chore: fix the TfSec findings (high/medium/low) (#1327)

## Description

There were already `tfsec:ignore:` in the code, but they were placed on
the wrong element.

Closes #1311

Author: kayman-mk

.cspell.json

@@ -94,6 +94,7 @@
     "cpus",
     "cpuset",
     "gitter",
+    "imds",
     "netsh",
     "Niek",
     "oxsecurity",

docker_autoscaler.tf

@@ -57,6 +57,8 @@ resource "aws_launch_template" "this" {
 
   tags = local.tags
 
+  # as per user decision. The module default is "required" for better security.
+  # tfsec:ignore:aws-ec2-enforce-launch-config-http-token-imds
   metadata_options {
     http_tokens                 = var.runner_worker_docker_autoscaler_instance.http_tokens
     http_put_response_hop_limit = var.runner_worker_docker_autoscaler_instance.http_put_response_hop_limit

logging.tf

@@ -13,6 +13,8 @@ locals {
   provided_kms_key = var.kms_key_id != "" ? var.kms_key_id : ""
 }
 
+# ignored as decided by the user
+# tfsec:ignore:aws-cloudwatch-log-group-customer-key
 resource "aws_cloudwatch_log_group" "environment" {
   count = var.runner_cloudwatch.enable ? 1 : 0
   name  = var.runner_cloudwatch.log_group_name != null ? var.runner_cloudwatch.log_group_name : var.environment
@@ -22,7 +24,6 @@ resource "aws_cloudwatch_log_group" "environment" {
   tags              = local.tags
 
   # ignored as decided by the user
-  # tfsec:ignore:aws-cloudwatch-log-group-customer-key
   # checkov:skip=CKV_AWS_158:Encryption can be enabled by user
   kms_key_id = local.kms_key_arn
 }

modules/cache/main.tf

@@ -41,9 +41,10 @@ resource "aws_s3_bucket" "build_cache" {
 resource "aws_s3_bucket_versioning" "build_cache_versioning" {
   bucket = aws_s3_bucket.build_cache.id
 
+  # ok as decided by the user
+  # tfsec:ignore:aws-s3-enable-versioning
   versioning_configuration {
     # ok as decided by the user
-    # tfsec:ignore:aws-s3-enable-versioning
     # kics-scan ignore-line
     status = var.cache_bucket_versioning ? "Enabled" : "Suspended"
   }

modules/terminate-agent-hook/cloudwatch.tf

@@ -28,13 +28,14 @@ resource "aws_cloudwatch_event_target" "terminate_instances" {
   arn       = aws_lambda_function.terminate_runner_instances.arn
 }
 
+# ok as encryption can be activated by the user
+# tfsec:ignore:aws-cloudwatch-log-group-customer-key
 resource "aws_cloudwatch_log_group" "lambda" {
   name = "/aws/lambda/${var.environment}-${var.name}"
   # checkov:skip=CKV_AWS_338:There is no need to store the logs for 1+ years. They are not critical.
   retention_in_days = var.cloudwatch_logging_retention_in_days
 
   # ok as encryption can be activated by the user
-  # tfsec:ignore:aws-cloudwatch-log-group-customer-key
   # checkov:skip=CKV_AWS_158:Encryption can be activated by the user
   kms_key_id = var.kms_key_id
 

modules/terminate-agent-hook/main.tf

@@ -43,8 +43,8 @@ resource "aws_vpc_security_group_egress_rule" "docker_autoscaler_egress" {
 }
 
 # tracing functions can be activated by the user
-# tfsec:ignore:aws-lambda-enable-tracing
 # kics-scan ignore-line
+# tfsec:ignore:aws-lambda-enable-tracing
 resource "aws_lambda_function" "terminate_runner_instances" {
   #ts:skip=AC_AWS_0485:Tracing functions can be activated by the user
   # checkov:skip=CKV_AWS_50:Tracing functions can be activated by the user

variables.tf

@@ -775,7 +775,8 @@ variable "runner_worker_docker_autoscaler_instance" {
 EOT
 
   type = object({
-    ebs_optimized               = optional(bool, true)
+    ebs_optimized = optional(bool, true)
+    # TODO should always be "required", right? https://aquasecurity.github.io/tfsec/v1.28.0/checks/aws/ec2/enforce-launch-config-http-token-imds/
     http_tokens                 = optional(string, "required")
     http_put_response_hop_limit = optional(number, 2)
     monitoring                  = optional(bool, false)