@intentius/chant-lexicon-terraform 0.100.0 → 0.102.0

package/src/lint/post-synth/fixtures/TF031/negative.tf

@@ -0,0 +1,89 @@
+# Vendored for TF031 (chant #2286), unmodified below this header.
+# Source: https://github.com/alphagov/tech-ops/blob/122e78d1c6477825b22dd52f32e185a4a7838683/reliability-engineering/terraform/modules/concourse-monitoring/prometheus-ecs-iam.tf
+# Repository: alphagov/tech-ops, path reliability-engineering/terraform/modules/concourse-monitoring/prometheus-ecs-iam.tf, commit 122e78d1c6477825b22dd52f32e185a4a7838683
+# Licence: MIT
+#
+# Scoped policies only: every action is named and every resource is an
+# attribute of a managed resource, which can never be "*". TF031 reports
+# nothing, and not "not determined" either.
+#
+# Copyright (c) 2018 Government Digital Service
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+data "aws_iam_policy_document" "ecs_assume_role" {
+  statement {
+    actions = ["sts:AssumeRole"]
+    principals {
+      type        = "Service"
+      identifiers = ["ecs-tasks.amazonaws.com"]
+    }
+  }
+}
+
+resource "aws_iam_role" "prometheus_execution" {
+  name               = "${var.deployment}-prometheus-execution"
+  assume_role_policy = data.aws_iam_policy_document.ecs_assume_role.json
+}
+
+data "aws_iam_policy_document" "prometheus_data_volume_access" {
+  statement {
+    principals {
+      type        = "AWS"
+      identifiers = [aws_iam_role.concourse_prometheus.arn]
+    }
+
+    actions = [
+      "elasticfilesystem:ClientMount",
+      "elasticfilesystem:ClientWrite",
+    ]
+
+    condition {
+      test     = "StringEquals"
+      variable = "elasticfilesystem:AccessPointArn"
+      values   = [aws_efs_access_point.prometheus.arn]
+    }
+
+    resources = [aws_efs_file_system.prometheus.arn]
+  }
+}
+
+data "aws_iam_policy_document" "prometheus_cloudwatch_access" {
+  statement {
+    actions = [
+      "logs:CreateLogStream",
+      "logs:PutLogEvents",
+    ]
+
+    resources = [
+      aws_cloudwatch_log_group.prometheus.arn,
+      "${aws_cloudwatch_log_group.prometheus.arn}:log-stream:*",
+    ]
+  }
+}
+
+resource "aws_iam_policy" "prometheus_cloudwatch_access" {
+  name   = "${var.deployment}-prometheus-cloudwatch-access"
+  policy = data.aws_iam_policy_document.prometheus_cloudwatch_access.json
+}
+
+resource "aws_iam_role_policy_attachment" "prometheus_cloudwatch_access" {
+  role       = aws_iam_role.prometheus_execution.name
+  policy_arn = aws_iam_policy.prometheus_cloudwatch_access.arn
+}

package/src/lint/post-synth/fixtures/TF031/not-determined.tf

@@ -0,0 +1,139 @@
+# Vendored for TF031 (chant #2286), unmodified below this header.
+# Source: https://github.com/alphagov/tech-ops/blob/122e78d1c6477825b22dd52f32e185a4a7838683/reliability-engineering/terraform/modules/concourse-secrets-admin/iam.tf
+# Repository: alphagov/tech-ops, path reliability-engineering/terraform/modules/concourse-secrets-admin/iam.tf, commit 122e78d1c6477825b22dd52f32e185a4a7838683
+# Licence: MIT
+#
+# Both documents build Statement with concat(...) and a for-expression, so
+# TF031 cannot read them and reports not determined, never a warning. The
+# Deny statement with Action "*" and Resource "*" inside the concat is a guard
+# rail and would not fire even if it were readable.
+#
+# Copyright (c) 2018 Government Digital Service
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+resource "aws_iam_role" "concourse_secrets_admin" {
+  name = "${var.deployment}-${var.concourse_team_name}-concourse-secrets-admin"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = concat(
+      [
+        for team_id in concat(
+          var.trusted_github_team_id == "" ? [] : [var.trusted_github_team_id],
+          var.trusted_github_team_ids
+        ) : {
+          Effect = "Allow"
+          Principal = {
+            Federated = var.iam_oidc_provider_arn
+          }
+          Action = "sts:AssumeRoleWithWebIdentity"
+          Condition = {
+            StringEquals = {
+              "${var.oidc_host_path}:aud" = var.github_oauth_client_id
+              "aws:RequestTag/t${team_id}" = "t"
+            }
+          }
+        }
+      ],
+      [
+        {
+          Sid = "AllowPassSessionTagsAndTransitive"
+          Effect = "Allow"
+          Action = "sts:TagSession"
+          Principal = {
+            Federated = var.iam_oidc_provider_arn
+          }
+        }
+      ],
+      (length(var.allowed_cidrs) == 0 ? [] : [{
+          Sid = "DisallowAssumeFromUntrustedCIDR"
+          Effect = "Deny"
+          Principal = {
+            Federated = var.iam_oidc_provider_arn
+          }
+          Action = "sts:AssumeRoleWithWebIdentity"
+          Condition = {
+            NotIpAddress = {
+              "aws:SourceIp" = var.allowed_cidrs
+            }
+          }
+        }
+      ])
+    )
+  })
+}
+
+resource "aws_iam_role_policy" "concourse_secrets_admin" {
+  name = "${var.deployment}-${var.concourse_team_name}-concourse-secrets-admin-policy"
+  role = aws_iam_role.concourse_secrets_admin.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = concat(
+      [
+        {
+          Action = [
+            "ssm:GetParameter",
+            "ssm:GetParameterHistory",
+            "ssm:GetParameters",
+            "ssm:GetParametersByPath",
+            "ssm:DeleteParameter",
+            "ssm:PutParameter",
+          ]
+          Effect = "Allow"
+          Resource = [
+            "arn:aws:ssm:eu-west-2:${data.aws_caller_identity.account.account_id}:parameter/${var.deployment}/concourse/pipelines/${var.concourse_team_name}/*"
+          ]
+        }, {
+          Action = [
+            "ssm:DeleteParameter",
+            "ssm:PutParameter",
+          ]
+          Effect = "Deny"
+          Resource = [
+            "arn:aws:ssm:eu-west-2:${data.aws_caller_identity.account.account_id}:parameter/${var.deployment}/concourse/pipelines/${var.concourse_team_name}/readonly_*"
+          ]
+        }, {
+          Action = [
+            "kms:ListKeys",
+            "kms:ListAliases",
+            "kms:Describe*",
+            "kms:Decrypt",
+            "kms:Encrypt",
+          ]
+          Effect = "Allow"
+          Resource = var.kms_key_arn
+        }
+      ],
+      (length(var.allowed_cidrs) == 0 ? [] : [{
+          Sid = "DisallowAllFromUntrustedCIDR"
+          Effect = "Deny"
+          Action = "*"
+          Resource = "*"
+          Condition = {
+            NotIpAddress = {
+              "aws:SourceIp" = var.allowed_cidrs
+            }
+          }
+        }
+      ])
+    )
+  })
+}

package/src/lint/post-synth/fixtures/TF031/positive-data-source.tf

@@ -0,0 +1,57 @@
+# Vendored for TF031 (chant #2286), unmodified below this header.
+# Source: https://github.com/alphagov/tech-ops/blob/122e78d1c6477825b22dd52f32e185a4a7838683/cyber-security/modules/gds_security_audit_role/inline_policies.tf
+# Repository: alphagov/tech-ops, path cyber-security/modules/gds_security_audit_role/inline_policies.tf, commit 122e78d1c6477825b22dd52f32e185a4a7838683
+# Licence: MIT
+#
+# TF031 fires on both aws_iam_policy_document data sources (resources = ["*"]).
+# The two aws_iam_role_policy resources name those documents' .json and are
+# not reported again.
+#
+# Copyright (c) 2018 Government Digital Service
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+data "aws_iam_policy_document" "support_inline_policy_document" {
+  statement {
+    effect    = "Allow"
+    actions   = ["support:*"]
+    resources = ["*"]
+  }
+}
+
+resource "aws_iam_role_policy" "support_inline_policy" {
+  name   = "${var.prefix}GDSSecurityAuditInlineSupportPolicy"
+  role   = aws_iam_role.gds_security_audit_role.id
+  policy = data.aws_iam_policy_document.support_inline_policy_document.json
+}
+
+data "aws_iam_policy_document" "sts_inline_policy_document" {
+  statement {
+    effect    = "Allow"
+    actions   = ["sts:GetCallerIdentity"]
+    resources = ["*"]
+  }
+}
+
+resource "aws_iam_role_policy" "sts_inline_policy" {
+  name   = "${var.prefix}GDSSecurityAuditInlineSTSPolicy"
+  role   = aws_iam_role.gds_security_audit_role.id
+  policy = data.aws_iam_policy_document.sts_inline_policy_document.json
+}
+

package/src/lint/post-synth/fixtures/TF031/positive-heredoc.tf

@@ -0,0 +1,149 @@
+# Vendored for TF031 (chant #2286), unmodified below this header.
+# Source: https://github.com/terraform-community-modules/tf_aws_ecs/blob/4a41e9c5acf4b71893bcb1ab3856c7c630f283d6/iam.tf
+# Repository: terraform-community-modules/tf_aws_ecs, path iam.tf, commit 4a41e9c5acf4b71893bcb1ab3856c7c630f283d6
+# Licence: MIT
+#
+# A heredoc with no interpolation is a literal string in the parse, so TF031
+# reads it as JSON: aws_iam_policy.ecs_policy (Resource "*") fires, and so does
+# data.aws_iam_policy_document.consul_task_policy. aws_iam_policy.custom_ecs_policy
+# is "${var.custom_iam_policy}" and is reported as not determined.
+#
+# Copyright (c) 2016 Tim Hartmann
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+resource "aws_iam_instance_profile" "ecs_profile" {
+  name_prefix = "${replace(format("%.102s", replace("tf-ECSProfile-${var.name}-", "_", "-")), "/\\s/", "-")}"
+  role        = "${aws_iam_role.ecs_role.name}"
+  path        = "${var.iam_path}"
+}
+
+resource "aws_iam_role" "ecs_role" {
+  name_prefix = "${replace(format("%.32s", replace("tf-ECSInRole-${var.name}-", "_", "-")), "/\\s/", "-")}"
+  path        = "${var.iam_path}"
+
+  assume_role_policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": "sts:AssumeRole",
+      "Principal": {
+      "Service": ["ecs.amazonaws.com", "ec2.amazonaws.com"]
+
+    },
+    "Effect": "Allow",
+    "Sid": ""
+    }
+  ]
+}
+EOF
+}
+
+# It may be useful to add the following for troubleshooting the InstanceStatus
+# Health check if using the fitnesskeeper/consul docker image
+# "ec2:Describe*",
+# "autoscaling:Describe*",
+
+resource "aws_iam_policy" "ecs_policy" {
+  name_prefix = "${replace(format("%.102s", replace("tf-ECSInPol-${var.name}-", "_", "-")), "/\\s/", "-")}"
+  description = "A terraform created policy for ECS"
+  path        = "${var.iam_path}"
+  count       = "${length(var.custom_iam_policy) > 0 ? 0 : 1}"
+
+  policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "ecs:CreateCluster",
+        "ecs:DeregisterContainerInstance",
+        "ecs:DiscoverPollEndpoint",
+        "ecs:Poll",
+        "ecs:RegisterContainerInstance",
+        "ecs:StartTelemetrySession",
+        "ecs:Submit*",
+        "ecr:GetAuthorizationToken",
+        "ecr:BatchCheckLayerAvailability",
+        "ecr:GetDownloadUrlForLayer",
+        "ecr:BatchGetImage",
+        "logs:CreateLogStream",
+        "logs:PutLogEvents"
+      ],
+      "Resource": "*"
+    }
+  ]
+}
+EOF
+}
+
+resource "aws_iam_policy" "custom_ecs_policy" {
+  name_prefix = "${replace(format("%.102s", replace("tf-ECSInPol-${var.name}-", "_", "-")), "/\\s/", "-")}"
+  description = "A terraform created policy for ECS"
+  path        = "${var.iam_path}"
+  count       = "${length(var.custom_iam_policy) > 0 ? 1 : 0}"
+
+  policy = "${var.custom_iam_policy}"
+}
+
+resource "aws_iam_policy_attachment" "attach_ecs" {
+  name       = "ecs-attachment"
+  roles      = ["${aws_iam_role.ecs_role.name}"]
+  policy_arn = "${element(concat(aws_iam_policy.ecs_policy.*.arn, aws_iam_policy.custom_ecs_policy.*.arn), 0)}"
+}
+
+# IAM Resources for Consul and Registrator Agents
+
+data "aws_iam_policy_document" "consul_task_policy" {
+  statement {
+    actions = [
+      "ec2:Describe*",
+      "autoscaling:Describe*",
+    ]
+
+    resources = ["*"]
+  }
+}
+
+data "aws_iam_policy_document" "assume_role_consul_task" {
+  statement {
+    actions = ["sts:AssumeRole"]
+
+    principals {
+      type        = "Service"
+      identifiers = ["ecs-tasks.amazonaws.com"]
+    }
+  }
+}
+
+resource "aws_iam_role" "consul_task" {
+  count              = "${var.enable_agents ? 1 : 0}"
+  name_prefix        = "${replace(format("%.32s", replace("tf-agentTaskRole-${var.name}-", "_", "-")), "/\\s/", "-")}"
+  path               = "${var.iam_path}"
+  assume_role_policy = "${data.aws_iam_policy_document.assume_role_consul_task.json}"
+}
+
+resource "aws_iam_role_policy" "consul_ecs_task" {
+  count       = "${var.enable_agents ? 1 : 0}"
+  name_prefix = "${replace(format("%.102s", replace("tf-agentTaskPol-${var.name}-", "_", "-")), "/\\s/", "-")}"
+  role        = "${aws_iam_role.consul_task.id}"
+  policy      = "${data.aws_iam_policy_document.consul_task_policy.json}"
+}

package/src/lint/post-synth/fixtures/TF031/positive-jsonencode.tf

@@ -0,0 +1,115 @@
+# Vendored for TF031 (chant #2286), unmodified below this header.
+# Source: https://github.com/BishopFox/iam-vulnerable/blob/0f298666f9b7cfa01488b86912afdb211773188a/modules/free-resources/privesc-paths/privesc-AssumeRole.tf
+# Repository: BishopFox/iam-vulnerable, path modules/free-resources/privesc-paths/privesc-AssumeRole.tf, commit 0f298666f9b7cfa01488b86912afdb211773188a
+# Licence: MIT
+#
+# TF031 fires on aws_iam_policy.privesc-AssumeRole-high-priv-policy: a literal
+# jsonencode() policy whose one Allow statement has Action "*" and Resource "*".
+# The three roles' assume_role_policy documents carry a reference Principal
+# beside a literal Action, and are read as scoped, not as not determined.
+#
+# Copyright (c) 2021 Bishop Fox
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+resource "aws_iam_policy" "privesc-AssumeRole-high-priv-policy" {
+  name        = "privesc-AssumeRole-high-priv-policy"
+  path        = "/"
+  description = "Allows privesc via targeted sts:AssumeRole"
+
+  # Terraform's "jsonencode" function converts a
+  # Terraform expression result to valid JSON syntax.
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect   = "Allow"
+        Action = "*"
+        Resource = "*"
+      },
+    ]
+  })
+}
+
+resource "aws_iam_role" "privesc-AssumeRole-starting-role" {
+  name                = "privesc-AssumeRole-starting-role"
+  assume_role_policy  = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Action = "sts:AssumeRole"
+        Effect = "Allow"
+        Sid    = ""
+        Principal = {
+          AWS = var.aws_assume_role_arn
+        }
+      },
+    ]
+  })
+}
+
+resource "aws_iam_role" "privesc-AssumeRole-intermediate-role" {
+  name                = "privesc-AssumeRole-intermediate-role"
+  assume_role_policy  = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Action = "sts:AssumeRole"
+        Effect = "Allow"
+        Sid    = ""
+        Principal = {
+          AWS = aws_iam_role.privesc-AssumeRole-starting-role.arn
+        }
+      },
+    ]
+  })
+}
+
+
+resource "aws_iam_role" "privesc-AssumeRole-ending-role" {
+  name                = "privesc-AssumeRole-ending-role"
+  assume_role_policy  = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Action = "sts:AssumeRole"
+        Effect = "Allow"
+        Sid    = ""
+        Principal = {
+          AWS = aws_iam_role.privesc-AssumeRole-intermediate-role.arn
+        }
+      },
+    ]
+  })
+}
+
+
+
+resource "aws_iam_user" "privesc-AssumeRole-start-user" {
+  name = "privesc-AssumeRole-start-user"
+  path = "/"
+}
+resource "aws_iam_access_key" "privesc-AssumeRole-start-user" {
+  user = aws_iam_user.privesc-AssumeRole-start-user.name
+}
+resource "aws_iam_role_policy_attachment" "privesc-AssumeRole-high-priv-policy-role-attach-policy" {
+  role       = aws_iam_role.privesc-AssumeRole-ending-role.name
+  policy_arn = aws_iam_policy.privesc-AssumeRole-high-priv-policy.arn
+
+}  

package/src/lint/post-synth/fixtures/TF032/negative-heredoc.tf

@@ -0,0 +1,20 @@
+# Vendored for TF032 (chant #2287). Source: https://github.com/aquasecurity/trivy-checks
+# Path: checks/cloud/aws/ecs/no_plaintext_secrets.yaml (terraform.good[0])
+# Commit: 71c05d02845cc2c3a5dfa4fe914a68a052cc88bf
+# Licence: MIT
+# Copyright (c) 2024 Aqua Security. MIT licence: https://github.com/aquasecurity/trivy-checks/blob/71c05d02845cc2c3a5dfa4fe914a68a052cc88bf/LICENSE
+# The upstream check's own passing example, lifted out of its YAML block scalar unchanged.
+# Silent: the one environment entry is not a credential.
+
+resource "aws_ecs_task_definition" "good_example" {
+  container_definitions = <<EOF
+ [
+   {
+     "name": "my_service",
+     "environment": [
+       { "name": "ENVIRONMENT", "value": "development" }
+     ]
+   }
+ ]
+ EOF
+}