-
-
Notifications
You must be signed in to change notification settings - Fork 1.3k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* Add initial support for opa * Make sure to install opa * Fix typo * Install opa bin as opa * Add function for running opa eval on all terraform modules in a repo * Update rego policy docs * Add debug flag to keep the temp folder * Expose the HCLFileToJSONFile function * Log temp folder being created * Does not have to be absolute path * Update comments so they can be shown on terratest website
- Loading branch information
1 parent
2ac0998
commit a0c867c
Showing
20 changed files
with
463 additions
and
22 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,34 @@ | ||
| # Terraform OPA Example | ||
|
|
||
| This folder contains an [OPA](https://www.openpolicyagent.org/) policy that validates that all module blocks use a | ||
| source that comes from the `gruntwork-io` GitHub org (the [enforce_source.rego](./policy/enforce_source.rego) file). | ||
| To test this policy, we provided two Terraform modules, [pass](./pass) and [fail](./fail), which will demonstrate how | ||
| OPA looks when run against a module that passes the checks, and one that fails the checks. | ||
|
|
||
| Check out [test/terraform_opa_example_test.go](/test/terraform_opa_example_test.go) to see how you can write automated | ||
| tests for this module. | ||
|
|
||
|
|
||
| ## Running this module manually | ||
|
|
||
| 1. Install [OPA](https://www.openpolicyagent.org/) and make sure it's on your `PATH`. | ||
| 1. Install [hcl2json](https://github.com/tmccombs/hcl2json) and make sure it's on your `PATH`. We need this to convert | ||
| the terraform source code to json as OPA currently doesn't support parsing HCL. | ||
| 1. Convert each terraform source code in the `pass` or `fail` folder to json by feeding it to `hcl2json`: | ||
|
|
||
| hcl2json pass/main.tf > pass/main.json | ||
|
|
||
| 1. Run each converted terraform json file against the OPA policy: | ||
|
|
||
| opa eval --fail \ | ||
| -i pass/main.json \ | ||
| -d policy/enforce_source.rego \ | ||
| 'data.enforce_source.allow' | ||
|
|
||
|
|
||
| ## Running automated tests against this module | ||
|
|
||
| 1. Install [OPA](https://www.openpolicyagent.org/) and make sure it's on your `PATH`. | ||
| 1. Install [Golang](https://golang.org/). | ||
| 1. `cd test` | ||
| 1. `go test -v -run TestOPAEvalTerraformModule` |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| module "instance_types" { | ||
| # website::tag::1:: We expect this to fail the OPA check since it is sourcing the module locally and not from gruntwork-io GitHub. | ||
| source = "../pass" | ||
| aws_region = var.aws_region | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
| output "recommended_instance_type" { | ||
| description = "The recommended instance type to use in this AWS region. This will be the first instance type in var.instance_types which is available in all AZs in this region." | ||
| value = module.instance_types.recommended_instance_type | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
| variable "aws_region" { | ||
| description = "Region to run the instance type checks on" | ||
| type = string | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| provider "aws" { | ||
| region = var.aws_region | ||
| } | ||
|
|
||
| module "instance_types" { | ||
| # website::tag::1:: We expect this to pass the OPA check since it is sourcing the module from gruntwork-io GitHub. | ||
| source = "git::[email protected]:gruntwork-io/terraform-aws-utilities.git//modules/instance-type?ref=v0.6.0" | ||
| instance_types = ["t2.micro", "t3.micro"] | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
| output "recommended_instance_type" { | ||
| description = "The recommended instance type to use in this AWS region. This will be the first instance type in var.instance_types which is available in all AZs in this region." | ||
| value = module.instance_types.recommended_instance_type | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
| variable "aws_region" { | ||
| description = "Region to run the instance type checks on" | ||
| type = string | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,25 @@ | ||
| # An example rego policy of how to enforce that all module blocks in terraform json representation source the module | ||
| # from the gruntwork-io github repo on the json representation of the terraform source files. A module block in the json | ||
| # representation looks like the | ||
| # following: | ||
| # | ||
| # { | ||
| # "module": { | ||
| # "MODULE_LABEL": [{ | ||
| # #BLOCK_CONTENT | ||
| # }] | ||
| # } | ||
| # } | ||
| package enforce_source | ||
|
|
||
|
|
||
| # website::tag::1:: Only define the allow variable and set to true if the violation set is empty. | ||
| allow = true { | ||
| count(violation) == 0 | ||
| } | ||
|
|
||
| # website::tag::1:: Add modules with module_label to the violation set if the source attribute does not start with a string indicating it came from gruntwork-io GitHub org. | ||
| violation[module_label] { | ||
| some module_label, i | ||
| startswith(input.module[module_label][i].source, "git::[email protected]:gruntwork-io") == false | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.