Skip to content

Commit 4e5b282

Browse files
GooygeekGooygeek
authored
Merge pull request #1 from Gooygeek/feat/new-format
Feat/new format
2 parents 0b9c76a + cc3e793 commit 4e5b282

File tree

8 files changed

+318
-48
lines changed

8 files changed

+318
-48
lines changed

‎.env.template‎

Whitespace-only changes.

‎.github/workflows/release.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,5 +23,5 @@ jobs:
2323
npm install @semantic-release/exec
2424
- name: "release :: tag repo"
2525
env:
26-
GITHUB_TOKEN: ${{ secrets.X_GITHUB_TOKEN }}
26+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
2727
run: npx semantic-release

‎.github/workflows/terraform.yml‎

Lines changed: 121 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -1,63 +1,137 @@
1-
name: Terraform
2-
on: [push]
1+
name: 'Terraform'
2+
on:
3+
push:
4+
branches:
5+
- main
6+
pull_request:
37

48
env:
5-
TERRAFORM_VERSION: 1.0.9
9+
TERRAFORM_VERSION: 1.1.7
10+
TFLINT_VERSION: 0.34.1
611
AWS_DEFAULT_REGION: ap-southeast-2
712

813
jobs:
9-
format:
10-
name: Format
14+
terraform:
15+
name: 'Terraform'
1116
runs-on: ubuntu-latest
12-
timeout-minutes: 5
1317
steps:
1418
- name: Checkout
15-
uses: actions/[email protected]
16-
- name: Format all
17-
uses: hashicorp/[email protected]
19+
uses: actions/checkout@v2
20+
21+
- name: Setup Terraform
22+
uses: hashicorp/setup-terraform@v1
23+
# with:
24+
# terraform_version: ${{ env.TERRAFORM_VERSION }} ## Use the latest version
25+
# cli_config_credentials_token: ${{ secrets.TF_API_TOKEN }}
26+
27+
- name: Terraform Format
28+
id: fmt
29+
run: terraform fmt -check -diff
30+
continue-on-error: true
31+
32+
- name: Terraform Init
33+
id: init
34+
run: terraform init
35+
36+
- name: Terraform Validate
37+
id: validate
38+
run: terraform validate -no-color
39+
40+
# - name: Terraform Plan
41+
# id: plan
42+
# if: github.event_name == 'pull_request'
43+
# run: terraform plan -no-color
44+
# continue-on-error: true
45+
46+
- name: Update Pull Request
47+
uses: actions/[email protected]
48+
if: github.event_name == 'pull_request'
1849
env:
19-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
50+
FMT: "\n${{ steps.fmt.outputs.stdout }}"
51+
# PLAN: "terraform\n${{ steps.plan.outputs.stdout }}"
2052
with:
21-
tf_actions_version: ${{ env.TERRAFORM_VERSION }}
22-
tf_actions_comment: true
23-
tf_actions_subcommand: fmt
53+
github-token: ${{ secrets.GITHUB_TOKEN }}
54+
script: |
55+
const output = `#### Terraform Format and Style 🖌\`${{ steps.fmt.outcome }}\`
56+
#### Terraform Initialization ⚙️\`${{ steps.init.outcome }}\`
57+
#### Terraform Validation 🤖\`${{ steps.validate.outcome }}\`
58+
#### Terraform Plan 📖\`${{ steps.plan.outcome }}\`
59+
60+
<details>
61+
<summary>Show Format</summary>
62+
63+
\`\`\`diff
64+
${process.env.FMT}
65+
\`\`\`
66+
67+
</details>
68+
69+
*Pusher: @${{ github.actor }}, Action: \`${{ github.event_name }}\`*`;
70+
71+
github.issues.createComment({
72+
issue_number: context.issue.number,
73+
owner: context.repo.owner,
74+
repo: context.repo.repo,
75+
body: output
76+
})
77+
78+
### Add to the above details section if running a plan
79+
# <summary>Show Plan</summary>
80+
81+
# \`\`\`\n
82+
# ${process.env.PLAN}
83+
# \`\`\`
84+
85+
# - name: Terraform Plan Status
86+
# if: steps.plan.outcome == 'failure'
87+
# run: exit 1
88+
89+
# - name: Terraform Apply
90+
# if: github.ref == 'refs/heads/main' && github.event_name == 'push'
91+
# run: terraform apply -auto-approve
2492

25-
validate:
26-
name: Validate
93+
tflint:
94+
name: Lint
95+
needs: terraform
2796
runs-on: ubuntu-latest
28-
timeout-minutes: 5
29-
strategy:
30-
matrix:
31-
dir:
32-
- '.'
3397
steps:
34-
- name: Checkout
35-
uses: actions/[email protected]
36-
- name: Init
37-
uses: hashicorp/[email protected]
38-
env:
39-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
40-
with:
41-
tf_actions_version: ${{ env.TERRAFORM_VERSION }}
42-
tf_actions_working_dir: ${{ matrix.dir }}
43-
tf_actions_comment: true
44-
tf_actions_subcommand: init
45-
- name: Validate
46-
uses: hashicorp/[email protected]
47-
env:
48-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
49-
with:
50-
tf_actions_version: ${{ env.TERRAFORM_VERSION }}
51-
tf_actions_working_dir: ${{ matrix.dir }}
52-
tf_actions_comment: true
53-
tf_actions_subcommand: validate
98+
- name: Checkout
99+
uses: actions/checkout@v2
54100

55-
lint:
56-
name: Lint
101+
- name: Cache plugin dir
102+
uses: actions/cache@v2
103+
with:
104+
path: ~/.tflint.d/plugins
105+
key: ubuntu-latest-tflint-${{ hashFiles('.tflint.hcl') }}
106+
107+
- name: Setup TFLint
108+
uses: terraform-linters/setup-tflint@v1
109+
with:
110+
tflint_version: "v${{ env.TFLINT_VERSION }}"
111+
github_token: ${{ secrets.GITHUB_TOKEN }}
112+
113+
- name: Show version
114+
run: tflint --version
115+
116+
- name: Init TFLint
117+
run: tflint --init
118+
119+
- name: Run TFLint
120+
run: tflint -f compact
121+
122+
tfdocs:
123+
needs: tflint
57124
runs-on: ubuntu-latest
58-
timeout-minutes: 5
59125
steps:
60-
- name: Checkout
61-
uses: actions/[email protected]
62-
- name: TFLint
63-
run: docker run --rm -v ${PWD}:/data ghcr.io/terraform-linters/tflint
126+
- name: Checkout
127+
uses: actions/checkout@v2
128+
with:
129+
ref: ${{ github.event.pull_request.head.ref }}
130+
131+
- name: Render terraform docs and push changes back to PR
132+
uses: terraform-docs/gh-actions@main
133+
with:
134+
working-dir: .
135+
output-file: README.md
136+
output-method: inject
137+
git-push: "true"

‎.tflint.hcl‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
config {
2+
plugin_dir = "./.tflint.d/plugins"
3+
}
4+
5+
# TF Rules
6+
7+
rule "terraform_comment_syntax" {
8+
enabled = true
9+
}
10+
11+
rule "terraform_documented_outputs" {
12+
enabled = true
13+
}
14+
15+
rule "terraform_documented_variables" {
16+
enabled = true
17+
}
18+
19+
rule "terraform_naming_convention" {
20+
enabled = true
21+
}
22+
23+
rule "terraform_required_providers" {
24+
enabled = true
25+
}
26+
27+
rule "terraform_required_version" {
28+
enabled = true
29+
}
30+
31+
rule "terraform_typed_variables" {
32+
enabled = true
33+
}
34+
35+
rule "terraform_unused_declarations" {
36+
enabled = true
37+
}
38+
39+
rule "terraform_unused_required_providers" {
40+
enabled = true
41+
}
42+
43+
# AWS
44+
45+
plugin "aws" {
46+
enabled = true
47+
version = "0.12.0"
48+
source = "github.com/terraform-linters/tflint-ruleset-aws"
49+
}

‎Makefile‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
2+
COMPOSE_RUN_TF = docker-compose run terraform
3+
COMPOSE_TF_LINT = docker-compose run terraform-lint
4+
COMPOSE_TF_DOCS = docker-compose run terraform-docs
5+
6+
.env: ## Create .env file
7+
@echo "No .env file found. Create new .env using .env.template"
8+
cp .env.template .env
9+
10+
.PHONY: init
11+
init: .env
12+
$(COMPOSE_RUN_TF) terraform init
13+
14+
.PHONY: #validate
15+
validate: .env init
16+
$(COMPOSE_RUN_TF) terraform validate
17+
18+
.PHONY: format
19+
format: .env #init
20+
$(COMPOSE_RUN_TF) terraform fmt
21+
22+
.PHONY: lint
23+
lint: .env #init
24+
$(COMPOSE_TF_LINT) --init
25+
$(COMPOSE_TF_LINT) --version
26+
$(COMPOSE_TF_LINT) --format compact
27+
28+
.PHONY: docs
29+
docs: .env init
30+
$(COMPOSE_TF_DOCS) markdown --output-file README.md --output-mode inject .
31+
32+
.PHONY: precommit
33+
precommit: .env init validate format lint docs
34+
echo "Done"
35+
36+
.PHONY: clean
37+
clean:
38+
rm -rf .env .terraform *.tfstate .tflint.d

‎README.md‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -139,3 +139,77 @@ You can send a test email once the deployment is complete and you have confirmed
139139
## License
140140

141141
This library is licensed under the MIT License. See the LICENSE file.
142+
143+
<!-- BEGIN_TF_DOCS -->
144+
## Requirements
145+
146+
| Name | Version |
147+
|------|---------|
148+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | ~> 1.0 |
149+
| <a name="requirement_archive"></a> [archive](#requirement\_archive) | ~> 2.0 |
150+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.0, < 5.0.0 |
151+
152+
## Providers
153+
154+
| Name | Version |
155+
|------|---------|
156+
| <a name="provider_archive"></a> [archive](#provider\_archive) | ~> 2.0 |
157+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 3.0, < 5.0.0 |
158+
159+
## Modules
160+
161+
No modules.
162+
163+
## Resources
164+
165+
| Name | Type |
166+
|------|------|
167+
| [aws_cloudwatch_event_rule.trigger](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_rule) | resource |
168+
| [aws_cloudwatch_event_target.lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_target) | resource |
169+
| [aws_iam_role.iam_for_lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
170+
| [aws_lambda_function.sechub_summariser](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_function) | resource |
171+
| [aws_lambda_permission.trigger](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_permission) | resource |
172+
| [aws_securityhub_insight.all_by_severity](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/securityhub_insight) | resource |
173+
| [aws_securityhub_insight.auditman_by_severity](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/securityhub_insight) | resource |
174+
| [aws_securityhub_insight.aws_best_prac_by_severity](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/securityhub_insight) | resource |
175+
| [aws_securityhub_insight.aws_best_prac_by_status](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/securityhub_insight) | resource |
176+
| [aws_securityhub_insight.chatbot_by_severity](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/securityhub_insight) | resource |
177+
| [aws_securityhub_insight.cis_by_severity](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/securityhub_insight) | resource |
178+
| [aws_securityhub_insight.cis_by_status](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/securityhub_insight) | resource |
179+
| [aws_securityhub_insight.detective_by_severity](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/securityhub_insight) | resource |
180+
| [aws_securityhub_insight.fwman_by_severity](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/securityhub_insight) | resource |
181+
| [aws_securityhub_insight.guardduty_by_severity](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/securityhub_insight) | resource |
182+
| [aws_securityhub_insight.health_by_severity](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/securityhub_insight) | resource |
183+
| [aws_securityhub_insight.iam_by_severity](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/securityhub_insight) | resource |
184+
| [aws_securityhub_insight.inspector_by_severity](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/securityhub_insight) | resource |
185+
| [aws_securityhub_insight.macie_by_severity](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/securityhub_insight) | resource |
186+
| [aws_securityhub_insight.new_findings](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/securityhub_insight) | resource |
187+
| [aws_securityhub_insight.ssmops_by_severity](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/securityhub_insight) | resource |
188+
| [aws_securityhub_insight.ssmpm_by_severity](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/securityhub_insight) | resource |
189+
| [aws_securityhub_insight.ta_by_severity](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/securityhub_insight) | resource |
190+
| [aws_securityhub_insight.top_resource_types](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/securityhub_insight) | resource |
191+
| [aws_sns_topic.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sns_topic) | resource |
192+
| [aws_sns_topic_subscription.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sns_topic_subscription) | resource |
193+
| [archive_file.code](https://registry.terraform.io/providers/hashicorp/archive/latest/docs/data-sources/file) | data source |
194+
| [aws_partition.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |
195+
196+
## Inputs
197+
198+
| Name | Description | Type | Default | Required |
199+
|------|-------------|------|---------|:--------:|
200+
| <a name="input_additional_email_footer_text"></a> [additional\_email\_footer\_text](#input\_additional\_email\_footer\_text) | Additional text to append at the end of email message | `string` | `""` | no |
201+
| <a name="input_additional_email_header_text"></a> [additional\_email\_header\_text](#input\_additional\_email\_header\_text) | Additional text to prepend at the start of email message | `string` | `""` | no |
202+
| <a name="input_email"></a> [email](#input\_email) | Email Address for Subscriber to Security Hub summary. Only used if SNS arn is not specified | `string` | `null` | no |
203+
| <a name="input_insights"></a> [insights](#input\_insights) | list of insights and in what order to include in the summary. | `list(any)` | `[]` | no |
204+
| <a name="input_kms_key_id"></a> [kms\_key\_id](#input\_kms\_key\_id) | KMS Key ID to use for encrypting the topic | `string` | `"alias/aws/sns"` | no |
205+
| <a name="input_name"></a> [name](#input\_name) | ID element | `string` | `"sechub-summariser"` | no |
206+
| <a name="input_schedule"></a> [schedule](#input\_schedule) | Expression for scheduling the Security Hub summary email. Default: Every Monday 8:00 AM UTC. Example: Every Friday 9:00 AM UTC: cron(0 9 ? * 6 *) | `string` | `"cron(0 8 ? * 2 *)"` | no |
207+
| <a name="input_sns_topic_arn"></a> [sns\_topic\_arn](#input\_sns\_topic\_arn) | ARN of the SNS Topic to send summaries to. If empty, a topic is created for you. | `string` | `null` | no |
208+
| <a name="input_tags"></a> [tags](#input\_tags) | Additional tags | `map(string)` | `{}` | no |
209+
210+
## Outputs
211+
212+
| Name | Description |
213+
|------|-------------|
214+
| <a name="output_sns_topic_arn"></a> [sns\_topic\_arn](#output\_sns\_topic\_arn) | The SNS topic that was created |
215+
<!-- END_TF_DOCS -->

‎docker-compose.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
version: '3.6'
2+
3+
services:
4+
terraform:
5+
image: hashicorp/terraform:1.1.7
6+
env_file: .env
7+
entrypoint: []
8+
working_dir: /opt/app
9+
volumes:
10+
- .:/opt/app:rw
11+
terraform-lint:
12+
image: ghcr.io/terraform-linters/tflint
13+
env_file: .env
14+
working_dir: /opt/app
15+
volumes:
16+
- .:/opt/app:rw
17+
terraform-docs:
18+
image: quay.io/terraform-docs/terraform-docs:0.16.0
19+
env_file: .env
20+
working_dir: /opt/app
21+
volumes:
22+
- .:/opt/app:rw

‎providers.tf‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
terraform {
2+
required_version = "~> 1.0"
3+
required_providers {
4+
aws = {
5+
source = "hashicorp/aws"
6+
version = ">= 3.0, < 5.0.0"
7+
}
8+
archive = {
9+
source = "hashicorp/archive"
10+
version = "~> 2.0"
11+
}
12+
}
13+
}

0 commit comments

Comments
 (0)