CCM-6245: TFSec Scanning

.github/actions/tfsec/action.yaml

@@ -0,0 +1,21 @@
+name: "TFSec Scan"
+description: "Scan HCL using TFSec"
+inputs:
+  root-modules:
+    description: "Comma separated list of root module directories to validate, content of the 'infrastructure/environments' is checked by default"
+    required: false
+runs:
+  using: "composite"
+  steps:
+    - name: "TFSec Scan Components"
+      shell: bash
+      run: |
+        for component in $(find infrastructure/terraform/components -mindepth 1 -type d); do
+          scripts/terraform/tfsec.sh $component
+        done
+    - name: "TFSec Scan Modules"
+      shell: bash
+      run: |
+        for module in $(find infrastructure/terraform/modules -mindepth 1 -type d); do
+          scripts/terraform/tfsec.sh $module
+        done

.github/workflows/stage-1-commit.yaml

@@ -86,6 +86,15 @@ jobs:
         uses: actions/checkout@v4
       - name: "Lint Terraform"
         uses: ./.github/actions/lint-terraform
+  tfsec:
+    name: "TFSec Scan"
+    runs-on: ubuntu-latest
+    timeout-minutes: 2
+    steps:
+      - name: "Checkout code"
+        uses: actions/checkout@v4
+      - name: "Lint Terraform"
+        uses: ./.github/actions/tfsec
   count-lines-of-code:
     name: "Count lines of code"
     runs-on: ubuntu-latest

.tool-versions

@@ -4,6 +4,7 @@ terraform 1.9.1
 pre-commit 3.6.0
 nodejs 18.18.2
 gitleaks 8.18.4
+tfsec 1.28.10
 
 # ==============================================================================
 # The section below is reserved for Docker image versions.

.vscode/settings.json

@@ -9,7 +9,6 @@
     "**/CVS": true,
     "**/Thumbs.db": true,
     ".devcontainer": true,
-    ".github": true,
     ".vscode": false
   }
 }

scripts/config/tfsec.yaml

@@ -0,0 +1 @@
+minimum_severity: MEDIUM

scripts/terraform/tfsec.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+
+# Check if tfsec is installed
+if ! command -v tfsec &> /dev/null; then
+    echo "tfsec could not be found, please install it first."
+    exit 1
+fi
+
+# Check if a directory was passed as an argument
+if [ "$#" -eq 1 ]; then
+    DIR_TO_SCAN="$1"
+elif [ "$#" -gt 1 ]; then
+    echo "Usage: $0 [directory]"
+    exit 1
+fi
+
+# Run tfsec
+echo "Running tfsec on directory: $DIR_TO_SCAN"
+tfsec \
+    --concise-output \
+    --force-all-dirs \
+    --exclude-downloaded-modules \
+    --config-file ../config/tfsec.yaml
+    "$DIR_TO_SCAN"
+
+
+# Check the exit status of tfsec
+if [ $? -eq 0 ]; then
+    echo "tfsec completed successfully."
+else
+    echo "tfsec found issues."
+    exit 1
+fi