tfsec -> trivy

Author: skwashd

.github/workflows/pr.yml

@@ -66,11 +66,20 @@ jobs:
         id: validate
         run: terraform validate
 
-      - name: tfsec
-        id: tfsec
-        uses: aquasecurity/tfsec-action@b466648d6e39e7c75324f25d83891162a721f2d6 # v1.0.3
+      - name: Trivy Scan Config
+        id: trivy-config
+        uses: aquasecurity/trivy-action@0.33.1
         with:
-          github_token: ${{ github.token }}
+          scan-type: 'config'
+          scan-ref: '.'
+
+      - name: Trivy Scan Filesystem
+        id: trivy-fs
+        uses: aquasecurity/trivy-action@0.33.1
+        with:
+          scan-type: 'fs'
+          scan-ref: '.'
+          skip-setup-trivy: true
 
       - name: Setup TFLint
         id: tflint-setup

s3.tf

@@ -3,7 +3,7 @@ data "aws_s3_bucket" "this" {
   bucket = var.s3_bucket
 }
 
-# tfsec:ignore:aws-s3-enable-bucket-logging We support bring your own bucket (BYOB) if access logging is needed.
+# trivy:ignore:AVD-AWS-0089 We support bring your own bucket (BYOB) if access logging is needed.
 resource "aws_s3_bucket" "this" {
   count  = local.create_bucket ? 1 : 0
   bucket = "${data.aws_caller_identity.current.account_id}-${data.aws_region.current.name}-${local.function_name}"