diff --git a/README.md b/README.md index bd848d5fa..95137d660 100644 --- a/README.md +++ b/README.md @@ -8,7 +8,8 @@ * [3. Add configs and hooks](#3-add-configs-and-hooks) * [4. Run](#4-run) * [Available Hooks](#available-hooks) -* [Hooks notes](#hooks-notes) +* [Hooks usage notes and examples](#hooks-usage-notes-and-examples) + * [checkov](#checkov) * [terraform_docs](#terraform_docs) * [terraform_tflint](#terraform_tflint) * [terraform_tfsec](#terraform_tfsec) @@ -176,21 +177,34 @@ There are several [pre-commit](https://pre-commit.com/) hooks to keep Terraform | Hook name | Description | | ------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| `terraform_fmt` | Rewrites all Terraform configuration files to a canonical format. [Hook notes](#terraform_docs) | -| `terraform_validate` | Validates all Terraform configuration files. [Hook notes](#terraform_validate) | -| `terraform_docs` | Inserts input and output documentation into `README.md`. Recommended. | -| `terraform_docs_without_aggregate_type_defaults` | Inserts input and output documentation into `README.md` without aggregate type defaults. | +| `checkov` | [checkov](https://github.com/bridgecrewio/checkov) static analysis of terraform templates to spot potential security issues. [Hook notes](#checkov) | | `terraform_docs_replace` | Runs `terraform-docs` and pipes the output directly to README.md | +| `terraform_docs_without_aggregate_type_defaults` | Inserts input and output documentation into `README.md` without aggregate type defaults. | +| `terraform_docs` | Inserts input and output documentation into `README.md`. Recommended. | +| `terraform_fmt` | Rewrites all Terraform configuration files to a canonical format. [Hook notes](#terraform_docs) | | `terraform_tflint` | Validates all Terraform configuration files with [TFLint](https://github.com/terraform-linters/tflint). [Available TFLint rules](https://github.com/terraform-linters/tflint/tree/master/docs/rules#rules). [Hook notes](#terraform_tflint). | +| `terraform_tfsec` | [TFSec](https://github.com/liamg/tfsec) static analysis of terraform templates to spot potential security issues. [Hook notes](#terraform_tfsec) | +| `terraform_validate` | Validates all Terraform configuration files. [Hook notes](#terraform_validate) | | `terragrunt_fmt` | Rewrites all [Terragrunt](https://github.com/gruntwork-io/terragrunt) configuration files (`*.hcl`) to a canonical format. | | `terragrunt_validate` | Validates all [Terragrunt](https://github.com/gruntwork-io/terragrunt) configuration files (`*.hcl`) | -| `terraform_tfsec` | [TFSec](https://github.com/liamg/tfsec) static analysis of terraform templates to spot potential security issues. [Hook notes](#terraform_tfsec) | -| `checkov` | [checkov](https://github.com/bridgecrewio/checkov) static analysis of terraform templates to spot potential security issues. | | `terrascan` | [terrascan](https://github.com/accurics/terrascan) Detect compliance and security violations. | Check the [source file](https://github.com/antonbabenko/pre-commit-terraform/blob/master/.pre-commit-hooks.yaml) to know arguments used for each hook. -## Hooks notes +## Hooks usage notes and examples + +### checkov + +For [checkov](https://github.com/bridgecrewio/checkov) you need to specify each argument separately: + +```yaml +hooks: + - id: checkov + args: [ + "-d", ".", + "--skip-check", "CKV2_AWS_8", + ] +``` ### terraform_docs