@intentius/chant-lexicon-terraform 0.100.0 → 0.102.0

package/src/lint/post-synth/fixtures/TF032/negative-references.tf

@@ -0,0 +1,214 @@
+# Vendored for TF032 (chant #2287). Source: https://github.com/testdrivenio/django-ecs-terraform
+# Path: terraform/07_ecs.tf
+# Commit: 6571bcce48cee37fa10b1ee9a5caec147356b047
+# Licence: MIT
+# Copyright (c) 2023 TestDriven.io. MIT licence: https://github.com/testdrivenio/django-ecs-terraform/blob/6571bcce48cee37fa10b1ee9a5caec147356b047/LICENSE
+# Copied verbatim below this header. No finding: RDS_PASSWORD is var.rds_password (a reference, not a literal), and the collectstatic task has no environment. The app task's container_definitions is data.template_file.app.rendered, which is not determined.
+
+resource "aws_ecs_cluster" "production" {
+  name = "${var.ecs_cluster_name}-cluster"
+}
+
+data "template_file" "app" {
+  template = file("templates/django_app.json.tpl")
+
+  vars = {
+    docker_image_url_django = var.docker_image_url_django
+    docker_image_url_nginx  = var.docker_image_url_nginx
+    region                  = var.region
+    rds_db_name             = var.rds_db_name
+    rds_username            = var.rds_username
+    rds_password            = var.rds_password
+    rds_hostname            = aws_db_instance.production.address
+    allowed_hosts           = var.allowed_hosts
+  }
+}
+
+resource "aws_ecs_task_definition" "app" {
+  family                   = "django-app"
+  depends_on               = [aws_db_instance.production]
+  network_mode             = "awsvpc" # Required for Fargate
+  requires_compatibilities = ["FARGATE"]
+  cpu                      = "${var.fargate_cpu}"
+  memory                   = "${var.fargate_memory}"
+  execution_role_arn       = aws_iam_role.ecs-task-execution-role.arn
+  task_role_arn            = aws_iam_role.ecs-task-execution-role.arn
+  container_definitions    = data.template_file.app.rendered
+  volume {
+    name = "efs-volume"
+    efs_volume_configuration {
+      file_system_id          = aws_efs_file_system.efs.id
+      root_directory          = "/"
+      transit_encryption      = "ENABLED"
+      transit_encryption_port = 2049
+      authorization_config {
+        access_point_id = aws_efs_access_point.app_access_point.id
+        iam             = "ENABLED"
+      }
+    }
+  }
+}
+
+resource "aws_ecs_service" "production" {
+  name            = "${var.ecs_cluster_name}-service"
+  cluster         = aws_ecs_cluster.production.id
+  task_definition = aws_ecs_task_definition.app.arn
+  launch_type     = "FARGATE"
+  desired_count   = var.app_count
+  network_configuration {
+    subnets          = [aws_subnet.public-subnet-1.id, aws_subnet.public-subnet-2.id]
+    security_groups  = [aws_security_group.ecs-fargate.id]
+    assign_public_ip = true
+  }
+
+  load_balancer {
+    target_group_arn = aws_alb_target_group.default-target-group.arn
+    container_name   = "nginx"
+    container_port   = 80
+  }
+}
+
+resource "aws_ecs_task_definition" "django_migration" {
+  family                = "django-migration-task"
+  network_mode          = "awsvpc"
+  requires_compatibilities = ["FARGATE"]
+  cpu                   = var.fargate_cpu
+  memory                = var.fargate_memory
+  execution_role_arn    = aws_iam_role.ecs-task-execution-role.arn
+
+  container_definitions = jsonencode([
+    {
+      name  = "django-migration-container"
+      image = var.docker_image_url_django
+      environment: [
+        {
+            "name": "RDS_DB_NAME",
+            "value": var.rds_db_name
+        },
+        {
+            "name": "RDS_USERNAME",
+            "value": var.rds_username
+        },
+        {
+            "name": "RDS_PASSWORD",
+            "value": var.rds_password
+        },
+        {
+            "name": "RDS_HOSTNAME",
+            "value": aws_db_instance.production.address
+        },
+        {
+            "name": "RDS_PORT",
+            "value": "5432"
+        }
+      ],
+      # Run migrations as the command
+      command = ["python", "manage.py", "migrate"]
+
+      # Add log configuration for CloudWatch
+      logConfiguration = {
+        logDriver = "awslogs"
+        options = {
+          awslogs-group         = "/ecs/django-app"
+          awslogs-region        = var.region
+          awslogs-stream-prefix = "ecs"
+        }
+      }
+
+      # Other required configurations go here...
+      portMappings = [
+        {
+          containerPort = 8000
+        }
+      ]
+    }
+  ])
+}
+
+resource "aws_efs_file_system" "efs" {
+  lifecycle_policy {
+    transition_to_ia = "AFTER_30_DAYS"
+  }
+}
+
+resource "aws_efs_access_point" "app_access_point" {
+  file_system_id = aws_efs_file_system.efs.id
+  posix_user {
+    uid = 1000
+    gid = 1000
+  }
+  root_directory {
+    path = "/efs"
+    creation_info {
+      owner_uid   = 1000
+      owner_gid   = 1000
+      permissions = "755"
+    }
+  }
+}
+
+resource "aws_efs_mount_target" "efs_mount" {
+  count           = length([aws_subnet.public-subnet-1.id, aws_subnet.public-subnet-2.id])
+  file_system_id  = aws_efs_file_system.efs.id
+  subnet_id       = [aws_subnet.public-subnet-1.id, aws_subnet.public-subnet-2.id][count.index]
+  security_groups = [aws_security_group.efs_sg.id]
+}
+
+resource "aws_ecs_task_definition" "django_collectstatic" {
+  family                = "django-collectstatic-task"
+  network_mode          = "awsvpc"
+  requires_compatibilities = ["FARGATE"]
+  cpu                   = var.fargate_cpu
+  memory                = var.fargate_memory
+  execution_role_arn    = aws_iam_role.ecs-task-execution-role.arn
+  task_role_arn         = aws_iam_role.ecs-task-execution-role.arn
+  volume {
+    name = "efs-volume"
+    efs_volume_configuration {
+      file_system_id          = aws_efs_file_system.efs.id
+      root_directory          = "/"
+      transit_encryption      = "ENABLED"
+      transit_encryption_port = 2049
+      authorization_config {
+        access_point_id = aws_efs_access_point.app_access_point.id
+        iam             = "ENABLED"
+      }
+    }
+  }
+  container_definitions = jsonencode([
+    {
+      name  = "django-collectstatic-container"
+      image = var.docker_image_url_django
+      linuxParameters = {
+        user = "1000:1000"
+      },
+      # Run collectstatic as the command
+      command = ["python", "manage.py", "collectstatic", "--no-input", "-v", "3"]
+
+      mountPoints = [
+        {
+          sourceVolume = "efs-volume",
+          containerPath = "/efs/staticfiles/",
+          readOnly = false
+        }
+      ]
+
+      # Add log configuration for CloudWatch
+      logConfiguration = {
+        logDriver = "awslogs"
+        options = {
+          awslogs-group         = "/ecs/django-app"
+          awslogs-region        = var.region
+          awslogs-stream-prefix = "ecs"
+        }
+      }
+
+      # Other required configurations go here...
+      portMappings = [
+        {
+          containerPort = 8000
+        }
+      ]
+    }
+  ])
+}

package/src/lint/post-synth/fixtures/TF032/negative.tf

@@ -0,0 +1,99 @@
+# Vendored for TF032 (chant #2287). Source: https://github.com/vapor/penny-bot
+# Path: infra/ecs.tf
+# Commit: e1481d187e703649e2116d36c3cb022357946916
+# Licence: Apache-2.0
+# Copyright the penny-bot contributors. Licensed under the Apache License, Version 2.0: https://github.com/vapor/penny-bot/blob/e1481d187e703649e2116d36c3cb022357946916/LICENSE
+# Copied verbatim below this header. Unmodified. Silent: BOT_TOKEN and SO_API_KEY arrive through secrets/valueFrom, and environment holds only a literal stage name and a reference.
+
+resource "aws_ecs_cluster" "penny" {
+  name = module.constants.ecs_cluster_name
+}
+
+resource "aws_ecs_task_definition" "penny" {
+  family                   = "penny-bot"
+  skip_destroy             = true
+  cpu                      = "256"
+  memory                   = "512"
+  network_mode             = "awsvpc"
+  requires_compatibilities = ["FARGATE"]
+  execution_role_arn       = data.aws_iam_role.ecs_task_execution.arn
+  task_role_arn            = data.aws_iam_role.ecs_task.arn
+
+  runtime_platform {
+    cpu_architecture        = "ARM64"
+    operating_system_family = "LINUX"
+  }
+
+  container_definitions = jsonencode([
+    {
+      name           = "penny-bot"
+      image          = "${aws_ecr_repository.penny_bot_discord_image.repository_url}:${local.penny_image_tag}"
+      cpu            = 0
+      essential      = true
+      portMappings   = []
+      mountPoints    = []
+      volumesFrom    = []
+      systemControls = []
+      environment = [
+        {
+          name  = "DEPLOYMENT_ENVIRONMENT"
+          value = "prod"
+        },
+        {
+          name  = "GH_OAUTH_CLIENT_ID"
+          value = module.constants.gh_oauth_client_id
+        }
+      ]
+      secrets = [
+        {
+          name      = "BOT_TOKEN"
+          valueFrom = aws_secretsmanager_secret.discord_bot_token.arn
+        },
+        {
+          name      = "LOGGING_WEBHOOK_URL"
+          valueFrom = aws_secretsmanager_secret.logs_webhook_url.arn
+        },
+        {
+          name      = "ACCOUNT_LINKING_OAUTH_FLOW_PRIV_KEY"
+          valueFrom = aws_secretsmanager_secret.account_linking_priv_key.arn
+        },
+        {
+          name      = "SO_API_KEY"
+          valueFrom = aws_secretsmanager_secret.stack_overflow_api_key.arn
+        }
+      ]
+      logConfiguration = {
+        logDriver = "awslogs"
+        options = {
+          awslogs-group         = aws_cloudwatch_log_group.ecs_api.name
+          awslogs-region        = local.region
+          awslogs-stream-prefix = "ecs"
+        }
+      }
+    }
+  ])
+}
+
+resource "aws_ecs_service" "penny" {
+  name                  = module.constants.ecs_service_name
+  cluster               = aws_ecs_cluster.penny.id
+  task_definition       = "${aws_ecs_task_definition.penny.family}:${aws_ecs_task_definition.penny.revision}"
+  desired_count         = 1
+  launch_type           = "FARGATE"
+  platform_version      = "1.4.0"
+  wait_for_steady_state = true
+
+  deployment_minimum_healthy_percent = 100
+  deployment_maximum_percent         = 200
+
+  deployment_circuit_breaker {
+    enable   = true
+    rollback = true
+  }
+
+  network_configuration {
+    subnets          = data.aws_subnets.default.ids
+    security_groups  = [aws_security_group.ecs_service.id]
+    assign_public_ip = true
+  }
+}

package/src/lint/post-synth/fixtures/TF032/positive-heredoc.tf

@@ -0,0 +1,22 @@
+# Vendored for TF032 (chant #2287). Source: https://github.com/aquasecurity/trivy-checks
+# Path: checks/cloud/aws/ecs/no_plaintext_secrets.yaml (terraform.bad[0])
+# Commit: 71c05d02845cc2c3a5dfa4fe914a68a052cc88bf
+# Licence: MIT
+# Copyright (c) 2024 Aqua Security. MIT licence: https://github.com/aquasecurity/trivy-checks/blob/71c05d02845cc2c3a5dfa4fe914a68a052cc88bf/LICENSE
+# The upstream check's own failing example, lifted out of its YAML block scalar unchanged.
+# A heredoc with no interpolation arrives from hcl2json as a plain string, so it is read
+# as JSON. Fires once, on DATABASE_PASSWORD.
+
+resource "aws_ecs_task_definition" "bad_example" {
+  container_definitions = <<EOF
+ [
+   {
+     "name": "my_service",
+     "environment": [
+       { "name": "ENVIRONMENT", "value": "development" },
+       { "name": "DATABASE_PASSWORD", "value": "oh no D:"}
+     ]
+   }
+ ]
+ EOF
+}

package/src/lint/post-synth/fixtures/TF032/positive-sidecar.tf

@@ -0,0 +1,197 @@
+# Vendored for TF032 (chant #2287). Source: https://github.com/govuk-forms/forms-admin
+# Path: .review_apps/ecs_task_definition.tf
+# Commit: b338d4386619e3379a2555d65b8cfdf5d786905c
+# Licence: MIT
+# Copyright (c) 2022 Crown Copyright (Government Digital Service). MIT licence: https://github.com/govuk-forms/forms-admin/blob/b338d4386619e3379a2555d65b8cfdf5d786905c/LICENSE
+# Copied verbatim below this header. Fires once on the postgres sidecar's literal POSTGRES_PASSWORD; the two containers whose environment is local.forms_admin_env_vars are not determined. The traefik dockerLabels keys are templates, which the reader drops without losing the rest.
+
+locals {
+  logs_stream_prefix = "${data.terraform_remote_state.review.outputs.review_apps_log_group_name}/pr-${var.pull_request_number}"
+
+  # try() so that deploys succeed before the review environment state has
+  # published the assets outputs
+  assets_bucket_name        = try(data.terraform_remote_state.review.outputs.assets_bucket_name, "govuk-forms-review-assets")
+  forms_admin_task_role_arn = try(data.terraform_remote_state.review.outputs.forms_admin_task_role_arn, null)
+
+  review_app_hostname = "pr-${var.pull_request_number}.admin.review.forms.service.gov.uk"
+
+  forms_admin_startup_commands = [
+    "echo $PATH",
+    "bundle install",
+    "echo $PATH",
+    "bin/rails db:prepare",
+    "bin/rails s -b 0.0.0.0"
+  ]
+
+  forms_admin_shell_script = join(" && ", local.forms_admin_startup_commands)
+
+  forms_admin_env_vars = [
+    { name = "DATABASE_URL", value = "postgres://postgres:postgres@127.0.0.1:5432" },
+    { name = "EMAIL", value = "review-app-submissions@review.forms.service.gov.uk" },
+    { name = "GOVUK_APP_DOMAIN", value = "publishing.service.gov.uk" },
+    { name = "PORT", value = "3000" },
+    { name = "RAILS_DEVELOPMENT_HOSTS", value = "pr-${var.pull_request_number}.admin.review.forms.service.gov.uk" },
+    { name = "RAILS_ENV", value = "production" },
+    { name = "SECRET_KEY_BASE", value = "unsecured_secret_key_material" },
+    { name = "SETTINGS__ACT_AS_USER_ENABLED", value = "true" },
+    { name = "SETTINGS__AUTH_PROVIDER", value = "developer" },
+    { name = "SETTINGS__AWS__ASSETS_S3_BUCKET_NAME", value = local.assets_bucket_name },
+    { name = "SETTINGS__FORMS_ENV", value = "review" },
+    { name = "SETTINGS__FORMS_RUNNER__URL", value = "https://forms.service.gov.uk" },
+  ]
+}
+
+resource "aws_ecs_task_definition" "task" {
+  family = "forms-admin-pr-${var.pull_request_number}"
+
+  network_mode = "awsvpc"
+  cpu          = 256
+  memory       = 1024
+
+  requires_compatibilities = ["FARGATE"]
+
+  runtime_platform {
+    operating_system_family = "LINUX"
+    cpu_architecture        = "ARM64"
+  }
+
+  execution_role_arn = data.terraform_remote_state.review.outputs.ecs_task_execution_role_arn
+
+  # Gives the app permission to upload brand assets to the assets bucket
+  task_role_arn = local.forms_admin_task_role_arn
+
+  container_definitions = jsonencode([
+
+    # forms-admin
+    {
+      name        = "forms-admin"
+      image       = var.forms_admin_container_image
+      command     = []
+      essential   = true
+      environment = local.forms_admin_env_vars
+      # Uploaded files are buffered to tempfiles, and the app user cannot
+      # write to a volume mounted at /tmp, so the root filesystem cannot be
+      # read-only
+      readonlyRootFilesystem = false
+
+      dockerLabels = {
+        "traefik.http.middlewares.forms-admin-pr-${var.pull_request_number}.basicauth.users" : data.terraform_remote_state.review.outputs.traefik_basic_auth_credentials
+
+        "traefik.http.routers.forms-admin-pr-${var.pull_request_number}.rule" : "Host(`${local.review_app_hostname}`)",
+        "traefik.http.routers.forms-admin-pr-${var.pull_request_number}.service" : "forms-admin-pr-${var.pull_request_number}",
+        "traefik.http.routers.forms-admin-pr-${var.pull_request_number}.middlewares" : "forms-admin-pr-${var.pull_request_number}@ecs"
+
+        "traefik.http.services.forms-admin-pr-${var.pull_request_number}.loadbalancer.server.port" : "3000",
+        "traefik.http.services.forms-admin-pr-${var.pull_request_number}.loadbalancer.healthcheck.path" : "/up",
+        "traefik.enable" : "true",
+      },
+
+      portMappings = [
+        {
+          containerPort = 3000
+          hostPort      = 3000
+          protocol      = "tcp"
+          appProtocol   = "http"
+        }
+      ]
+
+      mountPoints    = []
+      systemControls = []
+      volumesFrom    = []
+
+      logConfiguration = {
+        logDriver = "awslogs"
+        options = {
+          awslogs-group         = data.terraform_remote_state.review.outputs.review_apps_log_group_name
+          awslogs-region        = "eu-west-2"
+          awslogs-stream-prefix = "${local.logs_stream_prefix}/forms-admin"
+        }
+      }
+
+      healthCheck = {
+        command     = ["CMD-SHELL", "wget -O - 'http://localhost:3000/up' || exit 1"]
+        interval    = 30
+        retries     = 5
+        startPeriod = 180
+        timeout     = 5
+      }
+
+      dependsOn = [
+        {
+          containerName = "postgres"
+          condition     = "HEALTHY"
+        }
+      ]
+    },
+
+    # postgres
+    {
+      name      = "postgres"
+      image     = "public.ecr.aws/docker/library/postgres:16.6"
+      command   = []
+      essential = true
+
+      portMappings = [
+        {
+          containerPort = 5432
+          hostPort      = 5432
+          protocol      = "tcp"
+        }
+      ]
+
+      mountPoints    = []
+      systemControls = []
+      volumesFrom    = []
+
+      environment = [
+        { name = "POSTGRES_PASSWORD", value = "postgres" }
+      ]
+
+      logConfiguration = {
+        logDriver = "awslogs"
+        options = {
+          awslogs-group         = data.terraform_remote_state.review.outputs.review_apps_log_group_name
+          awslogs-region        = "eu-west-2"
+          awslogs-stream-prefix = "${local.logs_stream_prefix}/postgres"
+        }
+      }
+
+      healthCheck = {
+        command  = ["CMD-SHELL", "psql -h localhost -p 5432 -U postgres -c \"SELECT current_timestamp - pg_postmaster_start_time();\""]
+        interval = 30
+        retries  = 3
+        timeout  = 5
+      }
+    },
+
+    # forms-admin-seeding
+    {
+      name                   = "forms-admin-seeding"
+      image                  = var.forms_admin_container_image
+      command                = ["rake", "db:create", "db:migrate", "db:seed"]
+      essential              = false
+      environment            = local.forms_admin_env_vars
+      readonlyRootFilesystem = true
+
+      mountPoints    = []
+      systemControls = []
+      volumesFrom    = []
+
+      logConfiguration = {
+        logDriver = "awslogs"
+        options = {
+          awslogs-group         = data.terraform_remote_state.review.outputs.review_apps_log_group_name
+          awslogs-region        = "eu-west-2"
+          awslogs-stream-prefix = "${local.logs_stream_prefix}/forms-admin-seeding"
+        }
+      }
+
+      dependsOn = [
+        {
+          containerName = "postgres"
+          condition     = "HEALTHY"
+        }
+      ]
+    },
+  ])
+}

package/src/lint/post-synth/fixtures/TF032/positive.tf

@@ -0,0 +1,54 @@
+# Vendored for TF032 (chant #2287). Source: https://github.com/edstem-tech/paylink-platform
+# Path: terraform/ecs.tf
+# Commit: 2bbcbcce09434286cf90d20f69df0bd3ffa4cd00
+# Licence: MIT
+# Copyright (c) 2025 EdStem. MIT licence: permission notice at https://github.com/edstem-tech/paylink-platform/blob/2bbcbcce09434286cf90d20f69df0bd3ffa4cd00/LICENSE
+# Copied verbatim below this header. Fires twice: DB_PASSWORD and PAYMENT_API_KEY are literals in environment.
+
+resource "aws_ecs_cluster" "main" {
+  name = "paylink-prod"
+}
+
+resource "aws_ecs_task_definition" "api" {
+  family                   = "paylink-api"
+  network_mode             = "awsvpc"
+  requires_compatibilities = ["FARGATE"]
+  cpu                      = "1024"
+  memory                   = "2048"
+  task_role_arn            = aws_iam_role.task.arn
+  execution_role_arn       = aws_iam_role.execution.arn
+
+  container_definitions = jsonencode([{
+    name  = "api"
+    image = "${var.ecr_repo}:latest"
+
+    portMappings = [{ containerPort = 8080 }]
+
+    environment = [
+      { name = "SPRING_PROFILES_ACTIVE", value = "prod" },
+      { name = "DB_PASSWORD", value = "Pl-Pr0d-Db-2025!" },
+      { name = "PAYMENT_API_KEY", value = "pk_live_4RtYuIoP2aSdF6gH8jK" }
+    ]
+
+    healthCheck = {
+      command  = ["CMD-SHELL", "curl -f http://localhost:8080/actuator/health || exit 1"]
+      interval = 10
+      timeout  = 2
+      retries  = 3
+    }
+  }])
+}
+
+resource "aws_ecs_service" "api" {
+  name            = "paylink-api"
+  cluster         = aws_ecs_cluster.main.id
+  task_definition = aws_ecs_task_definition.api.arn
+  desired_count   = 2
+  launch_type     = "FARGATE"
+
+  network_configuration {
+    subnets          = aws_subnet.public[*].id
+    security_groups  = [aws_security_group.service.id]
+    assign_public_ip = true
+  }
+}

package/src/lint/post-synth/fixtures/TF033/negative.tf

@@ -0,0 +1,39 @@
+# Vendored for TF033 (chant #2288) from https://github.com/tmknom/example-pragmatic-terraform
+# Path: 13/4.tf
+# Commit: 7043f9216cf7fb55b3c5e9cd1926fe5da04a3ddb
+# Licence: Apache-2.0, https://github.com/tmknom/example-pragmatic-terraform/blob/7043f9216cf7fb55b3c5e9cd1926fe5da04a3ddb/LICENSE
+# The whole file, unmodified.
+#
+# TF033: silent. A MySQL DB instance with storage_encrypted = true and a customer managed kms_key_id.
+
+resource "aws_db_instance" "example" {
+  identifier                 = "example"
+  engine                     = "mysql"
+  engine_version             = "5.7.25"
+  instance_class             = "db.t3.small"
+  allocated_storage          = 20
+  max_allocated_storage      = 100
+  storage_type               = "gp2"
+  storage_encrypted          = true
+  kms_key_id                 = aws_kms_key.example.arn
+  username                   = "admin"
+  password                   = "VeryStrongPassword!"
+  multi_az                   = true
+  publicly_accessible        = false
+  backup_window              = "09:10-09:40"
+  backup_retention_period    = 30
+  maintenance_window         = "mon:10:10-mon:10:40"
+  auto_minor_version_upgrade = false
+  deletion_protection        = true
+  skip_final_snapshot        = false
+  port                       = 3306
+  apply_immediately          = false
+  vpc_security_group_ids     = [module.mysql_sg.security_group_id]
+  parameter_group_name       = aws_db_parameter_group.example.name
+  option_group_name          = aws_db_option_group.example.name
+  db_subnet_group_name       = aws_db_subnet_group.example.name
+
+  lifecycle {
+    ignore_changes = [password]
+  }
+}

package/src/lint/post-synth/fixtures/TF033/not-determined-aurora.tf

@@ -0,0 +1,25 @@
+# Vendored for TF033 (chant #2288) from https://github.com/bridgecrewio/terragoat
+# Path: terraform/aws/rds.tf
+# Commit: 729f8da62c6a85ce4af5ad3d123de97776d954c4
+# Licence: Apache-2.0, https://github.com/bridgecrewio/terragoat/blob/729f8da62c6a85ce4af5ad3d123de97776d954c4/LICENSE
+# Excerpt: lines 1-15, unmodified.
+#
+# TF033: one info, Not determined. An aws_rds_cluster with no engine (Aurora; provider v5 defaulted it to "aurora")
+# and no storage_encrypted. AWS encrypts Aurora clusters created on or after 2026-02-16 whatever the
+# configuration says, and the configuration does not say when this one was created.
+
+resource "aws_rds_cluster" "app1-rds-cluster" {
+  cluster_identifier      = "app1-rds-cluster"
+  allocated_storage       = 10
+  backup_retention_period = 0
+  tags = {
+    git_commit           = "079fe74f6b96d887c245664fbd8cf676c92f20e5"
+    git_file             = "terraform/aws/rds.tf"
+    git_last_modified_at = "2021-12-08 23:26:32"
+    git_last_modified_by = "tron47@gmail.com"
+    git_modifiers        = "tron47"
+    git_org              = "matansha"
+    git_repo             = "terragoat"
+    yor_trace            = "b6f2c2ec-0715-46a0-83d4-502e588826d1"
+  }
+}