🔍 Repository Review: Version Mismatches, Incomplete Docs, Cross-Repo Drift, and Test Coverage Gaps

[oldmanbendobot]

Review Summary

Repository review completed on 2026-02-27. This module has several issues affecting maintainability, cross-repo consistency, and documentation quality.

Findings

1. Version & Documentation Mismatches ⚠️

• AWS Provider Version Comment Stale: versions.tf says "Use a v5.x.x version" but pinned to ~> 6.0. Update comment.
• terraform-null-label Module Mismatch: main.tf pins to 0.5.0 but README shows 0.4.2 from auto-generated docs. Need to sync or regenerate.
• terraform-docs Hook Disabled: Pre-commit hook for terraform-docs is commented out, but README contains auto-generated docs. This is inconsistent — either enable the hook or remove auto-generated marker from docs.

2. Cross-Repository Consistency Drift 🔀

Pre-commit hook versions diverge from terraform-aws-apigateway (recently reviewed):

• pre-commit-hooks: v4.6.0 (lambda) vs v5.0.0 (apigateway) — out of sync
• gruntwork pre-commit: v0.1.28 (lambda) vs v0.1.29 (apigateway) — needs upgrade
• trivy: v0.12.0 (lambda) vs v0.15.0 (apigateway) — needs upgrade
• gitleaks: v8.18.4 (lambda) vs v8.25.1 (apigateway) — needs upgrade

Recommend standardizing pre-commit versions across all modules in the org.

3. Incomplete Documentation 📝

README contains placeholder sections:

• "About The Project" → TODO
• "Usage" → TODO

These should be filled in or removed. Stale documentation reduces usability.

4. Test Coverage Gaps ❌

Only one test case (TestDefaults). Missing comprehensive coverage for:

• VPC configuration (subnet_ids + security_group_ids interaction)
• X-Ray tracing enabled/disabled modes
• KMS encryption for environment variables
• KMS encryption for CloudWatch logs
• Multiple architectures (x86_64, arm64)
• Additional policies and inline policies attachment
• Edge Lambda assume role policy (addl_assume_role_policy_principles)
• Layers attachment

Current single test only validates the happy path. These features should have explicit test coverage.

5. Go Module Health ✅

• go mod tidy: Clean (no changes needed)
• govulncheck: Unable to verify in review environment (Go not installed), but no obvious transitive vulnerabilities visible in go.sum

6. Best Practices Notes

• IAM policy has appropriate wildcard suppression comment (tfsec:ignore:aws-iam-no-policy-wildcards) for log streams — good practice documented.
• X-Ray and VPC policies use managed policies (AWSXrayWriteOnlyAccess, AWSLambdaVPCAccessExecutionRole) — appropriate and minimal.
• CloudWatch log group creation is optional (enable_cloudwatch_logs) — good.

7. Security Observations

• All defaults are reasonably secure (CloudWatch logs enabled, no KMS required unless specified, tracing disabled by default)
• No public access vectors exposed by the module itself
• Pre-commit security scanning (gitleaks, trivy, pre-commit-hooks) is configured

Recommended Actions

Priority order:

1. High: Update version comments and sync module dependencies. Regenerate README if terraform-docs hook is re-enabled.
2. High: Standardize pre-commit hook versions with other repos (suggests an org-wide config file might be better).
3. Medium: Expand test coverage for optional features (VPC, tracing, KMS, layers, policies).
4. Medium: Complete or remove TODO sections in README.
5. Low: Document default security posture (why CloudWatch retention is 30 days, why certain features are disabled by default).

Cross-Repo Consistency Note

Consider whether pre-commit configurations should be pulled from a centralized template (bendoerr-terraform-modules/terraform-module-repo-template?) rather than maintained per-repo. This would eliminate drift.

---

Status: Awaiting approval before implementation. Do not start work on fixes without explicit approval.