Prevent error when aws_required_tags is not set

[fernandogoncalves-me]

When aws_required_tags is not set, Terraform throws the following error:

Error: Invalid function argument

  on .terraform/modules/landing_zone/organizations_policy.tf line 61, in resource "aws_organizations_policy" "required_tags":
  61:     for ou in data.aws_organizations_organizational_units.default.children : ou.name => ou if contains(keys(try(var.aws_required_tags, {})), ou.name)
    |----------------
    | var.aws_required_tags is null

Invalid value for "inputMap" parameter: argument must not be null.

This change adds a way to prevent this error from happening.

[github-actions]

Terraform Security Scan Failed

Show Output

Problem 1

  [AWS063][WARNING] Resource 'aws_cloudtrail.additional_auditing_trail' does not set multi region trail config.
  /github/workspace/main.tf:1-6

       1 | resource "aws_cloudtrail" "additional_auditing_trail" {
       2 |   count                 = var.additional_auditing_trail != null ? 1 : 0
       3 |   name                  = var.additional_auditing_trail.name
       4 |   s3_bucket_name        = var.additional_auditing_trail.bucket
       5 |   is_organization_trail = true
       6 | }
       7 | 
       8 | resource "aws_cloudwatch_log_metric_filter" "iam_activity_master" {
       9 |   for_each = var.monitor_iam_activity ? local.iam_activity : {}

   See https://tfsec.dev/docs/aws/AWS063/ for more information. 

Problem 2

  [AWS064][WARNING] Resource 'aws_cloudtrail.additional_auditing_trail' does not enable log file validation.
  /github/workspace/main.tf:1-6

       1 | resource "aws_cloudtrail" "additional_auditing_trail" {
       2 |   count                 = var.additional_auditing_trail != null ? 1 : 0
       3 |   name                  = var.additional_auditing_trail.name
       4 |   s3_bucket_name        = var.additional_auditing_trail.bucket
       5 |   is_organization_trail = true
       6 | }
       7 | 
       8 | resource "aws_cloudwatch_log_metric_filter" "iam_activity_master" {
       9 |   for_each = var.monitor_iam_activity ? local.iam_activity : {}

   See https://tfsec.dev/docs/aws/AWS064/ for more information. 

Problem 3

  [AWS065][ERROR] Resource 'aws_cloudtrail.additional_auditing_trail' does not have a kms_key_id set.
  /github/workspace/main.tf:1-6

       1 | resource "aws_cloudtrail" "additional_auditing_trail" {
       2 |   count                 = var.additional_auditing_trail != null ? 1 : 0
       3 |   name                  = var.additional_auditing_trail.name
       4 |   s3_bucket_name        = var.additional_auditing_trail.bucket
       5 |   is_organization_trail = true
       6 | }
       7 | 
       8 | resource "aws_cloudwatch_log_metric_filter" "iam_activity_master" {
       9 |   for_each = var.monitor_iam_activity ? local.iam_activity : {}

   See https://tfsec.dev/docs/aws/AWS065/ for more information. 

  times
  ------------------------------------------
  disk i/o             8.857622ms
  parsing HCL          43.999µs
  evaluating values    9.5288ms
  running checks       4.320264ms

  counts
  ------------------------------------------
  files loaded         10
  blocks               94
  evaluated blocks     94
  modules              0
  module blocks        0

3 potential problems detected.