Improve Terraform auditing

[michaelsaki]

💡 Summary

We should add some improvements to our Terraform auditing.

Motivation and context

Currently we use terraform validate in our pre-commit linting. It works great for making sure that the TF configurations are valid but it doesn't check if they are secure. I suggest that we add Checkov or some other tool into our CI/CD pipeline to ensure that any TF configuration is also secure.

Acceptance criteria

How do we know when this work is done?

• Terraform files are being audited for security vulnerabilities early in our CI/CD pipeline.

[michaelsaki]

Initial local tests look good for using this tool. I haven't ran tests in GitHub Actions just yet. The biggest hurdle will be fixing all the downstream repos that use Terraform. I made an issue on cool-assessment-terraform to begin fixing these lint issues since it is the largest Terraform repo.