chore: revisit skipped Checkov findings

[edersonbrilhante]

Summary

Track the temporary #checkov:skip inventory in Forge modules and decide, resource by resource, whether each skip should be replaced with a code fix, kept as a documented accepted exception, or removed after regression testing.

This exists because the module-layout refactor intentionally suppresses the current open Checkov findings first, so the branch can keep testing focused while we validate the behavior of KMS, S3, SQS, DynamoDB, SSM, IAM, and security group changes end to end.

Scope

• S3 bucket encryption, lifecycle, ACL ownership, replication, event notification, and access logging skips.
• CloudWatch Log Group customer-managed KMS encryption skips.
• SQS and DynamoDB customer-managed KMS encryption skips.
• SSM parameter customer-managed KMS skips for GitHub App bootstrap values.
• KMS key policy and rotation skips.
• IAM wildcard/resource-scope skips for helpers, tenant bootstrap, Splunk integrations, Teleport discovery, CloudFormation StackSets, and runner image operations.
• Security group egress and description skips for generated runner Lambda networking.
• Terraform module source pinning skips that are currently handled by Renovate-managed version tags.
• Vendor-managed CloudFormation template notification skips.

Acceptance Criteria

• Reproduce the inventory with:

  rg -n "#checkov:skip" modules
  checkov --directory modules --framework terraform --compact

• For every skip, choose one outcome:

  • fix the Terraform and remove the skip,
  • keep the skip with a clear accepted-risk reason,
  • split the module/configuration so stricter defaults can be enabled without breaking existing deployments.

• Validate changes with Terraform/OpenTofu formatting and Checkov.

• Add deployment or regression coverage before tightening behavior that may affect existing Forge examples, especially:

  • Splunk Cloud Data Manager template delivery from S3,
  • Splunk billing export buckets,
  • GitHub App SSM bootstrap and manual private-key update flow,
  • GitHub webhook relay cross-account secret access,
  • EC2 runner Lambda egress,
  • job-log S3/SQS/Lambda paths,
  • ARC and EC2 tenant deployments.

Current Local Baseline

The current local scan on the module-layout branch reports:

Passed checks: 777
Failed checks: 0
Skipped checks: 122
Parsing errors: 1

The parse warning is for modules/infra/eks/karpenter.tf and should be reviewed separately from the skip cleanup.