feat(tfsec): add multiple tfvars files for testing

.github/workflows/tfsec.yml

@@ -7,3 +7,4 @@ jobs:
     with:
       terraform-version: "1.2.7"
       working-directory: "./"
+      tfsec-var-files: '["test/default.tfvars", "test/a.tfvars"]'

iam.tf

@@ -26,6 +26,7 @@ data "aws_iam_policy_document" "this" {
       "logs:PutLogEvents"
     ]
 
+    # This only allows creating log streams and putting log events in this specific log group
     #tfsec:ignore:aws-iam-no-policy-wildcards
     resources = ["${aws_cloudwatch_log_group.this.arn}:*", ]
   }
@@ -53,6 +54,13 @@ data "aws_iam_policy_document" "this" {
         "ec2:AssignPrivateIpAddresses",
         "ec2:UnassignPrivateIpAddresses",
       ]
+
+      # This policy is a narrowed-down version of the AWS-Managed policy.
+      # https://us-east-1.console.aws.amazon.com/iam/home#/policies/arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole$jsonEditor
+      # 
+      # It cannot be more narrow than this, otherwise AWS Lambda won't be able to
+      # associate the Lambda Function to the VPC.
+      #tfsec:ignore:aws-iam-no-policy-wildcards
       resources = ["*"]
     }
   }

test/a.tfvars

@@ -0,0 +1,10 @@
+xray_tracing_enabled = true
+vpc_config = {
+  subnet_ids        = ["32b32baa-551b-49ba-a848-33db3bcac03c", "77e41782-96e0-4010-8310-07c058f3f93c"]
+  security_group_id = ["dbf42868-3864-41c1-afe1-e9b6b925054f"]
+}
+dead_letter_arn = "arn:aws:sqs:29ab394a-f3e8-4a59-bed8-9d3fe634ae78"
+file_system_config = {
+  arn       = "af60424e-70bb-4c07-964f-120fb5533f5c"
+  read_only = false
+}