Feat terrascan compliance (#146)

Author: penguinjournals

.github/workflows/ci-pull-request.yaml

@@ -72,6 +72,7 @@ jobs:
         run: |
           pip install pre-commit
           go install github.com/hashicorp/terraform-config-inspect@latest
+          make deps
 
       - name: Execute generate-terraform-providers for organizational
         if: ${{ matrix.directory !=  '.' }}
@@ -128,9 +129,7 @@ jobs:
       - name: Install pre-commit dependencies
         run: |
           pip install pre-commit
-          go install github.com/terraform-docs/terraform-docs@v0.16.0
-          go install github.com/hashicorp/terraform-config-inspect@latest
-          curl -L "$(curl -s https://api.github.com/repos/terraform-linters/tflint/releases/latest | grep -o -E "https://.+?_linux_amd64.zip")" > tflint.zip && unzip tflint.zip && rm tflint.zip && sudo mv tflint /usr/bin/
+          make deps
       - name: Clean pre-commit cache
         run: pre-commit clean
       - name: Execute pre-commit max_version

.pre-commit-config.yaml

@@ -70,6 +70,10 @@ repos:
       # https://github.com/antonbabenko/pre-commit-terraform#terraform_validate
       - id: terraform_validate
         exclude: (test)|(examples-internal)\/.*$
+      - id: terrascan
+        exclude: (test)
+        args:
+          - '--args=--skip-rules AC_AWS_0369'
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v4.1.0
     hooks:

Makefile

@@ -5,6 +5,11 @@ deps:
 		unzip tflint.zip && \
 		rm tflint.zip && \
 		mv tflint "`go env GOPATH`/bin"
+	curl -L https://github.com/tenable/terrascan/releases/download/v1.9.0/terrascan_1.9.0_Linux_x86_64.tar.gz -o terrascan.tar.gz && \
+                tar -xf terrascan.tar.gz terrascan && \
+                rm terrascan.tar.gz && \
+                install terrascan "`go env GOPATH`/bin" && \
+                rm terrascan
 
 clean:
 	find -name ".terraform" -type d | xargs rm -rf

modules/infrastructure/cloudtrail/s3.tf

@@ -1,4 +1,10 @@
 resource "aws_s3_bucket" "cloudtrail" {
+  # AC_AWS_0214
+  # Why: S3 bucket versioning is disabled
+  #ts:skip=AC_AWS_0214 S3 is for testing purpose by the customer. In production S3 it's pretended to be provided by the customer with the logging related decisions taken by them as it has costs.
+  # AC_AWS_0497
+  # Why: S3 access logging is disabled
+  #ts:skip=AC_AWS_0497 S3 is for testing purpose by the customer. In production S3 it's pretended to be provided by the customer with the logging related decisions taken by them as it has costs.
   bucket        = "${var.name}-${data.aws_caller_identity.me.account_id}"
   force_destroy = true
   tags          = var.tags

modules/infrastructure/cloudtrail/sns.tf

@@ -1,4 +1,7 @@
 resource "aws_sns_topic" "cloudtrail" {
+  # AC_AWS_0502
+  # Why: Encrypt SNS with KMS
+  #ts:skip=AC_AWS_0502 Don't encrypt as far as SNS can be provided by customer
   name = var.name
   tags = var.tags
 }

modules/infrastructure/cloudtrail_s3-sns-sqs/main.tf

@@ -13,8 +13,10 @@ locals {
 
 
 resource "aws_sns_topic" "s3_sns" {
-  name = local.s3_sns_name
-
+  # AC_AWS_0502
+  # Why: Encrypt SNS with KMS
+  #ts:skip=AC_AWS_0502 Don't encrypt as far as SNS can be provided by customer
+  name   = local.s3_sns_name
   policy = <<POLICY
 {
     "Version":"2012-10-17",

modules/infrastructure/ecs-vpc/vpc.tf

@@ -3,6 +3,8 @@ data "aws_availability_zones" "zones" {
 
 # https://registry.terraform.io/modules/terraform-aws-modules/vpc/aws/latest
 module "vpc" {
+  # AC_AWS_0369
+  #ts:skip=AC_AWS_0369 Cannot be ignored on external module
   source  = "terraform-aws-modules/vpc/aws"
   version = ">=3.14.0"
 

modules/infrastructure/permissions/iam-user/main.tf

@@ -5,6 +5,8 @@ resource "aws_iam_user" "this" {
 }
 
 resource "aws_iam_access_key" "this" {
+  # AC_AWS_0133
+  #ts:skip=AC_AWS_0133 Doesn't apply
   user = aws_iam_user.this.name
   lifecycle {
     create_before_destroy = true

modules/infrastructure/sqs-sns-subscription/main.tf

@@ -1,4 +1,7 @@
 resource "aws_sqs_queue" "this" {
+  # AC_AWS_0366
+  # Why: Ensure that your Amazon Simple Queue Service (SQS) queues are protecting the contents of their messages using Server-Side Encryption (SSE).
+  #ts:skip=AC_AWS_0366 Doesn't apply as the content of the event is stored on S3 not on the log
   name = var.name
   tags = var.tags
 }
@@ -8,6 +11,7 @@ resource "aws_sns_topic_subscription" "this" {
   protocol  = "sqs"
   endpoint  = aws_sqs_queue.this.arn
   topic_arn = var.cloudtrail_sns_arn
+
 }
 
 resource "aws_sqs_queue_policy" "this" {

modules/infrastructure/eks/README.md renamed to test/eks/README.md

@@ -2,7 +2,7 @@
 
 ```terraform
 module "eks"{
-  source = "sysdiglabs/secure-for-cloud/aws//modules/infrastructure/eks"
+  source = "sysdiglabs/secure-for-cloud/aws//test/eks"
   default_vpc_subnets = ["<SUBNET_1>", "<SUBNET_2>"]
   name = "<IDENTIFYING_NAME>"
 }