Repository navigation
GitHub Actions / Tirith IaC Governance
failed
Oct 12, 2026 in 0s
Tirith — 1 failed, 1 warned, 9 passed
🛡️ Tirith — 1 failed, 1 warned, 9 passed
Scanned commit 676d7ca · dir . · workflow github-com-StackGuardian-tirith-action-demo-deploy
+ aws_s3_bucket.analytics create
+ bucket = "demo-tirith-action-analytics-790543352839"
+ force_destroy = false
+ tags = {"Demo":"tirith-action-demo","Name":"tirith-action-demo","Owner":""}
… and 24 computed attribute(s), known after applyPlan: 1 to add, 0 to change, 0 to destroy. 5 unchanged.
| Policy | Rule | Resource | |
|---|---|---|---|
__sg.checkov-best-practices |
checkov-best-practices |
aws_s3_bucket.analytics, aws_s3_bucket.artifacts |
|
| ✅ | __sg.repo-scan |
ci-long-lived-cloud-credentials |
— |
| ✅ | __sg.repo-scan |
ci-untrusted-actions |
— |
| ✅ | __sg.repo-scan |
ci-risky-triggers |
— |
| ✅ | __sg.repo-scan |
ci-terraform-validation |
— |
| ✅ | __sg.repo-scan |
remote-state-backend |
— |
| ✅ | __sg.repo-scan |
state-encryption |
— |
| ✅ | __sg.repo-scan |
provider-lock-file |
— |
| ✅ | tirith-demo-cost-ceiling |
monthly-cost-ceiling |
— |
| ✅ | tirith-demo-opa-check |
s3-naming-and-region |
— |
| ❌ | tirith-demo-s3-owner-tag |
s3-buckets-must-declare-an-owner |
aws_s3_bucket.analytics, aws_s3_bucket.artifacts |
⚠️ __sg.checkov-best-practices › checkov-best-practices
Ensure S3 buckets should have event notifications enabledEnsure S3 buckets should have event notifications enabledEnsure that an S3 bucket has a lifecycle configurationEnsure the S3 bucket has access logging enabledEnsure that S3 bucket has a Public Access blockEnsure that S3 bucket has cross-region replication enabledEnsure that S3 bucket has cross-region replication enabledEnsure that S3 buckets are encrypted with KMS by defaultEnsure all data stored in the S3 bucket have versioning enabled
Resources:
aws_s3_bucket.analyticsaws_s3_bucket.artifacts
❌ tirith-demo-s3-owner-tag › s3-buckets-must-declare-an-owner
Owner tag on every planned S3 bucket[aws_s3_bucket.analytics (create)] tags.Owner: `""` is empty[aws_s3_bucket.artifacts (no-op)] tags.Owner: `"rafid.aslam"` is not empty
Resources:
aws_s3_bucket.analyticsaws_s3_bucket.artifacts
💵 Estimated monthly cost: 1.00 USD (+1.00 from this change)
✅ 9 passed · View run in StackGuardian
Loading