Skip to content

Commit cc8acb5

Browse files
ksatirliksatirli
authored
adds Module Code (#1)
* adds module code and documentation * adds basic example and documentation
1 parent 3321ddc commit cc8acb5

32 files changed

+1494
-0
lines changed

‎.github/CODEOWNERS

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
* @ksatirli @drewmullen

‎.github/workflows/snyk.yml

+51
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
---
2+
name: "Security Scan: Snyk IaC"
3+
4+
on:
5+
pull_request:
6+
7+
jobs:
8+
snyk:
9+
runs-on: ubuntu-latest
10+
11+
strategy:
12+
# see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstrategyfail-fast
13+
fail-fast: false
14+
matrix:
15+
# The Snyk IaC GitHub Action currently only supports single files (via the `file` attribute in `with`).
16+
# To work around this, a GitHub Actions Strategy is used to provide the files that should be tested.
17+
terraform_files:
18+
- iam.tf
19+
- main.tf
20+
- networking.tf
21+
- outputs.tf
22+
- storage.tf
23+
- terraform.tf
24+
- variables.tf
25+
- examples/basic/main.tf
26+
- examples/basic/providers.tf
27+
- examples/basic/terraform.tf
28+
29+
steps:
30+
- name: Checkout Repository
31+
uses: actions/checkout@v2
32+
with:
33+
fetch-depth: 1
34+
35+
# see https://github.com/snyk/actions/tree/master/iac
36+
- name: Lint Code with Snyk
37+
uses: snyk/actions/iac@master
38+
env:
39+
# see https://github.com/snyk/actions#getting-your-snyk-token
40+
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
41+
with:
42+
file: ${{ matrix.terraform_files }}
43+
# see https://docs.snyk.io/products/snyk-infrastructure-as-code/snyk-cli-for-infrastructure-as-code/iac-ignores-using-the-.snyk-policy-file#policy-flags-and-policy-file-notes
44+
args: --policy-path=.snyk --org=${{ secrets.SNYK_ORG }}
45+
sarif: true
46+
47+
# see https://github.com/github/codeql-action/tree/main/upload-sarif
48+
- name: Upload Snyk IaC results to GitHub Code Scanning
49+
uses: github/codeql-action/upload-sarif@v1
50+
with:
51+
sarif_file: snyk.sarif

‎.github/workflows/superlinter.yml

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
---
2+
name: "Code Quality: Super-Linter"
3+
4+
on:
5+
pull_request:
6+
7+
jobs:
8+
superlinter:
9+
name: Super-Linter
10+
runs-on: ubuntu-latest
11+
steps:
12+
- name: Checkout Repository
13+
uses: actions/checkout@v2
14+
with:
15+
# Full git history is needed to get a proper list of changed files within `super-linter`
16+
fetch-depth: 0
17+
18+
- name: Lint Code with Super-Linter
19+
uses: github/super-linter@v4
20+
env:
21+
VALIDATE_ALL_CODEBASE: true
22+
DEFAULT_BRANCH: "main"
23+
DISABLE_ERRORS: false
24+
TERRAFORM_TFLINT_CONFIG_FILE: ".tflint.hcl"
25+
VALIDATE_BASH: true
26+
VALIDATE_JSON: true
27+
VALIDATE_MD: true
28+
VALIDATE_TERRAFORM: true

‎.github/workflows/terraform-docs.yml

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
---
2+
name: "Documentation: terraform-docs"
3+
4+
on:
5+
pull_request:
6+
7+
jobs:
8+
docs:
9+
runs-on: ubuntu-latest
10+
steps:
11+
- uses: actions/checkout@v2
12+
with:
13+
ref: ${{ github.event.pull_request.head.ref }}
14+
15+
- name: Render documentation for Module and push changes back to branch
16+
uses: terraform-docs/[email protected]
17+
with:
18+
config-file: ".terraform-docs.yml"
19+
output-file: "README.md"
20+
git-push: true
21+
22+
- name: Render documentation for `basic` example and push changes back to branch
23+
uses: terraform-docs/[email protected]
24+
with:
25+
config-file: "../../.terraform-docs.yml"
26+
output-file: "README.md"
27+
git-push: true
28+
working-dir: "./examples/basic"

‎.github/workflows/tfsec.yml

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
---
2+
name: "Security Scan: tfsec"
3+
4+
on:
5+
pull_request:
6+
7+
jobs:
8+
tfsec:
9+
runs-on: ubuntu-latest
10+
11+
steps:
12+
- name: Checkout Repository
13+
uses: actions/checkout@v2
14+
with:
15+
fetch-depth: 1
16+
17+
# see https://aquasecurity.github.io/tfsec/v0.63.1/getting-started/configuration/github-actions/github-action/
18+
- name: Lint Code with tfsec
19+
uses: aquasecurity/tfsec-sarif-action@master
20+
with:
21+
config_file: tfsec.yml
22+
sarif_file: tfsec.sarif
23+
24+
# see https://github.com/github/codeql-action/tree/main/upload-sarif
25+
- name: Upload tfsec results to GitHub Code Scanning
26+
uses: github/codeql-action/upload-sarif@v1
27+
with:
28+
sarif_file: tfsec.sarif

‎.pre-commit-config.yaml

+72
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
---
2+
3+
fail_fast: true
4+
minimum_pre_commit_version: "2.6.0"
5+
6+
repos:
7+
- # see https://github.com/pre-commit/pre-commit-hooks
8+
repo: https://github.com/pre-commit/pre-commit-hooks
9+
rev: v4.1.0
10+
hooks:
11+
- id: check-added-large-files
12+
name: Check for accidentally added Large Files
13+
14+
- id: check-case-conflict
15+
name: Check for cross-OS File Name Case Conflicts
16+
17+
- id: check-merge-conflict
18+
name: Check for Git Merge Conflicts
19+
20+
- id: check-vcs-permalinks
21+
name: Check VCS Permalinks
22+
23+
- id: check-json
24+
name: Validate JSON files
25+
26+
- id: check-yaml
27+
name: Validate YAML files
28+
29+
- # see https://github.com/antonbabenko/pre-commit-terraform
30+
repo: https://github.com/antonbabenko/pre-commit-terraform
31+
rev: v1.64.0
32+
hooks:
33+
# see https://github.com/antonbabenko/pre-commit-terraform#terraform_fmt
34+
- id: terraform_fmt
35+
name: Run `terraform fmt` recursively
36+
args:
37+
- --args=-recursive
38+
39+
# see https://github.com/antonbabenko/pre-commit-terraform#terraform_validate
40+
- id: terraform_validate
41+
name: Run `terraform validate` against `examples/basic`
42+
files: examples/basic
43+
44+
# see https://github.com/antonbabenko/pre-commit-terraform#terraform_docs
45+
- id: terraform_docs
46+
name: Render documentation for Module
47+
args:
48+
- "--args=--config=.terraform-docs.yml"
49+
50+
# see https://github.com/antonbabenko/pre-commit-terraform#terraform_docs
51+
- id: terraform_docs
52+
name: Render documentation for `basic` example
53+
files: examples/basic
54+
args:
55+
- "--args=--config=.terraform-docs.yml"
56+
57+
# see https://github.com/antonbabenko/pre-commit-terraform#terraform_providers_lock
58+
- id: terraform_providers_lock
59+
name: Run `terraform init` and `terraform providers lock`
60+
61+
# see https://github.com/antonbabenko/pre-commit-terraform#terraform_tflint
62+
- id: terraform_tflint
63+
name: Run `tflint`
64+
args:
65+
- "--args=--config=__GIT_WORKING_DIR__/.tflint.hcl"
66+
67+
# see https://github.com/antonbabenko/pre-commit-terraform#terraform_tfsec
68+
- id: terraform_tfsec
69+
name: Run `tfsec` against `examples/basic`
70+
files: "examples/basic"
71+
args:
72+
- --args= --config-file=__GIT_WORKING_DIR__/tfsec.yml

‎.snyk

+35
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
version: v1.22.1
2+
3+
# see https://docs.snyk.io/products/snyk-infrastructure-as-code/snyk-cli-for-infrastructure-as-code/iac-ignores-using-the-.snyk-policy-file
4+
ignore:
5+
# see https://snyk.io/security-rules/SNYK-CC-TF-4
6+
SNYK-CC-TF-4:
7+
- 'storage.tf > input > resource > aws_s3_bucket[main]':
8+
reason: Contents of S3 Bucket are meant for public consumption, encryption not required.
9+
10+
# see https://snyk.io/security-rules/SNYK-CC-TF-45
11+
SNYK-CC-TF-45:
12+
- 'storage.tf > input > resource > aws_s3_bucket[main] > logging':
13+
reason: Contents of S3 Bucket are meant for public consumption, logging not required.
14+
15+
# see # see https://snyk.io/security-rules/SNYK-CC-TF-95
16+
SNYK-CC-TF-95:
17+
- 'storage.tf > resource > aws_s3_bucket_public_access_block[main] > block_public_acls':
18+
reason: Contents of S3 Bucket are meant for public consumption, public access is intentional.
19+
20+
# see https://snyk.io/security-rules/SNYK-CC-TF-116
21+
SNYK-CC-TF-116:
22+
- 'iam.tf > resource > aws_iam_user_policy[main]':
23+
reason: Policy is user-specific and therefore attached directly (increase of management overhead is negligible due to use of Terraform).
24+
25+
# see https://snyk.io/security-rules/SNYK-CC-TF-124
26+
SNYK-CC-TF-124:
27+
- 'storage.tf > resource > aws_s3_bucket[main] > versioning > enabled':
28+
reason: Contents of S3 Bucket are meant for public consumption, versioning not required.
29+
30+
# see https://snyk.io/security-rules/SNYK-CC-TF-127
31+
SNYK-CC-TF-127:
32+
- 'storage.tf > resource > aws_s3_bucket[main] > versioning > mfa_delete':
33+
reason: Contents of S3 Bucket are meant for public consumption, MFA-Delete not required (or supported by Dropshare.app).
34+
35+
patch: {}

‎.terraform-docs.yml

+38
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
---
2+
3+
# see https://terraform-docs.io/user-guide/configuration/formatter/
4+
formatter: "markdown table"
5+
6+
# see https://terraform-docs.io/user-guide/configuration/output/
7+
output:
8+
file: "README.md"
9+
mode: inject
10+
template: |-
11+
<!-- BEGIN_TF_DOCS -->
12+
{{ .Content }}
13+
<!-- END_TF_DOCS -->
14+
15+
# see https://terraform-docs.io/user-guide/configuration/settings/
16+
settings:
17+
anchor: false
18+
color: true
19+
default: true
20+
escape: true
21+
indent: 3
22+
required: true
23+
sensitive: true
24+
type: true
25+
26+
# see https://terraform-docs.io/user-guide/configuration/sort/
27+
sort:
28+
enabled: true
29+
by: required
30+
31+
# see https://terraform-docs.io/user-guide/configuration/sections/
32+
sections:
33+
show:
34+
- inputs
35+
- outputs
36+
37+
# see https://terraform-docs.io/user-guide/configuration/version/
38+
version: ">= 0.16.0, < 1.0.0"

‎.tflint.hcl

+66
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
# https://github.com/terraform-linters/tflint/blob/master/docs/user-guide/module-inspection.md
2+
# borrowed & modified indefinitely from https://github.com/ksatirli/building-infrastructure-you-can-mostly-trust/blob/main/.tflint.hcl
3+
4+
config {
5+
module = true
6+
force = false
7+
}
8+
9+
plugin "aws" {
10+
enabled = true
11+
version = "0.12.0"
12+
source = "github.com/terraform-linters/tflint-ruleset-aws"
13+
}
14+
15+
rule "terraform_required_providers" {
16+
enabled = true
17+
}
18+
19+
rule "terraform_required_version" {
20+
enabled = true
21+
}
22+
23+
rule "terraform_naming_convention" {
24+
enabled = true
25+
format = "snake_case"
26+
}
27+
28+
rule "terraform_typed_variables" {
29+
enabled = true
30+
}
31+
32+
rule "terraform_unused_declarations" {
33+
enabled = true
34+
}
35+
36+
rule "terraform_comment_syntax" {
37+
enabled = true
38+
}
39+
40+
rule "terraform_deprecated_index" {
41+
enabled = true
42+
}
43+
44+
rule "terraform_deprecated_interpolation" {
45+
enabled = true
46+
}
47+
48+
rule "terraform_documented_outputs" {
49+
enabled = true
50+
}
51+
52+
rule "terraform_documented_variables" {
53+
enabled = true
54+
}
55+
56+
rule "terraform_module_pinned_source" {
57+
enabled = true
58+
}
59+
60+
rule "terraform_standard_module_structure" {
61+
enabled = true
62+
}
63+
64+
rule "terraform_workspace_remote" {
65+
enabled = true
66+
}

0 commit comments

Comments
 (0)