Bump certifi from 2022.12.7 to 2023.7.22 in /modules/analyzer/slack/slack

[dependabot]

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

Bumps certifi from 2022.12.7 to 2023.7.22.

Commits

• 8fb96ed 2023.07.22
• afe7722 Bump actions/setup-python from 4.6.1 to 4.7.0 (#230)
• 2038739 Bump dessant/lock-threads from 3.0.0 to 4.0.1 (#229)
• 44df761 Hash pin Actions and enable dependabot (#228)
• 8b3d7ba 2023.05.07
• 53da240 ci: Add Python 3.12-dev to the testing (#224)
• c2fc3b1 Create a Security Policy (#222)
• c211ef4 Set up permissions to github workflows (#218)
• 2087de5 Don't let deprecation warning fail CI (#219)
• e0b9fc5 remove paragraphs about 1024-bit roots from README
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[anmolnagpal]

Terraform Security Scan Failed

Show Output

Result #1 HIGH No public access block so not ignoring public acls 
────────────────────────────────────────────────────────────────────────────────
  modules/guardduty/main.tf:22-26
   via main.tf:116-138 (module.guardduty)
────────────────────────────────────────────────────────────────────────────────
   22    resource "aws_s3_bucket" "bucket" {
   23      count         = var.enabled ? 1 : 0
   24      bucket        = var.bucket_name
   25      force_destroy = true
   26    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-s3-ignore-public-acls
      Impact PUT calls with public ACLs specified can make objects public
  Resolution Enable ignoring the application of public ACLs in PUT calls

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/s3/ignore-public-acls/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block#ignore_public_acls
────────────────────────────────────────────────────────────────────────────────


Result #2 HIGH No public access block so not restricting public buckets 
────────────────────────────────────────────────────────────────────────────────
  modules/guardduty/main.tf:22-26
   via main.tf:116-138 (module.guardduty)
────────────────────────────────────────────────────────────────────────────────
   22    resource "aws_s3_bucket" "bucket" {
   23      count         = var.enabled ? 1 : 0
   24      bucket        = var.bucket_name
   25      force_destroy = true
   26    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-s3-no-public-buckets
      Impact Public buckets can be accessed by anyone
  Resolution Limit the access to public buckets to only the owner or AWS Services (eg; CloudFront)

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/s3/no-public-buckets/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block#restrict_public_buckets¡
────────────────────────────────────────────────────────────────────────────────


Result #3 MEDIUM Bucket does not have logging enabled 
────────────────────────────────────────────────────────────────────────────────
  modules/guardduty/main.tf:22-26
   via main.tf:116-138 (module.guardduty)
────────────────────────────────────────────────────────────────────────────────
   22    resource "aws_s3_bucket" "bucket" {
   23      count         = var.enabled ? 1 : 0
   24      bucket        = var.bucket_name
   25      force_destroy = true
   26    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-s3-enable-bucket-logging
      Impact There is no way to determine the access to this bucket
  Resolution Add a logging block to the resource to enable access logging

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/s3/enable-bucket-logging/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket
────────────────────────────────────────────────────────────────────────────────


Result #4 MEDIUM Bucket does not have versioning enabled 
────────────────────────────────────────────────────────────────────────────────
  modules/guardduty/main.tf:22-26
   via main.tf:116-138 (module.guardduty)
────────────────────────────────────────────────────────────────────────────────
   22    resource "aws_s3_bucket" "bucket" {
   23      count         = var.enabled ? 1 : 0
   24      bucket        = var.bucket_name
   25      force_destroy = true
   26    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-s3-enable-versioning
      Impact Deleted or modified data would not be recoverable
  Resolution Enable versioning to protect against accidental/malicious removal or modification

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/s3/enable-versioning/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#versioning
────────────────────────────────────────────────────────────────────────────────


Result #5 MEDIUM Password policy allows a maximum password age of greater than 90 days. 
────────────────────────────────────────────────────────────────────────────────
  modules/iam/main.tf:28
   via main.tf:229-251 (module.aws-iam-baseline)
────────────────────────────────────────────────────────────────────────────────
   19    resource "aws_iam_account_password_policy" "default" {
   20      count                          = var.aws_iam_account_password_policy ? 1 : 0
   21      minimum_password_length        = var.minimum_password_length
   22      password_reuse_prevention      = var.password_reuse_prevention
   23      require_lowercase_characters   = var.require_lowercase_characters
   24      require_numbers                = var.require_numbers
   25      require_uppercase_characters   = var.require_uppercase_characters
   26      require_symbols                = var.require_symbols
   27      allow_users_to_change_password = var.allow_users_to_change_password
   ..  
────────────────────────────────────────────────────────────────────────────────
          ID aws-iam-set-max-password-age
      Impact Long life password increase the likelihood of a password eventually being compromised
  Resolution Limit the password duration with an expiry in the policy

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/iam/set-max-password-age/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_account_password_policy
────────────────────────────────────────────────────────────────────────────────


Result #6 LOW Log group is not encrypted. 
────────────────────────────────────────────────────────────────────────────────
  modules/cloudtrail/main.tf:135-140
   via main.tf:5-30 (module.cloudtrail)
────────────────────────────────────────────────────────────────────────────────
  135    resource "aws_cloudwatch_log_group" "cloudtrail_events" {
  136      count             = var.enabled ? 1 : 0
  137      name              = var.cloudwatch_logs_group_name
  138      retention_in_days = var.cloudwatch_logs_retention_in_days
  139      tags              = module.labels.tags
  140    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-cloudwatch-log-group-customer-key
      Impact Log data may be leaked if the logs are compromised. No auditing of who have viewed the logs.
  Resolution Enable CMK encryption of CloudWatch Log Groups

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/cloudwatch/log-group-customer-key/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group#kms_key_id
────────────────────────────────────────────────────────────────────────────────


Result #7 LOW Bucket does not have a corresponding public access block. 
────────────────────────────────────────────────────────────────────────────────
  modules/guardduty/main.tf:22-26
   via main.tf:116-138 (module.guardduty)
────────────────────────────────────────────────────────────────────────────────
   22    resource "aws_s3_bucket" "bucket" {
   23      count         = var.enabled ? 1 : 0
   24      bucket        = var.bucket_name
   25      force_destroy = true
   26    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-s3-specify-public-access-block
      Impact Public access policies may be applied to sensitive data buckets
  Resolution Define a aws_s3_bucket_public_access_block for the given bucket to control public access policies

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/s3/specify-public-access-block/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block#bucket
────────────────────────────────────────────────────────────────────────────────


  timings
  ──────────────────────────────────────────
  disk i/o             963.205µs
  parsing              485.005838ms
  adaptation           3.427121ms
  checks               24.489749ms
  total                513.885913ms

  counts
  ──────────────────────────────────────────
  modules downloaded   0
  modules processed    11
  blocks processed     507
  files read           41

  results
  ──────────────────────────────────────────
  passed               13
  ignored              4
  critical             0
  high                 2
  medium               3
  low                  2

  13 passed, 4 ignored, 7 potential problem(s) detected.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.