fix: address 4 critical security and operational issues from PR review

1. Add Terraform state locking with DynamoDB
   - Add dynamodb_table to S3 backend configuration
   - Prevents state corruption from concurrent operations

2. Restrict IAM CloudWatch Logs policy
   - Change Resource from '*' to 'arn:aws:logs:*:*:log-group:/aws/eks/*'
   - Limit permissions to EKS log groups only

3. Pin ArgoCD version to v2.10.4
   - Replace 'stable' tag with explicit version
   - Prevent uncontrolled updates and ensure reproducibility

4. Add error handling for terrascan results
   - Check if terrascan-results.json exists before parsing
   - Set counts to 0 if file is missing
   - Add 'if: always()' to parse step
   - Prevent workflow failure when terrascan doesn't produce output

Author: tukue

.github/workflows/terraform-scan.yml

@@ -71,17 +71,24 @@ jobs:
             -o human | tee terrascan-human.txt
         continue-on-error: true
 
-      - name: Parse Results
-        id: parse
-        run: |
-          HIGH_COUNT=$(jq -r '.results.violations | map(select(.severity == "HIGH")) | length' terrascan-results.json || echo "0")
-          MEDIUM_COUNT=$(jq -r '.results.violations | map(select(.severity == "MEDIUM")) | length' terrascan-results.json || echo "0")
-          echo "high_severity_count=${HIGH_COUNT}" >> $GITHUB_ENV
-          echo "medium_severity_count=${MEDIUM_COUNT}" >> $GITHUB_ENV
-          
-          echo "Summary of findings:"
-          echo "High severity issues: ${HIGH_COUNT}"
-          echo "Medium severity issues: ${MEDIUM_COUNT}"
+      - name: Parse Results
+        id: parse
+        if: always()
+        run: |
+          if [ -f terrascan-results.json ]; then
+            HIGH_COUNT=$(jq -r '.results.violations | map(select(.severity == "HIGH")) | length' terrascan-results.json || echo "0")
+            MEDIUM_COUNT=$(jq -r '.results.violations | map(select(.severity == "MEDIUM")) | length' terrascan-results.json || echo "0")
+          else
+            echo "Terrascan results file not found, setting counts to 0"
+            HIGH_COUNT=0
+            MEDIUM_COUNT=0
+          fi
+          echo "high_severity_count=${HIGH_COUNT}" >> $GITHUB_ENV
+          echo "medium_severity_count=${MEDIUM_COUNT}" >> $GITHUB_ENV
+          
+          echo "Summary of findings:"
+          echo "High severity issues: ${HIGH_COUNT}"
+          echo "Medium severity issues: ${MEDIUM_COUNT}"
 
       - name: Upload Results
         uses: actions/upload-artifact@v4

infra/backend.tf

@@ -2,9 +2,10 @@ terraform {
   required_version = ">= 1.6.0"
 
   backend "s3" {
-    bucket  = "my-terraform-state-eks-infra"
-    key     = "simpleApp/terraform.tfstate"
-    region  = "eu-north-1"
-    encrypt = true
+    bucket         = "my-terraform-state-eks-infra"
+    key            = "simpleApp/terraform.tfstate"
+    region         = "eu-north-1"
+    encrypt        = true
+    dynamodb_table = "terraform-state-lock"
   }
 }

infra/modules/iam/main.tf

@@ -97,7 +97,7 @@ resource "aws_iam_policy" "cloudwatch_logs" {
           "logs:DescribeLogStreams"
         ]
         Effect   = "Allow"
-        Resource = "*"
+        Resource = "arn:aws:logs:*:*:log-group:/aws/eks/*"
       }
     ]
   })

platform/bootstrap/install-argocd.sh

@@ -3,13 +3,15 @@
 
 set -e
 
+ARGOCD_VERSION="v2.10.4"
+
 echo "Creating argocd namespace..."
 kubectl create namespace argocd || true
 
-echo "Installing Argo CD..."
-kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml
+echo "Installing Argo CD ${ARGOCD_VERSION}..."
+kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/${ARGOCD_VERSION}/manifests/install.yaml
 
 echo "Waiting for Argo CD to be ready..."
 kubectl wait --for=condition=available --timeout=300s deployment/argocd-server -n argocd
 
-echo "Argo CD installed successfully."
+echo "Argo CD ${ARGOCD_VERSION} installed successfully."