Skip to content

fix: remove unused ALB egress and tune Trivy findings - #49

Open
GaryGSC wants to merge 1 commit into
mainfrom
trivy-findings
Open

GaryGSC wants to merge 1 commit into
mainfrom
trivy-findings

Conversation

@GaryGSC

@GaryGSC GaryGSC commented Oct 28, 2026

Copy link
Copy Markdown
Member

Remove outbound access from the Lambda-target ALB security group. Describe HTTP, HTTPS, and Lambda outbound rules, and ignore CMK and application-defined egress findings.

Refs: #48
Refs: byu-oit/github-action-tf-plan-analyzer#196

Remove outbound access from the Lambda-target ALB security group. Describe HTTP, HTTPS, and Lambda outbound rules, and ignore CMK and application-defined egress findings.

Refs: #48
Refs: byu-oit/github-action-tf-plan-analyzer#196
@GaryGSC
GaryGSC requested a review from a team October 28, 2026 15:29
@github-actions

Copy link
Copy Markdown

Plan for Terraform v-1.0.0:

will create 32 resources:

  • aws_alb - alb
  • aws_alb_listener - http_to_https
  • aws_alb_listener - https
  • aws_alb_target_group - tg
  • aws_alb_target_group_attachment - live_attachment
  • aws_cloudwatch_log_group - log_group
  • aws_iam_role - iam_for_lambda
  • aws_iam_role_policy_attachment - lambda_cloudwatch_attach
  • aws_iam_role_policy_attachment - lambda_eni_attach
  • aws_lambda_alias - live
  • aws_lambda_function - zip_api
  • aws_lambda_permission - with_lb
  • aws_route53_record - a_record
  • aws_route53_record - aaaa_record
  • aws_security_group - alb-sg
  • aws_security_group - lambda_sg
  • aws_alb - alb
  • aws_alb_listener - http_to_https
  • aws_alb_listener - https
  • aws_alb_target_group - tg
  • aws_alb_target_group_attachment - live_attachment
  • aws_cloudwatch_log_group - log_group
  • aws_iam_role - iam_for_lambda
  • aws_iam_role_policy_attachment - lambda_cloudwatch_attach
  • aws_iam_role_policy_attachment - lambda_eni_attach
  • aws_lambda_alias - live
  • aws_lambda_function - docker_api
  • aws_lambda_permission - with_lb
  • aws_route53_record - a_record
  • aws_route53_record - aaaa_record
  • aws_security_group - alb-sg
  • aws_security_group - lambda_sg

see details

@github-actions

Copy link
Copy Markdown

Plan for Terraform v-0.13.2:

will create 32 resources:

  • aws_alb - alb
  • aws_alb_listener - http_to_https
  • aws_alb_listener - https
  • aws_alb_target_group - tg
  • aws_alb_target_group_attachment - live_attachment
  • aws_cloudwatch_log_group - log_group
  • aws_iam_role - iam_for_lambda
  • aws_iam_role_policy_attachment - lambda_cloudwatch_attach
  • aws_iam_role_policy_attachment - lambda_eni_attach
  • aws_lambda_alias - live
  • aws_lambda_function - zip_api
  • aws_lambda_permission - with_lb
  • aws_route53_record - a_record
  • aws_route53_record - aaaa_record
  • aws_security_group - alb-sg
  • aws_security_group - lambda_sg
  • aws_alb - alb
  • aws_alb_listener - http_to_https
  • aws_alb_listener - https
  • aws_alb_target_group - tg
  • aws_alb_target_group_attachment - live_attachment
  • aws_cloudwatch_log_group - log_group
  • aws_iam_role - iam_for_lambda
  • aws_iam_role_policy_attachment - lambda_cloudwatch_attach
  • aws_iam_role_policy_attachment - lambda_eni_attach
  • aws_lambda_alias - live
  • aws_lambda_function - docker_api
  • aws_lambda_permission - with_lb
  • aws_route53_record - a_record
  • aws_route53_record - aaaa_record
  • aws_security_group - alb-sg
  • aws_security_group - lambda_sg

see details

@github-actions

Copy link
Copy Markdown

Plan for Terraform v-0.14.8:

will create 32 resources:

  • aws_alb - alb
  • aws_alb_listener - http_to_https
  • aws_alb_listener - https
  • aws_alb_target_group - tg
  • aws_alb_target_group_attachment - live_attachment
  • aws_cloudwatch_log_group - log_group
  • aws_iam_role - iam_for_lambda
  • aws_iam_role_policy_attachment - lambda_cloudwatch_attach
  • aws_iam_role_policy_attachment - lambda_eni_attach
  • aws_lambda_alias - live
  • aws_lambda_function - zip_api
  • aws_lambda_permission - with_lb
  • aws_route53_record - a_record
  • aws_route53_record - aaaa_record
  • aws_security_group - alb-sg
  • aws_security_group - lambda_sg
  • aws_alb - alb
  • aws_alb_listener - http_to_https
  • aws_alb_listener - https
  • aws_alb_target_group - tg
  • aws_alb_target_group_attachment - live_attachment
  • aws_cloudwatch_log_group - log_group
  • aws_iam_role - iam_for_lambda
  • aws_iam_role_policy_attachment - lambda_cloudwatch_attach
  • aws_iam_role_policy_attachment - lambda_eni_attach
  • aws_lambda_alias - live
  • aws_lambda_function - docker_api
  • aws_lambda_permission - with_lb
  • aws_route53_record - a_record
  • aws_route53_record - aaaa_record
  • aws_security_group - alb-sg
  • aws_security_group - lambda_sg

see details

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants