CP3 Vended logs for Auto Mode by tom-j-smith · Pull Request #18720 · ministryofjustice/modernisation-platform-environments

Tom Smith (tom-j-smith) · 2026-09-01T16:17:23Z

Done as a part of #8430
This PR enables the creation of vended logs for CP3 clusters.
This will create the following log groups:

AUTO_MODE_COMPUTE_LOGS - for Karpenter
AUTO_MODE_BLOCK_STORAGE_LOGS - for EBS CSI
AUTO_MODE_LOAD_BALANCING_LOGS - for AWS Load Balancer Controller
AUTO_MODE_IPAM_LOGS - for VPC CNI IP address management

This has been tested on CP3 test cluster builds.

…e-vended-logs

…s-build

github-actions · 2026-09-01T16:19:18Z

`Checkov Scan` Failed

Show Output

*****************************

Checkov will check the following folders:
terraform/environments/cloud-platform/cluster

*****************************

Running Checkov in terraform/environments/cloud-platform/cluster
terraform scan results:

Passed checks: 42, Failed checks: 11, Skipped checks: 1

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.auto_mode["AUTO_MODE_BLOCK_STORAGE_LOGS"]
	File: /eks-cluster.tf:117-124
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		117 | resource "aws_cloudwatch_log_group" "auto_mode" {
		118 |   for_each = local.auto_mode_log_types
		119 |
		120 |   name              = "/aws/vendedlogs/eks/cluster/${each.key}/${local.cluster_name}"
		121 |   retention_in_days = 30
		122 |
		123 |   tags = merge(local.tags, { Name = "/aws/vendedlogs/eks/cluster/${each.key}/${local.cluster_name}" })
		124 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.auto_mode["AUTO_MODE_BLOCK_STORAGE_LOGS"]
	File: /eks-cluster.tf:117-124
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		117 | resource "aws_cloudwatch_log_group" "auto_mode" {
		118 |   for_each = local.auto_mode_log_types
		119 |
		120 |   name              = "/aws/vendedlogs/eks/cluster/${each.key}/${local.cluster_name}"
		121 |   retention_in_days = 30
		122 |
		123 |   tags = merge(local.tags, { Name = "/aws/vendedlogs/eks/cluster/${each.key}/${local.cluster_name}" })
		124 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.auto_mode["AUTO_MODE_COMPUTE_LOGS"]
	File: /eks-cluster.tf:117-124
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		117 | resource "aws_cloudwatch_log_group" "auto_mode" {
		118 |   for_each = local.auto_mode_log_types
		119 |
		120 |   name              = "/aws/vendedlogs/eks/cluster/${each.key}/${local.cluster_name}"
		121 |   retention_in_days = 30
		122 |
		123 |   tags = merge(local.tags, { Name = "/aws/vendedlogs/eks/cluster/${each.key}/${local.cluster_name}" })
		124 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.auto_mode["AUTO_MODE_COMPUTE_LOGS"]
	File: /eks-cluster.tf:117-124
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		117 | resource "aws_cloudwatch_log_group" "auto_mode" {
		118 |   for_each = local.auto_mode_log_types
		119 |
		120 |   name              = "/aws/vendedlogs/eks/cluster/${each.key}/${local.cluster_name}"
		121 |   retention_in_days = 30
		122 |
		123 |   tags = merge(local.tags, { Name = "/aws/vendedlogs/eks/cluster/${each.key}/${local.cluster_name}" })
		124 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.auto_mode["AUTO_MODE_IPAM_LOGS"]
	File: /eks-cluster.tf:117-124
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		117 | resource "aws_cloudwatch_log_group" "auto_mode" {
		118 |   for_each = local.auto_mode_log_types
		119 |
		120 |   name              = "/aws/vendedlogs/eks/cluster/${each.key}/${local.cluster_name}"
		121 |   retention_in_days = 30
		122 |
		123 |   tags = merge(local.tags, { Name = "/aws/vendedlogs/eks/cluster/${each.key}/${local.cluster_name}" })
		124 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.auto_mode["AUTO_MODE_IPAM_LOGS"]
	File: /eks-cluster.tf:117-124
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		117 | resource "aws_cloudwatch_log_group" "auto_mode" {
		118 |   for_each = local.auto_mode_log_types
		119 |
		120 |   name              = "/aws/vendedlogs/eks/cluster/${each.key}/${local.cluster_name}"
		121 |   retention_in_days = 30
		122 |
		123 |   tags = merge(local.tags, { Name = "/aws/vendedlogs/eks/cluster/${each.key}/${local.cluster_name}" })
		124 | }

Check: CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
	FAILED for resource: aws_cloudwatch_log_group.auto_mode["AUTO_MODE_LOAD_BALANCING_LOGS"]
	File: /eks-cluster.tf:117-124
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-cloudwatch-log-group-is-encrypted-by-kms

		117 | resource "aws_cloudwatch_log_group" "auto_mode" {
		118 |   for_each = local.auto_mode_log_types
		119 |
		120 |   name              = "/aws/vendedlogs/eks/cluster/${each.key}/${local.cluster_name}"
		121 |   retention_in_days = 30
		122 |
		123 |   tags = merge(local.tags, { Name = "/aws/vendedlogs/eks/cluster/${each.key}/${local.cluster_name}" })
		124 | }

Check: CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
	FAILED for resource: aws_cloudwatch_log_group.auto_mode["AUTO_MODE_LOAD_BALANCING_LOGS"]
	File: /eks-cluster.tf:117-124
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-338

		117 | resource "aws_cloudwatch_log_group" "auto_mode" {
		118 |   for_each = local.auto_mode_log_types
		119 |
		120 |   name              = "/aws/vendedlogs/eks/cluster/${each.key}/${local.cluster_name}"
		121 |   retention_in_days = 30
		122 |
		123 |   tags = merge(local.tags, { Name = "/aws/vendedlogs/eks/cluster/${each.key}/${local.cluster_name}" })
		124 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: eks
	File: /eks-cluster.tf:1-96
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		Code lines for this resource are too many. Please use IDE of your choice to review the file.
Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: aws_vpc_cni_pod_identity
	File: /eks-pod-identities.tf:1-20
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		1  | module "aws_vpc_cni_pod_identity" {
		2  |
		3  |   source  = "terraform-aws-modules/eks-pod-identity/aws"
		4  |   version = "2.5.0"
		5  |
		6  |   name = "aws-vpc-cni"
		7  |
		8  |   attach_aws_vpc_cni_policy = true
		9  |   aws_vpc_cni_enable_ipv4   = true
		10 |
		11 |   associations = {
		12 |     this = {
		13 |       cluster_name    = module.eks.cluster_name
		14 |       namespace       = "kube-system"
		15 |       service_account = "aws-node"
		16 |     }
		17 |   }
		18 |
		19 |   tags = local.tags
		20 | }

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: aws_ebs_csi_pod_identity
	File: /eks-pod-identities.tf:22-41
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		22 | module "aws_ebs_csi_pod_identity" {
		23 |
		24 |   source  = "terraform-aws-modules/eks-pod-identity/aws"
		25 |   version = "2.5.0"
		26 |
		27 |   name = "aws-ebs-csi"
		28 |
		29 |   attach_aws_ebs_csi_policy = true
		30 |   # aws_ebs_csi_kms_arns      = ["arn:aws:kms:*:*:key/1234abcd-12ab-34cd-56ef-1234567890ab"]
		31 |
		32 |   associations = {
		33 |     this = {
		34 |       cluster_name    = module.eks.cluster_name
		35 |       namespace       = "kube-system"
		36 |       service_account = "ebs-csi-controller-sa"
		37 |     }
		38 |   }
		39 |
		40 |   tags = local.tags
		41 | }

kubernetes scan results:

Passed checks: 70, Failed checks: 19, Skipped checks: 0

Check: CKV_K8S_40: "Containers should run as a high UID to avoid host conflict"
	FAILED for resource: Deployment.default.inflate
	File: /inflate.yaml:1-21
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bc-k8s-37

		1  | apiVersion: apps/v1
		2  | kind: Deployment
		3  | metadata:
		4  |   name: inflate
		5  | spec:
		6  |   replicas: 5
		7  |   selector:
		8  |     matchLabels:
		9  |       app: inflate
		10 |   template:
		11 |     metadata:
		12 |       labels:
		13 |         app: inflate
		14 |     spec:
		15 |       terminationGracePeriodSeconds: 0
		16 |       containers:
		17 |         - name: inflate
		18 |           image: public.ecr.aws/eks-distro/kubernetes/pause:3.7
		19 |           resources:
		20 |             requests:
		21 |               cpu: 1
Check: CKV_K8S_31: "Ensure that the seccomp profile is set to docker/default or runtime/default"
	FAILED for resource: Deployment.default.inflate
	File: /inflate.yaml:1-21
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bc-k8s-29

		1  | apiVersion: apps/v1
		2  | kind: Deployment
		3  | metadata:
		4  |   name: inflate
		5  | spec:
		6  |   replicas: 5
		7  |   selector:
		8  |     matchLabels:
		9  |       app: inflate
		10 |   template:
		11 |     metadata:
		12 |       labels:
		13 |         app: inflate
		14 |     spec:
		15 |       terminationGracePeriodSeconds: 0
		16 |       containers:
		17 |         - name: inflate
		18 |           image: public.ecr.aws/eks-distro/kubernetes/pause:3.7
		19 |           resources:
		20 |             requests:
		21 |               cpu: 1
Check: CKV_K8S_8: "Liveness Probe Should be Configured"
	FAILED for resource: Deployment.default.inflate
	File: /inflate.yaml:1-21
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bc-k8s-7

		1  | apiVersion: apps/v1
		2  | kind: Deployment
		3  | metadata:
		4  |   name: inflate
		5  | spec:
		6  |   replicas: 5
		7  |   selector:
		8  |     matchLabels:
		9  |       app: inflate
		10 |   template:
		11 |     metadata:
		12 |       labels:
		13 |         app: inflate
		14 |     spec:
		15 |       terminationGracePeriodSeconds: 0
		16 |       containers:
		17 |         - name: inflate
		18 |           image: public.ecr.aws/eks-distro/kubernetes/pause:3.7
		19 |           resources:
		20 |             requests:
		21 |               cpu: 1
Check: CKV_K8S_38: "Ensure that Service Account Tokens are only mounted where necessary"
	FAILED for resource: Deployment.default.inflate
	File: /inflate.yaml:1-21
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bc-k8s-35

		1  | apiVersion: apps/v1
		2  | kind: Deployment
		3  | metadata:
		4  |   name: inflate
		5  | spec:
		6  |   replicas: 5
		7  |   selector:
		8  |     matchLabels:
		9  |       app: inflate
		10 |   template:
		11 |     metadata:
		12 |       labels:
		13 |         app: inflate
		14 |     spec:
		15 |       terminationGracePeriodSeconds: 0
		16 |       containers:
		17 |         - name: inflate
		18 |           image: public.ecr.aws/eks-distro/kubernetes/pause:3.7
		19 |           resources:
		20 |             requests:
		21 |               cpu: 1
Check: CKV_K8S_13: "Memory limits should be set"
	FAILED for resource: Deployment.default.inflate
	File: /inflate.yaml:1-21
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bc-k8s-12

		1  | apiVersion: apps/v1
		2  | kind: Deployment
		3  | metadata:
		4  |   name: inflate
		5  | spec:
		6  |   replicas: 5
		7  |   selector:
		8  |     matchLabels:
		9  |       app: inflate
		10 |   template:
		11 |     metadata:
		12 |       labels:
		13 |         app: inflate
		14 |     spec:
		15 |       terminationGracePeriodSeconds: 0
		16 |       containers:
		17 |         - name: inflate
		18 |           image: public.ecr.aws/eks-distro/kubernetes/pause:3.7
		19 |           resources:
		20 |             requests:
		21 |               cpu: 1
Check: CKV_K8S_22: "Use read-only filesystem for containers where possible"
	FAILED for resource: Deployment.default.inflate
	File: /inflate.yaml:1-21
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bc-k8s-21

		1  | apiVersion: apps/v1
		2  | kind: Deployment
		3  | metadata:
		4  |   name: inflate
		5  | spec:
		6  |   replicas: 5
		7  |   selector:
		8  |     matchLabels:
		9  |       app: inflate
		10 |   template:
		11 |     metadata:
		12 |       labels:
		13 |         app: inflate
		14 |     spec:
		15 |       terminationGracePeriodSeconds: 0
		16 |       containers:
		17 |         - name: inflate
		18 |           image: public.ecr.aws/eks-distro/kubernetes/pause:3.7
		19 |           resources:
		20 |             requests:
		21 |               cpu: 1
Check: CKV_K8S_20: "Containers should not run with allowPrivilegeEscalation"
	FAILED for resource: Deployment.default.inflate
	File: /inflate.yaml:1-21
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bc-k8s-19

		1  | apiVersion: apps/v1
		2  | kind: Deployment
		3  | metadata:
		4  |   name: inflate
		5  | spec:
		6  |   replicas: 5
		7  |   selector:
		8  |     matchLabels:
		9  |       app: inflate
		10 |   template:
		11 |     metadata:
		12 |       labels:
		13 |         app: inflate
		14 |     spec:
		15 |       terminationGracePeriodSeconds: 0
		16 |       containers:
		17 |         - name: inflate
		18 |           image: public.ecr.aws/eks-distro/kubernetes/pause:3.7
		19 |           resources:
		20 |             requests:
		21 |               cpu: 1
Check: CKV_K8S_29: "Apply security context to your pods and containers"
	FAILED for resource: Deployment.default.inflate
	File: /inflate.yaml:1-21
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/ensure-securitycontext-is-applied-to-pods-and-containers

		1  | apiVersion: apps/v1
		2  | kind: Deployment
		3  | metadata:
		4  |   name: inflate
		5  | spec:
		6  |   replicas: 5
		7  |   selector:
		8  |     matchLabels:
		9  |       app: inflate
		10 |   template:
		11 |     metadata:
		12 |       labels:
		13 |         app: inflate
		14 |     spec:
		15 |       terminationGracePeriodSeconds: 0
		16 |       containers:
		17 |         - name: inflate
		18 |           image: public.ecr.aws/eks-distro/kubernetes/pause:3.7
		19 |           resources:
		20 |             requests:
		21 |               cpu: 1
Check: CKV_K8S_37: "Minimize the admission of containers with capabilities assigned"
	FAILED for resource: Deployment.default.inflate
	File: /inflate.yaml:1-21
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bc-k8s-34

		1  | apiVersion: apps/v1
		2  | kind: Deployment
		3  | metadata:
		4  |   name: inflate
		5  | spec:
		6  |   replicas: 5
		7  |   selector:
		8  |     matchLabels:
		9  |       app: inflate
		10 |   template:
		11 |     metadata:
		12 |       labels:
		13 |         app: inflate
		14 |     spec:
		15 |       terminationGracePeriodSeconds: 0
		16 |       containers:
		17 |         - name: inflate
		18 |           image: public.ecr.aws/eks-distro/kubernetes/pause:3.7
		19 |           resources:
		20 |             requests:
		21 |               cpu: 1
Check: CKV_K8S_12: "Memory requests should be set"
	FAILED for resource: Deployment.default.inflate
	File: /inflate.yaml:1-21
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bc-k8s-11

		1  | apiVersion: apps/v1
		2  | kind: Deployment
		3  | metadata:
		4  |   name: inflate
		5  | spec:
		6  |   replicas: 5
		7  |   selector:
		8  |     matchLabels:
		9  |       app: inflate
		10 |   template:
		11 |     metadata:
		12 |       labels:
		13 |         app: inflate
		14 |     spec:
		15 |       terminationGracePeriodSeconds: 0
		16 |       containers:
		17 |         - name: inflate
		18 |           image: public.ecr.aws/eks-distro/kubernetes/pause:3.7
		19 |           resources:
		20 |             requests:
		21 |               cpu: 1
Check: CKV_K8S_21: "The default namespace should not be used"
	FAILED for resource: Deployment.default.inflate
	File: /inflate.yaml:1-21
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bc-k8s-20

		1  | apiVersion: apps/v1
		2  | kind: Deployment
		3  | metadata:
		4  |   name: inflate
		5  | spec:
		6  |   replicas: 5
		7  |   selector:
		8  |     matchLabels:
		9  |       app: inflate
		10 |   template:
		11 |     metadata:
		12 |       labels:
		13 |         app: inflate
		14 |     spec:
		15 |       terminationGracePeriodSeconds: 0
		16 |       containers:
		17 |         - name: inflate
		18 |           image: public.ecr.aws/eks-distro/kubernetes/pause:3.7
		19 |           resources:
		20 |             requests:
		21 |               cpu: 1
Check: CKV_K8S_15: "Image Pull Policy should be Always"
	FAILED for resource: Deployment.default.inflate
	File: /inflate.yaml:1-21
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bc-k8s-14

		1  | apiVersion: apps/v1
		2  | kind: Deployment
		3  | metadata:
		4  |   name: inflate
		5  | spec:
		6  |   replicas: 5
		7  |   selector:
		8  |     matchLabels:
		9  |       app: inflate
		10 |   template:
		11 |     metadata:
		12 |       labels:
		13 |         app: inflate
		14 |     spec:
		15 |       terminationGracePeriodSeconds: 0
		16 |       containers:
		17 |         - name: inflate
		18 |           image: public.ecr.aws/eks-distro/kubernetes/pause:3.7
		19 |           resources:
		20 |             requests:
		21 |               cpu: 1
Check: CKV_K8S_11: "CPU limits should be set"
	FAILED for resource: Deployment.default.inflate
	File: /inflate.yaml:1-21
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bc-k8s-10

		1  | apiVersion: apps/v1
		2  | kind: Deployment
		3  | metadata:
		4  |   name: inflate
		5  | spec:
		6  |   replicas: 5
		7  |   selector:
		8  |     matchLabels:
		9  |       app: inflate
		10 |   template:
		11 |     metadata:
		12 |       labels:
		13 |         app: inflate
		14 |     spec:
		15 |       terminationGracePeriodSeconds: 0
		16 |       containers:
		17 |         - name: inflate
		18 |           image: public.ecr.aws/eks-distro/kubernetes/pause:3.7
		19 |           resources:
		20 |             requests:
		21 |               cpu: 1
Check: CKV_K8S_23: "Minimize the admission of root containers"
	FAILED for resource: Deployment.default.inflate
	File: /inflate.yaml:1-21
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bc-k8s-22

		1  | apiVersion: apps/v1
		2  | kind: Deployment
		3  | metadata:
		4  |   name: inflate
		5  | spec:
		6  |   replicas: 5
		7  |   selector:
		8  |     matchLabels:
		9  |       app: inflate
		10 |   template:
		11 |     metadata:
		12 |       labels:
		13 |         app: inflate
		14 |     spec:
		15 |       terminationGracePeriodSeconds: 0
		16 |       containers:
		17 |         - name: inflate
		18 |           image: public.ecr.aws/eks-distro/kubernetes/pause:3.7
		19 |           resources:
		20 |             requests:
		21 |               cpu: 1
Check: CKV_K8S_30: "Apply security context to your containers"
	FAILED for resource: Deployment.default.inflate
	File: /inflate.yaml:1-21
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bc-k8s-28

		1  | apiVersion: apps/v1
		2  | kind: Deployment
		3  | metadata:
		4  |   name: inflate
		5  | spec:
		6  |   replicas: 5
		7  |   selector:
		8  |     matchLabels:
		9  |       app: inflate
		10 |   template:
		11 |     metadata:
		12 |       labels:
		13 |         app: inflate
		14 |     spec:
		15 |       terminationGracePeriodSeconds: 0
		16 |       containers:
		17 |         - name: inflate
		18 |           image: public.ecr.aws/eks-distro/kubernetes/pause:3.7
		19 |           resources:
		20 |             requests:
		21 |               cpu: 1
Check: CKV_K8S_9: "Readiness Probe Should be Configured"
	FAILED for resource: Deployment.default.inflate
	File: /inflate.yaml:1-21
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bc-k8s-8

		1  | apiVersion: apps/v1
		2  | kind: Deployment
		3  | metadata:
		4  |   name: inflate
		5  | spec:
		6  |   replicas: 5
		7  |   selector:
		8  |     matchLabels:
		9  |       app: inflate
		10 |   template:
		11 |     metadata:
		12 |       labels:
		13 |         app: inflate
		14 |     spec:
		15 |       terminationGracePeriodSeconds: 0
		16 |       containers:
		17 |         - name: inflate
		18 |           image: public.ecr.aws/eks-distro/kubernetes/pause:3.7
		19 |           resources:
		20 |             requests:
		21 |               cpu: 1
Check: CKV_K8S_28: "Minimize the admission of containers with the NET_RAW capability"
	FAILED for resource: Deployment.default.inflate
	File: /inflate.yaml:1-21
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bc-k8s-27

		1  | apiVersion: apps/v1
		2  | kind: Deployment
		3  | metadata:
		4  |   name: inflate
		5  | spec:
		6  |   replicas: 5
		7  |   selector:
		8  |     matchLabels:
		9  |       app: inflate
		10 |   template:
		11 |     metadata:
		12 |       labels:
		13 |         app: inflate
		14 |     spec:
		15 |       terminationGracePeriodSeconds: 0
		16 |       containers:
		17 |         - name: inflate
		18 |           image: public.ecr.aws/eks-distro/kubernetes/pause:3.7
		19 |           resources:
		20 |             requests:
		21 |               cpu: 1
Check: CKV_K8S_43: "Image should use digest"
	FAILED for resource: Deployment.default.inflate
	File: /inflate.yaml:1-21
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bc-k8s-39

		1  | apiVersion: apps/v1
		2  | kind: Deployment
		3  | metadata:
		4  |   name: inflate
		5  | spec:
		6  |   replicas: 5
		7  |   selector:
		8  |     matchLabels:
		9  |       app: inflate
		10 |   template:
		11 |     metadata:
		12 |       labels:
		13 |         app: inflate
		14 |     spec:
		15 |       terminationGracePeriodSeconds: 0
		16 |       containers:
		17 |         - name: inflate
		18 |           image: public.ecr.aws/eks-distro/kubernetes/pause:3.7
		19 |           resources:
		20 |             requests:
		21 |               cpu: 1
Check: CKV2_K8S_6: "Minimize the admission of pods which lack an associated NetworkPolicy"
	FAILED for resource: Pod.default.inflate.app-inflate
	File: /inflate.yaml:1-21

		1  | apiVersion: apps/v1
		2  | kind: Deployment
		3  | metadata:
		4  |   name: inflate
		5  | spec:
		6  |   replicas: 5
		7  |   selector:
		8  |     matchLabels:
		9  |       app: inflate
		10 |   template:
		11 |     metadata:
		12 |       labels:
		13 |         app: inflate
		14 |     spec:
		15 |       terminationGracePeriodSeconds: 0
		16 |       containers:
		17 |         - name: inflate
		18 |           image: public.ecr.aws/eks-distro/kubernetes/pause:3.7
		19 |           resources:
		20 |             requests:
		21 |               cpu: 1

checkov_exitcode=1

`TFLint Scan` Success

Show Output

*****************************

Using default config
Installing "terraform" plugin...
The plugin was signed using a legacy PGP signing key. Please update the plugin to the latest version
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.15.0)
tflint checking:
terraform/environments/cloud-platform/cluster

*****************************

Running tflint in terraform/environments/cloud-platform/cluster
tflint_exitcode=0

masrafp-moj and others added 7 commits August 12, 2026 14:21

Enable EKS Auto Mode component logs via CloudWatch Vended Logs (#8415)

05f9fcd

Apply Auto Mode component logs to all clusters, not just development

6a30111

Reduce wait to 100s and note the CloudWatch API limitation

ddca06a

Merge remote-tracking branch 'origin/main' into feature/8415-auto-mod…

44b0462

…e-vended-logs

Merge branch 'feature/8415-auto-mode-vended-logs' into cp3-vended-log…

40d1b5a

…s-build

Increasing duration by 20s

231715d

Add vended-logs delivery resource policy for Auto Mode log groups

212afe7

Tom Smith (tom-j-smith) requested review from a team as code owners September 1, 2026 16:17

github-actions Bot added the environments-repository Used to exclude PRs from this repo in our Slack PR update label Sep 1, 2026

Navigation Menu

Uh oh!

CP3 Vended logs for Auto Mode - #18720

CP3 Vended logs for Auto Mode#18720
Tom Smith (tom-j-smith) wants to merge 7 commits into
mainfrom
cp3-vended-logs-build

Tom Smith (tom-j-smith) commented Sep 1, 2026

Uh oh!

github-actions Bot commented Sep 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

Tom Smith (tom-j-smith) commented Sep 1, 2026

Uh oh!

github-actions Bot commented Sep 1, 2026

Checkov Scan Failed

TFLint Scan Success

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

`Checkov Scan` Failed

`TFLint Scan` Success