add resource permission checks #2446

	name: checkov

	on:
	workflow_dispatch:
	push:
	branches:
	- main
	pull_request:
	branches:
	- main
	- v2m*

	permissions:
	contents: read

	jobs:
	build:
	env:
	CDK_DEFAULT_REGION: us-east-1
	AWS_REGION: us-east-1
	CDK_DEFAULT_ACCOUNT: 111111111111
	GITHUB_ACTIONS: true
	CHECKOV_ACTIONS: true
	DATAALL_REPO_BRANCH: main
	strategy:
	matrix:
	python-version: [3.9]
	services:
	postgres:
	image: postgres
	env:
	POSTGRES_DB: dataall
	POSTGRES_PASSWORD: docker
	POSTGRES_USER: postgres
	ports:
	- 5432:5432
	options: >-
	--health-cmd pg_isready
	--health-interval 10s
	--health-timeout 5s
	--health-retries 5
	runs-on: ubuntu-latest
	steps:
	- name: Git clone
	uses: actions/checkout@v4
	- name: Set up Node.js
	uses: actions/setup-node@v3
	- name: Install CDK
	run: \|
	npm install -g aws-cdk cdk-nag
	cdk --version
	- name: Set up Python ${{ matrix.python-version }}
	uses: actions/setup-python@v4
	with:
	python-version: ${{ matrix.python-version }}
	- name: Upgrade Pip
	run: python -m pip install --upgrade pip
	- name: Install Requirements
	run: python -m pip install -r deploy/requirements.txt
	- name: CDK Synth
	run: \|
	npx cdk synth
	- name: Resources CDK Synth
	run: make checkov-synth
	- name: Test with Checkov
	id: checkov
	uses: bridgecrewio/[email protected]
	with:
	directory: .
	quiet: true
	skip_path: tests/, .github, compose/, docker/dev/
	hard_fail_on: MEDIUM
	soft_fail_on: LOW
	baseline: .checkov.baseline

Provide feedback