after apply)
          + volume_id             = (known after apply)
          + volume_size           = (known after apply)
          + volume_type           = (known after apply)
        }
    }

  # aws_security_group.web-sg will be created
  + resource "aws_security_group" "web-sg" {
      + arn                    = (known after apply)
      + description            = "Ingress on port 8000"
      + egress                 = (known after apply)
      + id                     = (known after apply)
      + ingress                = [
          + {
              + cidr_blocks      = [
                  + "1.2.3.4/32",
                ]
              + description      = ""
              + from_port        = 8080
              + ipv6_cidr_blocks = []
              + prefix_list_ids  = []
              + protocol         = "tcp"
              + security_groups  = []
              + self             = false
              + to_port          = 8080
            },
        ]
      + name                   = (known after apply)
      + name_prefix            = (known after apply)
      + owner_id               = (known after apply)
      + revoke_rules_on_delete = false
      + tags_all               = (known after apply)
      + vpc_id                 = (known after apply)
    }

  # random_pet.sg will be created
  + resource "random_pet" "sg" {
      + id        = (known after apply)
      + length    = 2
      + separator = "-"
    }

Plan: 3 to add, 0 to change, 0 to destroy.
::debug::Terraform exited with code 0.
::debug::stdout: %0ATerraform used the selected providers to generate the following execution%0Aplan. Resource actions are indicated with the following symbols:%0A  + create%0A%0ATerraform will perform the following actions:%0A%0A  # aws_instance.GHAEC2 will be created%0A  + resource "aws_instance" "GHAEC2" {%0A      + ami                                  = "ami-0596d807260f25fc1"%0A      + arn                                  = (known after apply)%0A      + associate_public_ip_address          = (known after apply)%0A      + availability_zone                    = (known after apply)%0A      + cpu_core_count                       = (known after apply)%0A      + cpu_threads_per_core                 = (known after apply)%0A      + disable_api_stop                     = (known after apply)%0A      + disable_api_termination              = (known after apply)%0A      + ebs_optimized                        = (known after apply)%0A      + get_password_data                    = false%0A      + host_id                              = (known after apply)%0A      + host_resource_group_arn              = (known after apply)%0A      + id                                   = (known after apply)%0A      + instance_initiated_shutdown_behavior = (known after apply)%0A      + instance_state                       = (known after apply)%0A      + instance_type                        = "t2.micro"%0A      + ipv6_address_count                   = (known after apply)%0A      + ipv6_addresses                       = (known after apply)%0A      + key_name                             = (known after apply)%0A      + monitoring                           = (known after apply)%0A      + outpost_arn                          = (known after apply)%0A      + password_data                        = (known after apply)%0A      + placement_group                      = (known after apply)%0A      + placement_partition_number           = (known after apply)%0A      + primary_network_interface_id         = (known after apply)%0A      + private_dns                          = (known after apply)%0A      + private_ip                           = (known after apply)%0A      + public_dns                           = (known after apply)%0A      + public_ip                            = (known after apply)%0A      + secondary_private_ips                = (known after apply)%0A      + security_groups                      = (known after apply)%0A      + source_dest_check                    = true%0A      + subnet_id                            = (known after apply)%0A      + tags_all                             = (known after apply)%0A      + tenancy                              = (known after apply)%0A      + user_data                            = (known after apply)%0A      + user_data_base64                     = (known after apply)%0A      + user_data_replace_on_change          = false%0A      + vpc_security_group_ids               = (known after apply)%0A%0A      + capacity_reservation_specification {%0A          + capacity_reservation_preference = (known after apply)%0A%0A          + capacity_reservation_target {%0A              + capacity_reservation_id                 = (known after apply)%0A              + capacity_reservation_resource_group_arn = (known after apply)%0A            }%0A        }%0A%0A      + ebs_block_device {%0A          + delete_on_termination = (known after apply)%0A          + device_name           = (known after apply)%0A          + encrypted             = (known after apply)%0A          + iops                  = (known after apply)%0A          + kms_key_id            = (known after apply)%0A          + snapshot_id           = (known after apply)%0A          + tags                  = (known after apply)%0A          + throughput            = (known after apply)%0A          + volume_id             = (known after apply)%0A          + volume_size           = (known after apply)%0A          + volume_type           = (known after apply)%0A        }%0A%0A      + enclave_options {%0A          + enabled = (known after apply)%0A        }%0A%0A      + ephemeral_block_device {%0A          + device_name  = (known after apply)%0A          + no_device    = (known after apply)%0A          + virtual_name = (known after apply)%0A        }%0A%0A      + maintenance_options {%0A          + auto_recovery = (known after apply)%0A        }%0A%0A      + metadata_options {%0A          + http_endpoint               = (known after apply)%0A          + http_put_response_hop_limit = (known after apply)%0A          + http_tokens                 = (known after apply)%0A          + instance_metadata_tags      = (known after apply)%0A        }%0A%0A      + network_interface {%0A          + delete_on_termination = (known after apply)%0A          + device_index          = (known after apply)%0A          + network_card_index    = (known after apply)%0A          + network_interface_id  = (known after apply)%0A        }%0A%0A      + private_dns_name_options {%0A          + enable_resource_name_dns_a_record    = (known after apply)%0A          + enable_resource_name_dns_aaaa_record = (known after apply)%0A          + hostname_type                        = (known after apply)%0A        }%0A%0A      + root_block_device {%0A          + delete_on_termination = (known after apply)%0A          + device_name           = (known after apply)%0A          + encrypted             = (known after apply)%0A          + iops                  = (known after apply)%0A          + kms_key_id            = (known after apply)%0A          + tags                  = (known after apply)%0A          + throughput            = (known after apply)%0A          + volume_id             = (known after apply)%0A          + volume_size           = (known after apply)%0A          + volume_type           = (known after apply)%0A        }%0A    }%0A%0A  # aws_security_group.web-sg will be created%0A  + resource "aws_security_group" "web-sg" {%0A      + arn                    = (known after apply)%0A      + description            = "Ingress on port 8000"%0A      + egress                 = (known after apply)%0A      + id                     = (known after apply)%0A      + ingress                = [%0A          + {%0A              + cidr_blocks      = [%0A                  + "1.2.3.4/32",%0A                ]%0A              + description      = ""%0A              + from_port        = 8080%0A              + ipv6_cidr_blocks = []%0A              + prefix_list_ids  = []%0A              + protocol         = "tcp"%0A              + security_groups  = []%0A              + self             = false%0A              + to_port          = 8080%0A            },%0A        ]%0A      + name                   = (known after apply)%0A      + name_prefix            = (known after apply)%0A      + owner_id               = (known after apply)%0A      + revoke_rules_on_delete = false%0A      + tags_all               = (known after apply)%0A      + vpc_id                 = (known after apply)%0A    }%0A%0A  # random_pet.sg will be created%0A  + resource "random_pet" "sg" {%0A      + id        = (known after apply)%0A      + length    = 2%0A      + separator = "-"%0A    }%0A%0APlan: 3 to add, 0 to change, 0 to destroy.%0A
::debug::stderr: 
::debug::exitcode: 0

  ```
  </details>
  *Pusher: @Dhansca, Action: `pull_request`, Working Directory: ``, Workflow: `Terraform - Staging`*
author_association: NONE
user: login: github-actions[bot]
created_at: 2025-03-25T00:07:02Z
body: ###  Part # 1
  #### Terraform Format and Style 🖌`success`
  #### Terraform Initialization ⚙️`success`
  #### Terraform Plan 📖`success`
  <details><summary>Show Plan</summary>
  ```

  [command]/home/runner/work/_temp/c00c3190-4c93-41ac-8c2b-17277a9e7c98/terraform-bin show -no-color tf.plan

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # aws_instance.GHAEC2 will be created
  + resource "aws_instance" "GHAEC2" {
      + ami                                  = "ami-0596d807260f25fc1"
      + arn                                  = (known after apply)
      + associate_public_ip_address          = (known after apply)
      + availability_zone                    = (known after apply)
      + cpu_core_count                       = (known after apply)
      + cpu_threads_per_core                 = (known after apply)
      + disable_api_stop                     = (known after apply)
      + disable_api_termination              = (known after apply)
      + ebs_optimized                        = (known after apply)
      + get_password_data                    = false
      + host_id                              = (known after apply)
      + host_resource_group_arn              = (known after apply)
      + id                                   = (known after apply)
      + instance_initiated_shutdown_behavior = (known after apply)
      + instance_state                       = (known after apply)
      + instance_type                        = "t2.micro"
      + ipv6_address_count                   = (known after apply)
      + ipv6_addresses                       = (known after apply)
      + key_name                             = (known after apply)
      + monitoring                           = (known after apply)
      + outpost_arn                          = (known after apply)
      + password_data                        = (known after apply)
      + placement_group                      = (known after apply)
      + placement_partition_number           = (known after apply)
      + primary_network_interface_id         = (known after apply)
      + private_dns                          = (known after apply)
      + private_ip                           = (known after apply)
      + public_dns                           = (known after apply)
      + public_ip                            = (known after apply)
      + secondary_private_ips                = (known after apply)
      + security_groups                      = (known after apply)
      + source_dest_check                    = true
      + subnet_id                            = (known after apply)
      + tags_all                             = (known after apply)
      + tenancy                              = (known after apply)
      + user_data                            = (known after apply)
      + user_data_base64                     = (known after apply)
      + user_data_replace_on_change          = false
      + vpc_security_group_ids               = (known after apply)

      + capacity_reservation_specification {
          + capacity_reservation_preference = (known after apply)

          + capacity_reservation_target {
              + capacity_reservation_id                 = (known after apply)
              + capacity_reservation_resource_group_arn = (known after apply)
            }
        }

      + ebs_block_device {
          + delete_on_termination = (known after apply)
          + device_name           = (known after apply)
          + encrypted             = (known after apply)
          + iops                  = (known after apply)
          + kms_key_id            = (known after apply)
          + snapshot_id           = (known after apply)
          + tags                  = (known after apply)
          + throughput            = (known after apply)
          + volume_id             = (known after apply)
          + volume_size           = (known after apply)
          + volume_type           = (known after apply)
        }

      + enclave_options {
          + enabled = (known after apply)
        }

      + ephemeral_block_device {
          + device_name  = (known after apply)
          + no_device    = (known after apply)
          + virtual_name = (known after apply)
        }

      + maintenance_options {
          + auto_recovery = (known after apply)
        }

      + metadata_options {
          + http_endpoint               = (known after apply)
          + http_put_response_hop_limit = (known after apply)
          + http_tokens                 = (known after apply)
          + instance_metadata_tags      = (known after apply)
        }

      + network_interface {
          + delete_on_termination = (known after apply)
          + device_index          = (known after apply)
          + network_card_index    = (known after apply)
          + network_interface_id  = (known after apply)
        }

      + private_dns_name_options {
          + enable_resource_name_dns_a_record    = (known after apply)
          + enable_resource_name_dns_aaaa_record = (known after apply)
          + hostname_type                        = (known after apply)
        }

      + root_block_device {
          + delete_on_termination = (known after apply)
          + device_name           = (known after apply)
          + encrypted             = (known after apply)
          + iops                  = (known after apply)
          + kms_key_id            = (known after apply)
          + tags                  = (known after apply)
          + throughput            = (known after apply)
          + volume_id             = (known after apply)
          + volume_size           = (known after apply)
          + volume_type           = (known after apply)
        }
    }

  # aws_security_group.web-sg will be created
  + resource "aws_security_group" "web-sg" {
      + arn                    = (known after apply)
      + description            = "Ingress on port 8000"
      + egress                 = (known after apply)
      + id                     = (known after apply)
      + ingress                = [
          + {
              + cidr_blocks      = [
                  + "1.2.3.4/32",
                ]
              + description      = ""
              + from_port        = 8080
              + ipv6_cidr_blocks = []
              + prefix_list_ids  = []
              + protocol         = "tcp"
              + security_groups  = []
              + self             = false
              + to_port          = 8080
            },
        ]
      + name                   = (known after apply)
      + name_prefix            = (known after apply)
      + owner_id               = (known after apply)
      + revoke_rules_on_delete = false
      + tags_all               = (known after apply)
      + vpc_id                 = (known after apply)
    }

  # random_pet.sg will be created
  + resource "random_pet" "sg" {
      + id        = (known after apply)
      + length    = 2
      + separator = "-"
    }

Plan: 3 to add, 0 to change, 0 to destroy.
::debug::Terraform exited with code 0.
::debug::stdout: %0ATerraform used the selected providers to generate the following execution%0Aplan. Resource actions are indicated with the following symbols:%0A  + create%0A%0ATerraform will perform the following actions:%0A%0A  # aws_instance.GHAEC2 will be created%0A  + resource "aws_instance" "GHAEC2" {%0A      + ami                                  = "ami-0596d807260f25fc1"%0A      + arn                                  = (known after apply)%0A      + associate_public_ip_address          = (known after apply)%0A      + availability_zone                    = (known after apply)%0A      + cpu_core_count                       = (known after apply)%0A      + cpu_threads_per_core                 = (known after apply)%0A      + disable_api_stop                     = (known after apply)%0A      + disable_api_termination              = (known after apply)%0A      + ebs_optimized                        = (known after apply)%0A      + get_password_data                    = false%0A      + host_id                              = (known after apply)%0A      + host_resource_group_arn              = (known after apply)%0A      + id                                   = (known after apply)%0A      + instance_initiated_shutdown_behavior = (known after apply)%0A      + instance_state                       = (known after apply)%0A      + instance_type                        = "t2.micro"%0A      + ipv6_address_count                   = (known after apply)%0A      + ipv6_addresses                       = (known after apply)%0A      + key_name                             = (known after apply)%0A      + monitoring                           = (known after apply)%0A      + outpost_arn                          = (known after apply)%0A      + password_data                        = (known after apply)%0A      + placement_group                      = (known after apply)%0A      + placement_partition_number           = (known after apply)%0A      + primary_network_interface_id         = (known after apply)%0A      + private_dns                          = (known after apply)%0A      + private_ip                           = (known after apply)%0A      + public_dns                           = (known after apply)%0A      + public_ip                            = (known after apply)%0A      + secondary_private_ips                = (known after apply)%0A      + security_groups                      = (known after apply)%0A      + source_dest_check                    = true%0A      + subnet_id                            = (known after apply)%0A      + tags_all                             = (known after apply)%0A      + tenancy                              = (known after apply)%0A      + user_data                            = (known after apply)%0A      + user_data_base64                     = (known after apply)%0A      + user_data_replace_on_change          = false%0A      + vpc_security_group_ids               = (known after apply)%0A%0A      + capacity_reservation_specification {%0A          + capacity_reservation_preference = (known after apply)%0A%0A          + capacity_reservation_target {%0A              + capacity_reservation_id                 = (known after apply)%0A              + capacity_reservation_resource_group_arn = (known after apply)%0A            }%0A        }%0A%0A      + ebs_block_device {%0A          + delete_on_termination = (known after apply)%0A          + device_name           = (known after apply)%0A          + encrypted             = (known after apply)%0A          + iops                  = (known after apply)%0A          + kms_key_id            = (known after apply)%0A          + snapshot_id           = (known after apply)%0A          + tags                  = (known after apply)%0A          + throughput            = (known after apply)%0A          + volume_id             = (known after apply)%0A          + volume_size           = (known after apply)%0A          + volume_type           = (known after apply)%0A        }%0A%0A      + enclave_options {%0A          + enabled = (known after apply)%0A        }%0A%0A      + ephemeral_block_device {%0A          + device_name  = (known after apply)%0A          + no_device    = (known after apply)%0A          + virtual_name = (known after apply)%0A        }%0A%0A      + maintenance_options {%0A          + auto_recovery = (known after apply)%0A        }%0A%0A      + metadata_options {%0A          + http_endpoint               = (known after apply)%0A          + http_put_response_hop_limit = (known after apply)%0A          + http_tokens                 = (known after apply)%0A          + instance_metadata_tags      = (known after apply)%0A        }%0A%0A      + network_interface {%0A          + delete_on_termination = (known after apply)%0A          + device_index          = (known after apply)%0A          + network_card_index    = (known after apply)%0A          + network_interface_id  = (known after apply)%0A        }%0A%0A      + private_dns_name_options {%0A          + enable_resource_name_dns_a_record    = (known after apply)%0A          + enable_resource_name_dns_aaaa_record = (known after apply)%0A          + hostname_type                        = (known after apply)%0A        }%0A%0A      + root_block_device {%0A          + delete_on_termination = (known after apply)%0A          + device_name           = (known after apply)%0A          + encrypted             = (known after apply)%0A          + iops                  = (known after apply)%0A          + kms_key_id            = (known after apply)%0A          + tags                  = (known after apply)%0A          + throughput            = (known after apply)%0A          + volume_id             = (known after apply)%0A          + volume_size           = (known after apply)%0A          + volume_type           = (known after apply)%0A        }%0A    }%0A%0A  # aws_security_group.web-sg will be created%0A  + resource "aws_security_group" "web-sg" {%0A      + arn                    = (known after apply)%0A      + description            = "Ingress on port 8000"%0A      + egress                 = (known after apply)%0A      + id                     = (known after apply)%0A      + ingress                = [%0A          + {%0A              + cidr_blocks      = [%0A                  + "1.2.3.4/32",%0A                ]%0A              + description      = ""%0A              + from_port        = 8080%0A              + ipv6_cidr_blocks = []%0A              + prefix_list_ids  = []%0A              + protocol         = "tcp"%0A              + security_groups  = []%0A              + self             = false%0A              + to_port          = 8080%0A            },%0A        ]%0A      + name                   = (known after apply)%0A      + name_prefix            = (known after apply)%0A      + owner_id               = (known after apply)%0A      + revoke_rules_on_delete = false%0A      + tags_all               = (known after apply)%0A      + vpc_id                 = (known after apply)%0A    }%0A%0A  # random_pet.sg will be created%0A  + resource "random_pet" "sg" {%0A      + id        = (known after apply)%0A      + length    = 2%0A      + separator = "-"%0A    }%0A%0APlan: 3 to add, 0 to change, 0 to destroy.%0A
::debug::stderr: 
::debug::exitcode: 0

  ```
  </details>
  *Pusher: @Dhansca, Action: `pull_request`, Working Directory: ``, Workflow: `Terraform - Staging`*
author_association: NONE
user: login: github-advanced-security[bot]
created_at: 2025-03-25T00:07:09Z
body: This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on [this overview](/Dhansca/acsmarchGHA/security/code-scanning?query=pr%3A1+is%3Aopen). Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out [the documentation](https://docs.github.com/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning). 
author_association: NONE